returnsandrefund.com Open in urlscan Pro
18.156.95.187  Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

• https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Freturnsandrefund.com%2F&domain=returnsandrefund.com&cw=1 HTTP 302
• https://mug.criteo.com/sid?cpp=1-vZ-Xw3cU1DQ0ZleTNSYVZiQmpKY2lDbFZZNzNwUmw2Y2p4TCtRa3JqYTZYMmFEQ1MzeG9wZlZ3K1J4SFVRaitTaitWdHFMRWxRQmVLd1ExL1NkZi9TQWhsbjh5dU5LdjhrTVZXRWFaNzQ2dTExczRrMVJnb1BmY2NuTjA5NG84K0pDbkt6UzV5OW1IKzZVdDRRM05qR2ZFdkdBRThlVHdKTXIyU2VqWWZuK1NYcDVBbDRnMDhrSUxQdGtZVGtXc3pqZTNoN1RJSEEvbFZ5OTZyOEYvb0MyeXMvLzJtaWpkR0ZDODFRY1lzOTMrbktrPXw&cppv=2

Request Chain 110

• https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
• https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG HTTP 302
• https://pixel.advertising.com/ups/55986/sync?uid=X_z3jAAAAKmfyjoG&_origin=0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG HTTP 302
• https://ups.analytics.yahoo.com/ups/55986/sync?uid=X_z3jAAAAKmfyjoG&_origin=0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa

Request Chain 111

• https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
• https://pixel.advertising.com/ups/55953/sync?uid=dc504058-6049-4c44-a824-c77956331a7e&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=dc504058-6049-4c44-a824-c77956331a7e

Request Chain 113

• https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
• https://pixel.advertising.com/ups/57304/sync?uid=CAESEGWHS_hypVBAG_m88jE4rPA&google_cver=1 HTTP 302
• https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEGWHS_hypVBAG_m88jE4rPA&google_cver=1&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa

Request Chain 148

• https://sb.scorecardresearch.com/b?c1=2&c2=20015427&ns__t=1609365391005&ns_c=UTF-8&cv=3.5&c8=All%20About%20Returns%20%26%20Refunds%20-&c7=https%3A%2F%2Freturnsandrefund.com%2F&c9= HTTP 302
• https://sb.scorecardresearch.com/b2?c1=2&c2=20015427&ns__t=1609365391005&ns_c=UTF-8&cv=3.5&c8=All%20About%20Returns%20%26%20Refunds%20-&c7=https%3A%2F%2Freturnsandrefund.com%2F&c9=&cs_ak_ss=1

Request Chain 211

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 213

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si

230 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response returnsandrefund.com/	102 KB 22 KB	956ms 859ms	Document text/html	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 9e2f12c7c7f3e435f8f7bf52db88162322f9f5bfe25ebef22da054d55c98a440 Request headers :method GET :authority returnsandrefund.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers age 47408 cache-control max-age=0, must-revalidate, no-cache, no-store content-encoding br content-type text/html; charset=UTF-8 date Wed, 30 Dec 2020 21:56:24 GMT display pub_site_sol expires Tue, 29 Dec 2020 21:56:24 GMT last-modified Wed, 30 Dec 2020 08:46:16 GMT pagespeed off response 200 server nginx/1.16.0 set-cookie ezoadgid_200400=-1; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 22:26:23 UTC ezoref_200400=; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 23:56:23 UTC ezoab_200400=mod1; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 23:56:23 UTC active_template::200400=pub_site.1609365383; Path=/; Domain=returnsandrefund.com; Expires=Fri, 01 Jan 2021 21:56:23 UTC ezopvc_200400=1; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 22:26:24 UTC ezepvv=0; Path=/; Domain=returnsandrefund.com; Expires=Thu, 31 Dec 2020 21:56:24 UTC lp_200400=https://returnsandrefund.com/; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 23:56:24 UTC ezovid_200400=471870135; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 22:26:24 UTC ezovuuidtime_200400=1609365384; Path=/; Domain=returnsandrefund.com; Expires=Fri, 01 Jan 2021 21:56:24 UTC ezovuuid_200400=54c416b0-e97c-416a-785d-4b0ba1f1edae; Path=/; Domain=returnsandrefund.com; Expires=Wed, 30 Dec 2020 22:26:24 UTC ezCMPCCS=true; Path=/; Domain=returnsandrefund.com; Expires=Thu, 30 Dec 2021 21:56:24 GMT vary Accept-Encoding Accept-Encoding x-cache HIT x-cache-hits 431 x-middleton-display pub_site_sol x-middleton-response 200 x-sol pub_site
GET H/1.1	200 OK	pwt.js Show response ads.pubmatic.com/AdServer/js/pwt/156983/3085/	278 KB 85 KB	324ms 72ms	Script text/javascript	2.18.233.180 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/pwt/156983/3085/pwt.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-233-180.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash 4211e2b7bee4be7a725b2cdddf171f8279ebf1bc6df449954695697d7e1f37cc Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 30 Dec 2020 21:56:24 GMT Content-Encoding gzip Last-Modified Thu, 03 Dec 2020 00:54:08 GMT Server Apache/2.2.15 (CentOS) ETag "1121094-45926-5b584cc25ceca" Vary Accept-Encoding P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control public, max-age=96225 Connection keep-alive Accept-Ranges bytes Content-Type text/javascript Content-Length 86636 Expires Fri, 01 Jan 2021 00:40:09 GMT
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 803 B	36ms 16ms	Script application/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:56:24 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	dall.js Show response go.ezodn.com/hb/	268 KB 73 KB	50ms 26ms	Script application/javascript	2606:4700:3031::681b:949d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::681b:949d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7bb709523a298ce2789c6e5fdd67cd0a5bc3c5b4d3e29b346f201219775b4efa Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} server cloudflare age 188605 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ME19Mk88lvvojSYuc%2Fa7C0zS5IYEGjBdfJZ2ro1Q6JAN%2FNSioH35shOpGt4Kl9NML1PNtqkgNH9%2BAaERRQ2yGE0h6awRwCYHe6p8EGfhu4wa0Xrx%2BSMk2nM%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=31536000 cf-ray 609f02b8f9e605b3-FRA cf-request-id 075740079f000005b368168000000001
GET H2	200	boise.js Show response returnsandrefund.com/detroitchicago/	983 B 465 B	45ms 38ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/boise.js?gcb=191-2&cb=1 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 41eb9054d5d5527274926b32631be8eb22dd6254f15a4d9d14cfe2688ea4f538 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 426
GET H2	200	1b228742a6de803c7e75b942176b1c5c.css returnsandrefund.com/wp-content/cache/min/1/	135 KB 42 KB	559ms 558ms	Stylesheet text/css	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/min/1/1b228742a6de803c7e75b942176b1c5c.css Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash cfa0b6813434822c15e932fae2a2e2032570de6d7c67f9fe164a41f1ca458ef9 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br x-sol orig age 80091 x-cache HIT x-middleton-display staticcontent_sol, orig_site_sol x-cache-hits 2 x-middleton-response 200 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type text/css; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, orig_site_sol expires Wed, 29 Dec 2021 23:41:34 GMT
GET H2	200	css fonts.googleapis.com/	5 KB 753 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:81d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3310c90bb20ae95e8558d8bfee23a9da2b938bc3304707e59055cb1fe8577f30 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 30 Dec 2020 21:56:24 GMT server ESF date Wed, 30 Dec 2020 21:56:24 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 30 Dec 2020 21:56:24 GMT
GET H2	200	jquery-1.12.4-wp.js Show response returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/jquery/	95 KB 32 KB	491ms 490ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/jquery/jquery-1.12.4-wp.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 age 40444 vary Accept-Encoding, Accept-Encoding,Origin x-cache HIT content-type application/javascript; charset=utf-8 x-middleton-display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 10:42:20 GMT cache-control max-age=31536000, public x-middleton-response 200 display staticcontent_sol, staticcontent_sol x-cache-hits 705
GET H2	200	responsive-menu-2d0c7103c561e01a415948234ca1514f.js Show response returnsandrefund.com/wp-content/cache/min/1/wp-content/themes/eleven40-pro/js/	765 B 397 B	385ms 378ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/min/1/wp-content/themes/eleven40-pro/js/responsive-menu-2d0c7103c561e01a415948234ca1514f.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 8e424541604f9439f054eb9e4e78925da8c4d2a77985f642f9f4b5f025424d48 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 37083 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 67 x-middleton-response 200 content-length 315 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 11:38:21 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	96 KB 39 KB	58ms 32ms	Script application/javascript	2a00:1450:4001:808::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-150748452-1 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ba5a1eb314c1bb6aad9644e3d97c06abc46b83072bb94daa262076ec992a2e9b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39020 x-xss-protection 0 last-modified Wed, 30 Dec 2020 21:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 30 Dec 2020 21:56:25 GMT
GET H2	200	cookieconsent.min.js Show response returnsandrefund.com/ezoic/	4 KB 2 KB	35ms 34ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/ezoic/cookieconsent.min.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:24 GMT content-encoding br last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 etag "11a4-5b7183ce08b00-gzip" vary Accept-Encoding, Accept-Encoding content-type application/javascript cache-control max-age=31536000, public accept-ranges bytes content-length 1707 expires Thu, 30 Dec 2021 21:56:24 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	133 KB 47 KB	47ms 21ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c221228ab25af041a5c8e218684dd4238acb17fc23b1a4a8c4864951550a3197 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 47107 x-xss-protection 0 server cafe etag 13290078405355148527 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 30 Dec 2020 21:56:25 GMT
GET H2	200	ezoic.png go.ezoic.net/utilcave_com/img/	1 KB 2 KB	35ms 6ms	Image image/png	2600:9000:206f:c400:2:cb38:840:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://go.ezoic.net/utilcave_com/img/ezoic.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206f:c400:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.16.0 / Resource Hash e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 01:42:03 GMT via 1.1 4162b603e4967e54c2386fa354705d6e.cloudfront.net (CloudFront) x-sol middleton age 72862 x-cache Hit from cloudfront x-middleton-display staticcontent_sol, staticcontent_sol content-length 1181 x-amz-cf-id aGoMTMULhloa419on1QqCe_Zzj9VeuQ4EIAroKxq6WYYLOPWHlFKMg== last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 etag "49d-5ac9ecc7b5bc0-gzip-gzip" vary Accept-Encoding,Accept-Encoding content-type image/png cache-control max-age=604800 x-amz-cf-pop FRA56-C1 display staticcontent_sol, staticcontent_sol expires Wed, 06 Jan 2021 01:42:03 GMT
GET H2	200	scripts-e3e808e4c8f662fd5729552caa9fa640.js Show response returnsandrefund.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/	10 KB 3 KB	396ms 390ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/min/1/wp-content/plugins/contact-form-7/includes/js/scripts-e3e808e4c8f662fd5729552caa9fa640.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash bac9d4fa2f18599dbacbcc346525d52ef56347c89d28dab61158fc40a6801ea1 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 38148 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 33 x-middleton-response 200 content-length 3076 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 11:20:37 GMT
GET H2	200	hoverIntent.min-1.8.1.js Show response returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/	1 KB 509 B	394ms 387ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/busting/1/wp-includes/js/hoverIntent.min-1.8.1.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 5036d77bc45902a3567f499ebf981076387d71995d6fab43c9be0cd0b962b230 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 40444 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 647 x-middleton-response 200 content-length 440 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 10:42:21 GMT
GET H2	200	superfish.min-1.7.10.js Show response returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/	4 KB 2 KB	387ms 380ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/superfish.min-1.7.10.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash ece565a1f66a32347dfed83562c428ff7736648de72b0027dd8f0e0f27e0c327 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 1119 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 2 x-middleton-response 200 content-length 1743 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 21:37:46 GMT
GET H2	200	superfish.args.min-3.3.3.js Show response returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/	132 B 219 B	451ms 444ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/menu/superfish.args.min-3.3.3.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 20550f7bcb2a817ac9a5879e04260da8268e971c0b8031a6b7a2f48a55ee60d5 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 85597 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 11 x-middleton-response 200 content-length 102 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Wed, 29 Dec 2021 22:09:48 GMT
GET H2	200	skip-links.min-3.3.3.js Show response returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/	386 B 279 B	403ms 396ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-content/cache/busting/1/wp-content/themes/genesis/lib/js/skip-links.min-3.3.3.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash ade38136058fcd75880d3673855aff859ee377d5915e59cccf24a973d418bebb Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 16028 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 5 x-middleton-response 200 content-length 188 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 17:29:17 GMT
GET H2	200	wp-embed.min.js Show response returnsandrefund.com/wp-includes/js/	1 KB 738 B	396ms 389ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/wp-includes/js/wp-embed.min.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 40444 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 639 x-middleton-response 200 content-length 670 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type application/javascript; charset=utf-8 cache-control max-age=31536000, public display staticcontent_sol, staticcontent_sol expires Thu, 30 Dec 2021 10:42:21 GMT
GET H2	200	houston.js Show response returnsandrefund.com/detroitchicago/	3 KB 1 KB	44ms 37ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/houston.js?gcb=2&cb=27 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash bc9f09ed09d7297e39457f94fa1c015406d38e730110e8d7b70b9a02e572dcd0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 1100
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	54 KB 19 KB	159ms 56ms	Script text/javascript	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software sffe / Resource Hash c363b72222f753b0aa8dffcabc965119b45a1d96241416b48edea991f264722a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "740 / 971 of 1000 / last-modified: 1608034737" vary Accept-Encoding content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18850 x-xss-protection 0 expires Wed, 30 Dec 2020 21:56:25 GMT
GET H2	200	banger.js Show response returnsandrefund.com/porpoiseant/	51 KB 11 KB	49ms 43ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/porpoiseant/banger.js?cb=191-2&bv=94&v=36&PageSpeed=off Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 461f2d9c1a9f4ed984905dac71644f31c99298d7e5f030be04cd42fd1edc962b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 cache-control max-age=31536000, public vary Accept-Encoding, Accept-Encoding content-type application/javascript
GET H2	200	memphis.js Show response returnsandrefund.com/detroitchicago/	5 KB 1 KB	56ms 49ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/memphis.js?gcb=191-2&cb=2 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 3280d840db75382b0a366d79bcd0dbe276a33e62b7be641e27b8b4bf68f66156 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 1463
GET H2	200	minneapolis.js Show response returnsandrefund.com/detroitchicago/	845 B 451 B	55ms 49ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/minneapolis.js?gcb=191-2&cb=1 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash aa475af0fb05e1b76590fbc8eb5b49d3c1e772a8efbde59c9991e07972f1223e Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 419
GET H2	200	raleigh.js Show response returnsandrefund.com/detroitchicago/	2 KB 814 B	54ms 49ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/raleigh.js?gcb=191-2&cb=2 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 12ceaaa105abb177182163d2b3c95418076c4cd7881b107e39e1ae77dde7f7c1 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 782
GET H2	200	tampa.js Show response returnsandrefund.com/detroitchicago/	754 B 437 B	54ms 48ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/tampa.js?gcb=191-2&cb=1 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash a2bd6d03b5ca4077052ad35975e64c93f8d790133a8ba0eea95d20fb5beb0b09 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 405
GET H2	200	rochester.js Show response returnsandrefund.com/detroitchicago/	2 KB 783 B	53ms 48ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/rochester.js?cb=191-2&v=9 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 777cc56d4fcbc36f7a94abab1b63d6c20cf73def1bc63f02aa2313b0aa609ada Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 751
GET H2	200	sid Show response mug.criteo.com/ Redirect Chain https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Freturnsandrefund.com%2F&domain=returnsandrefund.com&cw=1 https://mug.criteo.com/sid?cpp=1-vZ-Xw3cU1DQ0ZleTNSYVZiQmpKY2lDbFZZNzNwUmw2Y2p4TCtRa3JqYTZYMmFEQ1MzeG9wZlZ3K1J4SFVRaitTaitWdHFMRWxRQmVLd1ExL1NkZi9TQWhsbjh5dU5LdjhrTVZXRWFaNzQ2dTExczRrMVJnb1BmY2NuTj...	369 B 662 B	99ms 32ms	XHR application/json	178.250.2.146 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://mug.criteo.com/sid?cpp=1-vZ-Xw3cU1DQ0ZleTNSYVZiQmpKY2lDbFZZNzNwUmw2Y2p4TCtRa3JqYTZYMmFEQ1MzeG9wZlZ3K1J4SFVRaitTaitWdHFMRWxRQmVLd1ExL1NkZi9TQWhsbjh5dU5LdjhrTVZXRWFaNzQ2dTExczRrMVJnb1BmY2NuTjA5NG84K0pDbkt6UzV5OW1IKzZVdDRRM05qR2ZFdkdBRThlVHdKTXIyU2VqWWZuK1NYcDVBbDRnMDhrSUxQdGtZVGtXc3pqZTNoN1RJSEEvbFZ5OTZyOEYvb0MyeXMvLzJtaWpkR0ZDODFRY1lzOTMrbktrPXw&cppv=2 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software / Resource Hash 24057a1db7e1d1138393b860d7bbb5e1fbae9440cee0a40b4ea7b148fd0e3381 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000 date Wed, 30 Dec 2020 21:56:24 GMT access-control-allow-methods GET content-type application/json; charset=utf-8 access-control-allow-origin null cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true server-processing-duration-in-ticks 1049 content-length 369 expires 0 Redirect headers pragma no-cache strict-transport-security max-age=31536000 date Wed, 30 Dec 2020 21:56:24 GMT location https://mug.criteo.com/sid?cpp=1-vZ-Xw3cU1DQ0ZleTNSYVZiQmpKY2lDbFZZNzNwUmw2Y2p4TCtRa3JqYTZYMmFEQ1MzeG9wZlZ3K1J4SFVRaitTaitWdHFMRWxRQmVLd1ExL1NkZi9TQWhsbjh5dU5LdjhrTVZXRWFaNzQ2dTExczRrMVJnb1BmY2NuTjA5NG84K0pDbkt6UzV5OW1IKzZVdDRRM05qR2ZFdkdBRThlVHdKTXIyU2VqWWZuK1NYcDVBbDRnMDhrSUxQdGtZVGtXc3pqZTNoN1RJSEEvbFZ5OTZyOEYvb0MyeXMvLzJtaWpkR0ZDODFRY1lzOTMrbktrPXw&cppv=2 access-control-allow-methods GET content-type text/html; charset=utf-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true server-processing-duration-in-ticks 1031 content-length 482 expires 0
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	30ms 6ms	Script text/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 124 date Wed, 30 Dec 2020 21:54:21 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17168 expires Wed, 30 Dec 2020 23:54:21 GMT
GET H2	200	ezosuigeneris.js Show response g.ezoic.net/	555 B 562 B	112ms 37ms	Script text/javascript	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/ezosuigeneris.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 0e4f02ef1c6c9d7dd0739b2ad87d06bff97353ed8abb4fa765f5edb6317d3967 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 etag 589e7d9040c388dc80b88a4ebcb19e76 vary Accept-Encoding, Accept-Encoding content-type text/javascript cache-control max-age=999999, private content-length 276 expires Mon, 29 Apr 2020 21:44:55 GMT
GET H2	200	return-logo-2.png returnsandrefund.com/wp-content/uploads/2019/03/	1 KB 1 KB	408ms 403ms	Image image/png	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/wp-content/uploads/2019/03/return-logo-2.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 31f7540a6075e6f34980199d420271d13d923801da426c060ed01732042a96b8 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br age 80091 x-cache HIT x-middleton-display staticcontent_sol, staticcontent_sol x-cache-hits 2 x-middleton-response 200 content-length 1075 response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding,Origin content-type image/png cache-control max-age=10368000, public display staticcontent_sol, staticcontent_sol expires Wed, 28 Apr 2021 23:41:34 GMT
GET H2	200	l.svg returnsandrefund.com/utilcave_com/	965 B 536 B	58ms 53ms	Image image/svg+xml	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/utilcave_com/l.svg Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 9cc19c02d87c3360d404c6dcf6e7982304f5e54abda4209de7a3bc44d3c54883 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 display staticcontent_sol, staticcontent_sol etag "3c5-5ac9ecc7b5bc0-gzip-gzip" vary Accept-Encoding, Accept-Encoding,Origin content-type image/svg+xml x-middleton-display staticcontent_sol, staticcontent_sol cache-control max-age=604800 x-sol middleton content-length 422 expires Wed, 06 Jan 2021 21:56:25 GMT
GET H2	200	TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiYySUhiCXAA.woff fonts.gstatic.com/s/oswald/v35/	12 KB 12 KB	9ms 5ms	Font font/woff	2a00:1450:4001:825::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/oswald/v35/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUZiYySUhiCXAA.woff Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6b810957ff3f3c7c207fbb3b24a0c9370f2b23bc94e7acfebceefa0d2976ac99 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://returnsandrefund.com Referer https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 28 Dec 2020 22:14:39 GMT x-content-type-options nosniff last-modified Mon, 13 Jul 2020 19:17:24 GMT server sffe age 171706 content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 12672 x-xss-protection 0 expires Tue, 28 Dec 2021 22:14:39 GMT
GET H2	200	0QIvMX1D_JOuMwr7I_FMl_E.woff2 fonts.gstatic.com/s/lora/v16/	33 KB 34 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:825::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lora/v16/0QIvMX1D_JOuMwr7I_FMl_E.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f9504635ce463f19888209acf89dc32831964d8dee1b4c22aa70f564c208061d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://returnsandrefund.com Referer https://fonts.googleapis.com/css?family=Lora%3A400%2C700%7COswald%3A400&ver=3.3.3&display=swap User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 29 Dec 2020 16:50:10 GMT x-content-type-options nosniff last-modified Fri, 26 Jun 2020 02:28:09 GMT server sffe age 104775 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 34172 x-xss-protection 0 expires Wed, 29 Dec 2021 16:50:10 GMT
GET H2	200	dell-270x100.jpg returnsandrefund.com/wp-content/uploads/2019/09/	5 KB 5 KB	383ms 382ms	Image image/jpeg	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/wp-content/uploads/2019/09/dell-270x100.jpg Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 1b954293b51939a32dd60bb2247d1f6606c92bfcad96c75765494efe287089b1 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 age 45181 vary Accept-Encoding, Accept-Encoding,Origin x-cache HIT content-type image/jpeg x-middleton-display staticcontent_sol, staticcontent_sol expires Thu, 29 Apr 2021 09:23:24 GMT cache-control max-age=10368000, public x-middleton-response 200 display staticcontent_sol, staticcontent_sol x-cache-hits 16
GET H2	200	united-270x100.jpg returnsandrefund.com/wp-content/uploads/2020/01/	5 KB 5 KB	402ms 402ms	Image image/jpeg	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/wp-content/uploads/2020/01/united-270x100.jpg Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 7b22c8e4f80384de8df3d61039309cfc07a9da83dba1cb6e8e7577891df40fe2 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 age 45181 vary Accept-Encoding, Accept-Encoding,Origin x-cache HIT content-type image/jpeg x-middleton-display staticcontent_sol, staticcontent_sol expires Thu, 29 Apr 2021 09:23:24 GMT cache-control max-age=10368000, public x-middleton-response 200 display staticcontent_sol, staticcontent_sol x-cache-hits 17
GET H2	200	neiman-marcus-270x100.jpg returnsandrefund.com/wp-content/uploads/2020/03/	5 KB 5 KB	392ms 391ms	Image image/jpeg	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/wp-content/uploads/2020/03/neiman-marcus-270x100.jpg Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e06678939b9f268ddb94d5fbe063d9fc5be7658d3ce180c89f6a0a74b5170dea Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 age 45181 vary Accept-Encoding, Accept-Encoding,Origin x-cache HIT content-type image/jpeg x-middleton-display staticcontent_sol, staticcontent_sol expires Thu, 29 Apr 2021 09:23:24 GMT cache-control max-age=10368000, public x-middleton-response 200 display staticcontent_sol, staticcontent_sol x-cache-hits 16
GET H2	200	ticketmaster-270x100.jpg returnsandrefund.com/wp-content/uploads/2020/01/	5 KB 5 KB	387ms 387ms	Image image/jpeg	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/wp-content/uploads/2020/01/ticketmaster-270x100.jpg Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 9641c71910a223f5c6003890a4e6b65db9b3a6fe232850877912d45458939732 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br response 200 last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 age 45181 vary Accept-Encoding, Accept-Encoding,Origin x-cache HIT content-type image/jpeg x-middleton-display staticcontent_sol, staticcontent_sol expires Thu, 29 Apr 2021 09:23:24 GMT cache-control max-age=10368000, public x-middleton-response 200 display staticcontent_sol, staticcontent_sol x-cache-hits 17
GET H3-Q050	200	__utm.gif ssl.google-analytics.com/r/	35 B 57 B	62ms 49ms	Image image/gif	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2081975281&utmhn=returnsandrefund.com&utme=8(template*t*rid*bra)9(pub_site*134*0*mod1)11(3!2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=All%20About%20Returns%20%26%20Refunds%20-&utmhid=1229858485&utmr=-&utmp=%2F&utmht=1609365385232&utmac=UA-169284892-10&utmcc=__utma%3D236246146.808650277.1609365385.1609365385.1609365385.1%3B%2B__utmz%3D236246146.1609365385.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1301781111&utmredir=1&utmmt=1&utmu=iTAgAAAAACAAAAAAAAAAAABE~ Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:25 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	__utm.gif ssl.google-analytics.com/r/	35 B 378 B	61ms 48ms	Image image/gif	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=2&utmn=692549617&utmhn=returnsandrefund.com&utme=8(template*domain)9(pub_site*returnsandrefund.com)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=All%20About%20Returns%20%26%20Refunds%20-&utmhid=1229858485&utmr=-&utmp=%2F&utmht=1609365385235&utmac=UA-38339005-1&utmcc=__utma%3D236246146.808650277.1609365385.1609365385.1609365385.1%3B%2B__utmz%3D236246146.1609365385.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=768152120&utmredir=1&utmmt=1&utmu=iTAgAAAAACAAAAAAAAAAAABE~ Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:25 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	anchorfix.js Show response returnsandrefund.com/ezoic/	879 B 461 B	54ms 54ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/ezoic/anchorfix.js?cb=191-2 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript cache-control max-age=31536000 content-length 383 expires Thu, 30 Dec 2021 21:56:25 GMT
GET H2	200	jellyfish.webp Show response returnsandrefund.com/porpoiseant/	58 KB 11 KB	142ms 142ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/porpoiseant/jellyfish.webp?a=a&cb=191-2&shcb=34 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 0001e893552b1e9805eaf2cfe9b6867ddb916e2213083d8d1513aa3e2ee2dd78 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 cache-control max-age=31536000 vary Accept-Encoding, Accept-Encoding content-type application/javascript
POST H2	204	cdb Show response bidder.criteo.com/	0 150 B	132ms 41ms	XHR text/plain	178.250.0.165 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://bidder.criteo.com/cdb?profileId=207&av=32&wv=3.27.0&cb=97928296602 Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS bidder.par.vip.prod.criteo.com Software Finatra / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com date Wed, 30 Dec 2020 21:56:24 GMT access-control-allow-credentials true server Finatra timing-allow-origin * vary Origin
POST H2	204	translator Show response hbopenbid.pubmatic.com/	0 119 B	101ms 34ms	XHR text/plain	185.64.189.112 AS-PUBMATIC
General Check archive.org Show headers Download Go to Full URL https://hbopenbid.pubmatic.com/translator?source=prebid-client Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com date Wed, 30 Dec 2020 21:56:25 GMT cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true
POST H2	200	prebid-request Show response onetag-sys.com/	15 B 451 B	155ms 74ms	XHR application/json	51.89.9.254 OVH
General Check archive.org Show headers Download Go to Full URL https://onetag-sys.com/prebid-request Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 51.89.9.254 , Germany, ASN16276 (OVH, FR), Reverse DNS ip254.ip-51-89-9.eu Software / Resource Hash 663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707 Security Headers Name Value Strict-Transport-Security max-age=2592000 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers strict-transport-security max-age=2592000 content-encoding gzip p3p CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR' access-control-allow-origin https://returnsandrefund.com cache-control no-transform, no-cache access-control-allow-credentials true content-type application/json access-control-allow-headers content-type, origin, referer, user-agent
POST H/1.1	204 No Content	hb Show response hb.undertone.com/	0 862 B	453ms 114ms	XHR text/plain	52.71.26.88 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://hb.undertone.com/hb?pid=4009&domain=returnsandrefund.com&gdpr=0&gdprstr= Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.71.26.88 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-71-26-88.compute-1.amazonaws.com Software istio-envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:25 GMT x-envoy-decorator-operation external-canary-request-service.ramplift-v2-p-us-east-1.svc.cluster.local:80/* server istio-envoy p3p policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV" access-control-allow-origin https://returnsandrefund.com cache-control private, max-age=0, no-cache access-control-allow-credentials true x-envoy-upstream-service-time 5 Connection keep-alive expires Mon, 26 Jul 1997 05:00:00 GMT
POST H/1.1	204 No Content	mvo Show response tag.1rx.io/rmp/215626/0/	0 277 B	161ms 54ms	XHR text/plain	213.19.147.210 RHYTHMONE
General Check archive.org Show headers Download Go to Full URL https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=3.27,2.1 Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US), Reverse DNS Software Tengine / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://returnsandrefund.com Pragma no-cache Date Wed, 30 Dec 2020 21:56:25 GMT Cache-Control private, max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Server Tengine Connection keep-alive
POST H/1.1	204 No Content	prebid Show response targeting.unrulymedia.com/	0 277 B	181ms 68ms	XHR text/plain	213.19.147.210 RHYTHMONE
General Check archive.org Show headers Download Go to Full URL https://targeting.unrulymedia.com/prebid Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 213.19.147.210 , United Kingdom, ASN26120 (RHYTHMONE, US), Reverse DNS Software Tengine / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://returnsandrefund.com Pragma no-cache Date Wed, 30 Dec 2020 21:56:25 GMT Cache-Control private, max-age=0, no-cache, no-store Access-Control-Allow-Credentials true Server Tengine Connection keep-alive
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	134ms 33ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	139ms 38ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	137ms 33ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	138ms 35ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	137ms 34ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	137ms 34ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	168ms 34ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	170ms 33ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	170ms 34ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	169ms 33ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	171ms 34ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	171ms 33ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	199ms 33ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	204 No Content	openrtb Show response ads.adaptv.advertising.com/rtb/	0 221 B	203ms 34ms	XHR application/json	52.57.94.147 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=EzoicInc Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.57.94.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-57-94-147.eu-central-1.compute.amazonaws.com Software adaptv/1.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true server adaptv/1.0 Connection keep-alive content-length 0 content-type application/json
POST H/1.1	200 OK	prebid Show response ib.adnxs.com/ut/v3/	494 B 1 KB	127ms 56ms	XHR application/json	37.252.173.38 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://ib.adnxs.com/ut/v3/prebid Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.38 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 0ad4989d8c24050b1f8371e3f366ed6f96464879856b055e1210e255dee9f662 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers Pragma no-cache Date Wed, 30 Dec 2020 21:56:25 GMT X-Proxy-Origin 82.102.20.235; 82.102.20.235; 537.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.76:80 AN-X-Request-Uuid 7f937293-7596-4b28-a033-018888d1d7f7 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://returnsandrefund.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 494 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	ezosuigenerisc.js Show response g.ezoic.net/	0 54 B	41ms 41ms	Script text/html	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/ezosuigenerisc.js?nogen=1 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT cache-control max-age=300, private server nginx/1.16.0 content-length 0 vary Accept-Encoding, Accept-Encoding content-type text/html; charset=utf-8
GET H2	200	imp.gif returnsandrefund.com/detroitchicago/	43 B 128 B	42ms 42ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A3%2C%22ad_location_ids%22%3A%225%2C21%2C1%2C0%2C34%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A5%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A5%2C%22city%22%3A%22Copenhagen%22%2C%22country%22%3A%22DK%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A4%2C%22domain_id%22%3A200400%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1101%2C1108%2C1112%2C1115%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22ee0e4c38-b5ff-4508-65c6-5a3e2702cc81%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%222750%22%2C%22pv_event_count%22%3A0%2C%22response_time_orig%22%3A348%2C%22serverid%22%3A%223.124.217.140%3A29610%22%2C%22state%22%3A%2284%22%2C%22sub_page_ad_positions%22%3A%221100%2C1101%2C1108%2C1112%2C1115%22%2C%22t_epoch%22%3A1609365383%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Freturnsandrefund.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A930%2C%22worst_bad_word_level%22%3A0%7D Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display imp_sol cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 47
GET H2	200	nmash.js returnsandrefund.com/porpoiseant/	23 KB 5 KB	42ms 41ms	Other application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/porpoiseant/nmash.js?v=94 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e18b987142a8919d52b8804968eab2cb323c1022f6f404862bb98496deb5435f Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 etag "5c0e-5b7183ce08b00;5b7183ce08b00-gzip" vary Accept-Encoding, Accept-Encoding content-type application/javascript cache-control max-age=31536000, public accept-ranges bytes
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 19 KB	26ms 6ms	Script text/javascript	2a00:1450:4001:809::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-150748452-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 23 Oct 2020 03:00:57 GMT server Golfe2 age 3978 date Wed, 30 Dec 2020 20:50:07 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18817 expires Wed, 30 Dec 2020 22:50:07 GMT
GET H2	200	anaheim.js Show response returnsandrefund.com/detroitchicago/	665 B 369 B	57ms 55ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/anaheim.js?gcb=2&cb=1 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash c090c938bbe4c0ed91065ff339cc4799f3758b9c1df20af104ac749ec285f97e Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding content-type application/javascript x-middleton-display sol-js cache-control max-age=31536000, public content-length 337
GET H2	200	edmonton.webp Show response returnsandrefund.com/detroitchicago/	14 KB 4 KB	65ms 64ms	Script application/javascript	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/detroitchicago/edmonton.webp?a=a&cb=191-2&shcb=34 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 997e1fbf8331c9f3af1ff0ace8c73754cbfce4c143c785b7bc44dbcead23576e Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 cache-control max-age=31536000 vary Accept-Encoding, Accept-Encoding content-type application/javascript
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 100 B	57ms 56ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoiZXh0X3VzZXJfaGFzaCIsInZhbCI6Ik5UIn1dfV0= Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:25 UTC
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 141 B	56ms 56ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoidW5pdmVyc2FsX3VzZXJfaWQiLCJ2YWwiOiI1ODllN2Q5MDQwYzM4OGRjODBiODhhNGViY2IxOWU3NiJ9XX1d Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:24 UTC
GET H3-Q050	200	pubads_impl_2020120801.js Show response securepubads.g.doubleclick.net/gpt/	274 KB 97 KB	120ms 66ms	Script text/javascript	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software sffe / Resource Hash 5f02981bfcab6807a15ddfea1babc7cee05cd0f1f59abe712928de44fb6c1f0d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 08 Dec 2020 09:42:29 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control private, immutable, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 98829 x-xss-protection 0 expires Wed, 30 Dec 2020 21:56:25 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	1 B 390 B	46ms 13ms	XHR text/plain	2a00:1450:4001:809::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1229858485&t=pageview&_s=1&dl=https%3A%2F%2Freturnsandrefund.com%2F&ul=en-us&de=UTF-8&dt=All%20About%20Returns%20%26%20Refunds%20-&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=236246146.808650277.1609365385.1609365385.1609365385.1&_utmz=236246146.1609365385.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1609365385384&_u=IQBCAUABAAAAAC~&jid=1507542831&gjid=1712277126&cid=808650277.1609365385&tid=UA-150748452-1&_gid=1922901015.1609365385&_r=1&gtm=2oubu0&z=1849796928 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:25 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://returnsandrefund.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 77 B	38ms 38ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjAtMTItMzAifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfV0= Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:25 UTC
GET H2	200	integrator.js Show response adservice.google.dk/adsid/	109 B 803 B	37ms 15ms	Script application/javascript	2a00:1450:4001:801::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.dk/adsid/integrator.js?domain=returnsandrefund.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	integrator.js Show response adservice.google.com/adsid/	109 B 781 B	43ms 29ms	Script application/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=returnsandrefund.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	468 B 275 B	714ms 714ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1159343608033107&output=ldjh&impl=fif&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3D8b07bae800b215e481d05a271b3e723b%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D700%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26&cookie_enabled=1&bc=31&abxe=1&lmt=1609317976&dt=1609365385603&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=1&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 03d685b6180cd64752f1a3a6b9e484a90abf5ec98386df5a4cff4beed91b5e55 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:26 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 241 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html 89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com/safeframe/1-0-37/html/	0 0	49ms 14ms	Other text/html	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	27ms 6ms	Other text/html	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	477 B 740 B	457ms 456ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1159343608033107&output=ldjh&impl=fif&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C580x400%7C728x90%7C320x50%7C468x60%7C234x60&fluid=height&prev_scp=iid13%3D1296797%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1296797%26eb_br%3Dc410f2a2b0c2123f4b6651cda6c5cf53%26eba%3D1%26ebss%3D10061%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D950%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26&cookie_enabled=1&bc=31&abxe=1&lmt=1609317976&dt=1609365385609&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=733&adks=2979263878&ucis=2&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=2&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x408&msz=809x400&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=0&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 68381dc0255c33108ce1cb3da293796654f0449749c8a1cfd163c359a4de75ae Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:26 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 255 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	468 B 274 B	1172ms 1171ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1159343608033107&output=ldjh&impl=fif&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C125x125%7C234x60%7C250x250%7C120x240%7C200x200%7C180x150&prev_scp=iid13%3D1288547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26a%3D%257C2%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1288547%26eb_br%3Dc410f2a2b0c2123f4b6651cda6c5cf53%26eba%3D1%26ebss%3D10061%26bv%3D2%26bvm%3D0%26bvr%3D6%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D950%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26&cookie_enabled=1&bc=31&abxe=1&lmt=1609317976&dt=1609365385612&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=482&adks=2452006746&ucis=3&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,37a5d7|color_text,,000000|color_url,,F0F0F0&ifi=3&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x273&msz=302x252&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 3d3e92254498998393a5baf4b6ed65891cb04d57deabcfab538610638858dd80 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:26 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 240 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	480 B 284 B	1370ms 1369ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1159343608033107&output=ldjh&impl=fif&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D5297de5240aa45da173a0792747e0d26%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D850%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26&cookie_enabled=1&bc=31&abxe=1&lmt=1609317976&dt=1609365385617&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=4&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=4&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 09624a3b116294705df5c58dc8b24ad7a89a5cbb04789817bba583bf66025d18 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:26 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 250 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	483 B 295 B	968ms 967ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1159343608033107&output=ldjh&impl=fif&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3Dbfa042bdb1583c959161b7823290dc1f%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D1300%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26&cookie_enabled=1&bc=31&abxe=1&lmt=1609317976&dt=1609365385619&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=5&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=5&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash ed08a078316eadb64cc8ef55edb01a6c0bea45c220b412b27a933f04dd5f9056 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:26 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 261 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/	234 KB 87 KB	57ms 42ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash fe5d97969e5d98e03eaacc671edb2e30373f05070f5a37d69f5a5f6f91b79149 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 89527 x-xss-protection 0 server cafe etag 1810063338415286733 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Wed, 30 Dec 2020 21:56:25 GMT
GET H2	200	zrt_lookup.html googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/ Frame 30A7	0 0	6ms 5ms	Document text/html	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20201203/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20201203/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Wed, 30 Dec 2020 10:01:15 GMT expires Wed, 13 Jan 2021 10:01:15 GMT content-type text/html; charset=UTF-8 etag 10723747146953794269 x-content-type-options nosniff content-encoding gzip server cafe content-length 4923 x-xss-protection 0 age 42910 cache-control public, max-age=1209600 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
GET H3-Q050	200	show_ads.js Show response pagead2.googlesyndication.com/pagead/	92 KB 33 KB	44ms 34ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/show_ads.js Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b06666a84e0d8fb440cd6dcfb4e9431e14f15ad1c20bc172fcafc23d9b081e76 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 33111 x-xss-protection 0 server cafe etag 3338715496686780052 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 30 Dec 2020 21:56:25 GMT
GET H2	200	cookie.js Show response partner.googleadservices.com/gampad/	210 B 445 B	53ms 52ms	Script text/javascript	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://partner.googleadservices.com/gampad/cookie.js?domain=returnsandrefund.com&callback=_gfp_s_&client=ca-pub-6396844742497208 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 2ed35124834250d445231ed2c2c232beece00425314a2c477c293d2056084c96 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/javascript; charset=UTF-8 cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 198 x-xss-protection 0
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 23 B	15ms 14ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Freturnsandrefund.com%2F&tn=DIV&id=ezmobfooter&cls=ezmob-footer%20ezoic-floating-bottom%20ezo_ad%20ezmob-footer-desktop&ign=false Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:25 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 88 B	14ms 14ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Freturnsandrefund.com%2F&tn=HEADER&cls=site-header&ign=false Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:25 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads googleads.g.doubleclick.net/pagead/ Frame 9D8C	0 0	90ms 90ms	Document text/html	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-6396844742497208&output=html&adk=1812271804&adf=3025194257&lmt=1609317976&plaf=1%3A2%2C2%3A2%2C3%3A2%2C4%3A2%2C5%3A2&plat=1%3A16810120%2C2%3A16810120%2C8%3A128%2C9%3A32904%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C27%3A128%2C30%3A1081472%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Freturnsandrefund.com%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1609365385644&bpp=4&bdt=1077&idt=120&shv=r20201203&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8025105977656&frm=20&pv=2&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=1&ga_wpids=UA-169284892-10&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068083%2C21068785&oid=3&pvsid=3231529339743241&pem=818&rx=0&eae=2&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&dtd=137 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?guci=1.2.0.0.2.2.0.0&client=ca-pub-6396844742497208&output=html&adk=1812271804&adf=3025194257&lmt=1609317976&plaf=1%3A2%2C2%3A2%2C3%3A2%2C4%3A2%2C5%3A2&plat=1%3A16810120%2C2%3A16810120%2C8%3A128%2C9%3A32904%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C27%3A128%2C30%3A1081472%2C32%3A32%2C40%3A32&format=0x0&url=https%3A%2F%2Freturnsandrefund.com%2F&ea=0&flash=0&pra=5&wgl=1&adsid=NT&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d&dt=1609365385644&bpp=4&bdt=1077&idt=120&shv=r20201203&cbv=r20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8025105977656&frm=20&pv=2&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=1&ga_wpids=UA-169284892-10&u_tz=60&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42530672%2C21068083%2C21068785&oid=3&pvsid=3231529339743241&pem=818&rx=0&eae=2&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=5&uci=a!5&fsb=1&dtd=137 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 30 Dec 2020 21:56:25 GMT server cafe content-length 34 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Wed, 30-Dec-2020 22:11:25 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" expires Wed, 30 Dec 2020 21:56:25 GMT cache-control private
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	74 KB 28 KB	34ms 14ms	Script text/javascript	2a00:1450:4001:801::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c1c9310eb6a56101c2133db372cfbe9cefb5ff6b90a02ded916984c975b813b2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1607690616793149" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28334 x-xss-protection 0 expires Wed, 30 Dec 2020 21:56:25 GMT
GET H2	200	dark-bottom.css returnsandrefund.com/ezoic/styles/	3 KB 792 B	34ms 34ms	Stylesheet text/css	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://returnsandrefund.com/ezoic/styles/dark-bottom.css Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ezoic/cookieconsent.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash 94edf973e9deb80b5eccf17f8f3108eafe15209fe25fe417e8f8962a4d8f48b3 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br last-modified Wed, 23 Dec 2020 02:13:32 GMT server nginx/1.16.0 etag "bd7-5b7183ce08b00-gzip" vary Accept-Encoding, Accept-Encoding content-type text/css cache-control max-age=31536000, public accept-ranges bytes content-length 725
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 78 B	34ms 33ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6Ijk4In0seyJuYW1lIjoicGVyZl9jb25uZWN0X3RvX3Jlc3Bfc3RhcnQiLCJ2YWwiOiI5NTcifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjE4In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjY4MiJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjEwNjUifSx7Im5hbWUiOiJwZXJmX2NvbXBsZXRlIiwidmFsIjoiMTI5NiJ9XX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:25 UTC
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 78 B	35ms 34ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiIxNTQ3In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiZGF0YSI6W3sibmFtZSI6ImZpcnN0X2NvbnRlbnRmdWxfcGFpbnQiLCJ2YWwiOiIxNTQ3In1dfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:25 UTC
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 78 B	34ms 34ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZG93bmxpbmsiLCJ2YWwiOiI5LjMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:25 UTC
GET H3-Q050	200	sodar Show response pagead2.googlesyndication.com/getconfig/	8 KB 7 KB	45ms 32ms	XHR application/json	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20201203&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 6b940596e82406b4979b2cfeaeff1367ddaaadb715ec9655516c2f7d3cef391c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 6344 x-xss-protection 0
GET H3-Q050	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	16 KB 6 KB	43ms 29ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/r20201203/r20190131/show_ads_impl_fy2019.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:25 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603823857801521" vary Accept-Encoding content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6015 x-xss-protection 0 expires Wed, 30 Dec 2020 21:56:25 GMT
GET H3-Q050	200	runner.html tpc.googlesyndication.com/sodar/sodar2/219/ Frame E258	0 0	6ms 6ms	Document text/html	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/219/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin content-length 4867 date Wed, 30 Dec 2020 20:54:29 GMT expires Thu, 30 Dec 2021 20:54:29 GMT last-modified Mon, 05 Oct 2020 22:33:01 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 3716 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 124 B	33ms 32ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjE1MTIifV19XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:26 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:26 UTC
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 46 B	16ms 16ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gda_r20201203&jk=3231529339743241&bg=!ExClEDDNAAUbEDgJG1hJL8wu3bDbCAIAAACZUgAAABBoAQcKAOcYjI-Tu745RsW9qVhK8RhVVwkhrXd99AK4w_wuYM6OaLPduFXOkL-_Dq_wEuxuvUjTzIXKQ1vEZNNr3EGZCobbpeBSML6DNAuoySHPB1E7qoB4zYidKjrkXt7PGsb33x3Ls9DuBFmu1k7Pwq1KRqBnCrOpWb4n57jpK-XcV1MUoV5lcZH-wI1KdI-ndfvIszvhwu7iQCuV0QbokHHyFwPSc9YVywxpeV83tBUKWqdRc2QgA3xpag4JmCw_Ek7ZZcHwuVDArfD16lVZ79oMniI93PaaORpv9mG7k5IVbwB6frbCvi7CQAWZAb2w6cZCPPDyhuuscEaHg5FHRyQNmGo0POAwgGU_wj7qvG5F5ledxDm3rB26uBmHfS10nl2j1b5Vf9OgUEdzjvkAPUACT9h_V3IOaq3aeePoQ1n3qM_eEBvZjeW_OuIVuuBZiv1CExWMSBaQv7q79JiFumSxJB4qrR_z55uW-pycoo9pAR8qzLaxM6a4AYHz6HI_nJX5jCYU9mp_BUpIiqRoMmlHdKV3fzAGyUl80RoYHmOFZFFi6ReU8W5KT6zXlWJeMy4UIBKnyQfokPj8aBTGyxA06_BGfpRfYhgudgoDvIIpQb-1m3KPRDA1izBkMA3HBYnOgyukuF4W3XY7f-b0E053Nul7SddnmWALKNvr1H5p2GQE9VkeGxJR-ojS930d4bmvs2VWJ_fCEjfflCPR0eSwnp1BZKog676C7-4zw2mgnu5kh1tjccYBGnlpQ2adSlV0JMMvRl7PhZAX_YXbYdRxqau1j4yYyYOvyK1id30E7GR8F2q6UmyjdynGGDOdqKfRDhgftG3JFFZMJZqg_F35K040J2hxA3crHxYYwqnxLtqq5lX1fdIeXbc9HViJ27whxnYQf07fClTE Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:26 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H/1.1	200	457.json Show response id5-sync.com/g/v2/	606 B 932 B	178ms 47ms	XHR application/json	51.75.146.200 OVH
General Check archive.org Show headers Download Go to Full URL https://id5-sync.com/g/v2/457.json?gdpr_consent=&gdpr=0 Requested by Host: ads.pubmatic.com URL: https://ads.pubmatic.com/AdServer/js/pwt/156983/3085/pwt.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 51.75.146.200 , Germany, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash 737569ddc702dfa8943a864d4ba7de9ded318c6926a6e1c7aca37f526d2b7a1e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers Access-Control-Allow-Origin https://returnsandrefund.com Date Wed, 30 Dec 2020 21:56:26 GMT Access-Control-Allow-Credentials true Vary Origin Transfer-Encoding chunked Strict-Transport-Security max-age=63072000; includeSubDomains; preload Content-Type application/json;charset=UTF-8
GET H2	451	envelope Show response api.rlcdn.com/api/identity/	0 224 B	137ms 67ms	XHR text/plain	34.120.207.148 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://api.rlcdn.com/api/identity/envelope?pid=1258 Requested by Host: ads.pubmatic.com URL: https://ads.pubmatic.com/AdServer/js/pwt/156983/3085/pwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.207.148 , United States, ASN15169 (GOOGLE, US), Reverse DNS 148.207.120.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers date Wed, 30 Dec 2020 21:56:27 GMT via 1.1 google alt-svc clear access-control-allow-methods GET, OPTIONS access-control-allow-origin https://returnsandrefund.com access-control-allow-credentials true access-control-allow-headers Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With content-length 0
GET H2	200	rid Show response match.adsrvr.org/track/	109 B 547 B	175ms 61ms	XHR application/json	54.195.113.118 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json Requested by Host: ads.pubmatic.com URL: https://ads.pubmatic.com/AdServer/js/pwt/156983/3085/pwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.195.113.118 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-195-113-118.eu-west-1.compute.amazonaws.com Software / Resource Hash 07f8e42d3652cd7c8ab0098124f0cd9697b33d6746d858b0d7751777429d2a44 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers date Wed, 30 Dec 2020 21:56:27 GMT x-aspnet-version 4.0.30319 vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://returnsandrefund.com cache-control private access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept content-length 109 expires Fri, 29 Jan 2021 21:56:27 GMT
GET H2	200	publishertag.prebid.js Show response static.criteo.net/js/ld/	79 KB 25 KB	68ms 24ms	Script text/javascript	2a02:2638::3 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://static.criteo.net/js/ld/publishertag.prebid.js Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash 2e09c1d6823b640280575072c92f5d6c524262cdd52ad285dfbbee130544974a Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:28 GMT content-encoding gzip last-modified Thu, 10 Dec 2020 16:22:27 GMT server nginx etag W/"5fd24b43-13cb8" content-type text/javascript access-control-allow-origin * cache-control max-age=86400, public timing-allow-origin * expires Thu, 31 Dec 2020 21:56:28 GMT
GET H2	200	syncframe gum.criteo.com/ Frame A20A	0 0	64ms 22ms	Document text/html	2a02:2638::1c ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://gum.criteo.com/syncframe?topUrl=returnsandrefund.com Requested by Host: static.criteo.net URL: https://static.criteo.net/js/ld/publishertag.prebid.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority gum.criteo.com :scheme https :path /syncframe?topUrl=returnsandrefund.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers cache-control private, max-age=0 content-type text/html; charset=utf-8 strict-transport-security max-age=31536000 server-processing-duration-in-ticks 591 date Wed, 30 Dec 2020 21:56:28 GMT content-length 0
GET H2	200	publishertag.prebid.js Show response static.criteo.net/js/ld/	79 KB 25 KB	67ms 25ms	XHR text/javascript	2a02:2638::3 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://static.criteo.net/js/ld/publishertag.prebid.js Requested by Host: static.criteo.net URL: https://static.criteo.net/js/ld/publishertag.prebid.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash 2e09c1d6823b640280575072c92f5d6c524262cdd52ad285dfbbee130544974a Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:28 GMT content-encoding gzip last-modified Thu, 10 Dec 2020 16:22:27 GMT server nginx etag W/"5fd24b43-13cb8" content-type text/javascript access-control-allow-origin * cache-control max-age=86400, public timing-allow-origin * expires Thu, 31 Dec 2020 21:56:28 GMT
GET H2	200	/ onetag-sys.com/usync/ Frame 6D28	0 0	39ms 38ms	Document text/html	51.89.9.254 OVH
General Check archive.org Show headers Download Go to Full URL https://onetag-sys.com/usync/?cb=1609365385456 Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 51.89.9.254 , Germany, ASN16276 (OVH, FR), Reverse DNS ip254.ip-51-89-9.eu Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=2592000 Request headers :method GET :authority onetag-sys.com :scheme https :path /usync/?cb=1609365385456 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers content-type text/html cache-control no-transform, no-cache content-encoding gzip strict-transport-security max-age=2592000
GET H2	200	third-party-iframes.html video.unrulymedia.com/iframes/ Frame 17E4	0 0	104ms 36ms	Document text/html	143.204.212.226 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://video.unrulymedia.com/iframes/third-party-iframes.html?gdpr=0 Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.212.226 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority video.unrulymedia.com :scheme https :path /iframes/third-party-iframes.html?gdpr=0 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers content-type text/html content-length 466 last-modified Wed, 02 Dec 2020 12:11:54 GMT x-amz-expiration expiry-date="Thu, 02 Dec 2027 00:00:00 GMT", rule-id="Delete after 7 years" accept-ranges bytes server AmazonS3 date Wed, 30 Dec 2020 21:55:02 GMT cache-control max-age=600 etag "e215fb9986b4d9d078843e58cb86e48a" x-cache Hit from cloudfront via 1.1 a4a46c5a6cdf81ec1d08cf6e63389765.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id Za-KWQA2PcoeB07dmSN925b3U9G-gS9bQOwXBSpoLm-N_xBQia6dJQ== age 87
GET H2	200	usersync.html cdn.undertone.com/js/ Frame DB66	0 0	116ms 36ms	Document text/html	2600:9000:20a5:9c00:1f:2473:9080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.undertone.com/js/usersync.html?gdpr=0&gdprstr= Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20a5:9c00:1f:2473:9080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers :method GET :authority cdn.undertone.com :scheme https :path /js/usersync.html?gdpr=0&gdprstr= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US cookie UTID_ENC=bgm5jo7xlndbpcwh05qfduvyp; UTID=c19962563960445e9b212afd3895a651 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers content-type text/html date Wed, 30 Dec 2020 06:52:02 GMT last-modified Wed, 16 Dec 2020 12:35:23 GMT etag W/"8ee422394c26ec0371c4676b43dd838d" server AmazonS3 content-encoding gzip vary Accept-Encoding x-cache Hit from cloudfront via 1.1 f00e3524edcdf61801454f2bb21e71ce.cloudfront.net (CloudFront) x-amz-cf-pop OSL50-C1 x-amz-cf-id IrNjF2AtcC4qgHod_ATA2ilv0ZQV0qV-u97uIrzT-lkkPmI9JlCSAw== age 54267
GET H/1.1	200 OK	showad.js ads.pubmatic.com/AdServer/js/ Frame 9684	0 0	58ms 58ms	Document text/html	2.18.233.180 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ads.pubmatic.com/AdServer/js/showad.js Requested by Host: go.ezodn.com URL: https://go.ezodn.com/hb/dall.js?b=criteo,oftmedia,oneVideo,onedisplay,onemobile,onetag,pubmatic,rhythmone,undertone,unruly&cb=191-2-5 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.180 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-233-180.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / Resource Hash Request headers Host ads.pubmatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://returnsandrefund.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers Last-Modified Wed, 21 Oct 2020 18:57:52 GMT ETag "13006b6-94f8-5b232eca8cf5e" Server Apache/2.2.15 (CentOS) Accept-Ranges bytes Content-Encoding gzip P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Content-Length 13837 Content-Type text/html; charset=UTF-8 Cache-Control public, max-age=162156 Expires Fri, 01 Jan 2021 18:59:04 GMT Date Wed, 30 Dec 2020 21:56:28 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	%7Bcombo_uid%7D pr-bh.ybp.yahoo.com/sync/adaptv_ortb/	43 B 841 B	140ms 45ms	Image image/gif	2a00:1288:110:c305::8000 YAHOO-IRD
General Check archive.org Show headers Download Go to Show image Full URL https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB), Reverse DNS Software ATS / Resource Hash 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:28 GMT referrer-policy strict-origin-when-cross-origin server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=31536000 content-type image/gif x-xss-protection 1; mode=block content-length 43 x-content-type-options nosniff expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	204 No Content	sync ups.analytics.yahoo.com/ups/55986/ Redirect Chain https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_... https://pixel.advertising.com/ups/55986/sync?uid=X_z3jAAAAKmfyjoG&_origin=0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG https://ups.analytics.yahoo.com/ups/55986/sync?uid=X_z3jAAAAKmfyjoG&_origin=0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa	0 964 B	80ms 34ms	Image text/plain	18.156.0.31 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/55986/sync?uid=X_z3jAAAAKmfyjoG&_origin=0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.0.31 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software ATS/7.1.2.128 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 30 Dec 2020 21:56:29 GMT Server ATS/7.1.2.128 Connection keep-alive Age 0 Strict-Transport-Security max-age=31536000 P3P CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers location https://ups.analytics.yahoo.com/ups/55986/sync?uid=X_z3jAAAAKmfyjoG&_origin=0&gdpr=0&gdpr_consent=&_test=X_z3jAAAAKmfyjoG&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa date Wed, 30 Dec 2020 21:56:29 GMT content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H2	204	sync pixel.advertising.com/ups/55953/ Redirect Chain https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 https://pixel.advertising.com/ups/55953/sync?uid=dc504058-6049-4c44-a824-c77956331a7e&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=dc504058-6049-4c44-a824-c77956331a7e	0 125 B	115ms 48ms	Image text/plain	18.197.47.23 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.advertising.com/ups/55953/sync?uid=dc504058-6049-4c44-a824-c77956331a7e&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=dc504058-6049-4c44-a824-c77956331a7e Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.197.47.23 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:28 GMT strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers pragma no-cache date Wed, 30 Dec 2020 21:56:28 GMT x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" location https://pixel.advertising.com/ups/55953/sync?uid=dc504058-6049-4c44-a824-c77956331a7e&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=dc504058-6049-4c44-a824-c77956331a7e cache-control private,no-cache, must-revalidate content-type text/html content-length 369
GET H2	204	/ onetag-sys.com/usync/	0 84 B	37ms 36ms	Image text/plain	51.89.9.254 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://onetag-sys.com/usync/?tag=img Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 51.89.9.254 , Germany, ASN16276 (OVH, FR), Reverse DNS ip254.ip-51-89-9.eu Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=2592000 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=2592000 cache-control no-cache, no-transform content-length 0
GET H/1.1	204 No Content	sync ups.analytics.yahoo.com/ups/57304/ Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc https://pixel.advertising.com/ups/57304/sync?uid=CAESEGWHS_hypVBAG_m88jE4rPA&google_cver=1 https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEGWHS_hypVBAG_m88jE4rPA&google_cver=1&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa	0 964 B	104ms 35ms	Image text/plain	18.156.0.31 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEGWHS_hypVBAG_m88jE4rPA&google_cver=1&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.0.31 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software ATS/7.1.2.128 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 30 Dec 2020 21:56:29 GMT Server ATS/7.1.2.128 Connection keep-alive Age 0 Strict-Transport-Security max-age=31536000 P3P CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers location https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEGWHS_hypVBAG_m88jE4rPA&google_cver=1&apid=UPdeb3c209-4ae9-11eb-84bf-02d5a74e5caa date Wed, 30 Dec 2020 21:56:28 GMT content-length 0 strict-transport-security max-age=31536000 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	463 B 267 B	302ms 301ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3876781129496105&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D450%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D850%26reqt%3D1609365388898&eri=1&cookie=ID%3D8860435517aff61f-22dc3ca178b900b5%3AT%3D1609365385%3AS%3DALNI_MaqZvLY8tHJA8o6QXmvLccgq3traQ&bc=31&abxe=1&lmt=1609317976&dt=1609365388929&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=6&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=7&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=2&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 7c12f24041bf914a03eed781d2bc871dc1952afa56ae882cf837a8e39514cd74 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 233 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	451 B 284 B	264ms 264ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2199434592666000&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C125x125%7C234x60%7C250x250%7C120x240%7C200x200%7C180x150&ris=3&rcs=1&prev_scp=iid13%3D1288547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26a%3D%257C2%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1288547%26eb_br%3D5f2b94bb26a5aa9b1a00e66d30cfd5ec%26eba%3D1%26ebss%3D10061%26bv%3D2%26bvm%3D0%26bvr%3D6%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D500%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D950%26reqt%3D1609365388932&eri=1&cookie=ID%3D8860435517aff61f-22dc3ca178b900b5%3AT%3D1609365385%3AS%3DALNI_MaqZvLY8tHJA8o6QXmvLccgq3traQ&bc=31&abxe=1&lmt=1609317976&dt=1609365388936&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=482&adks=2452006746&ucis=7&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,37a5d7|color_text,,000000|color_url,,F0F0F0&ifi=8&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x273&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 029b44750228e48ebaef20a8fa2147ee6c90d12f1966a2c4de48aac208072c42 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 228 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	459 B 269 B	292ms 291ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2097735986672744&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=3&rcs=1&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3D5bac35e1a3b6adc56da706000a645484%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D650%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D1300%26reqt%3D1609365388939&eri=1&cookie=ID%3D8860435517aff61f-22dc3ca178b900b5%3AT%3D1609365385%3AS%3DALNI_MaqZvLY8tHJA8o6QXmvLccgq3traQ&bc=31&abxe=1&lmt=1609317976&dt=1609365388942&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=8&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=9&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 42cc98d5ae96232b703220364c4f64d7002f544ec52c58f2635cb0d3b9c3f103 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 235 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	451 B 258 B	265ms 265ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=896030649340004&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D350%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D700%26reqt%3D1609365388944&eri=1&cookie=ID%3D8860435517aff61f-22dc3ca178b900b5%3AT%3D1609365385%3AS%3DALNI_MaqZvLY8tHJA8o6QXmvLccgq3traQ&bc=31&abxe=1&lmt=1609317976&dt=1609365388948&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=9&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=10&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 635c6888bd668656b0c5510baed5fc8cd6036186f02e2d676cd247628319e4b5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 228 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	460 B 270 B	375ms 374ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2698845180949259&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C580x400%7C728x90%7C320x50%7C468x60%7C234x60&fluid=height&ris=3&rcs=1&prev_scp=iid13%3D1296797%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1296797%26eb_br%3D5f2b94bb26a5aa9b1a00e66d30cfd5ec%26eba%3D1%26ebss%3D10061%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D500%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D950%26reqt%3D1609365388951&eri=1&cookie=ID%3D8860435517aff61f-22dc3ca178b900b5%3AT%3D1609365385%3AS%3DALNI_MaqZvLY8tHJA8o6QXmvLccgq3traQ&bc=31&abxe=1&lmt=1609317976&dt=1609365388953&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=733&adks=2979263878&ucis=a&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=11&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x408&msz=809x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=0&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 00ae53d9a6a31fafff835cc0e321eea31ffb175b2042ff73b17e88c17adef86d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 240 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 0	14ms 13ms	Fetch image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=gfp_cw_status&domain=returnsandrefund.com&host=returnsandrefund.com&success=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:29 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	354 B 181 B	182ms 181ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1958844263131358&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=2&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D350%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D450%26reqt%3D1609365389447&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389450&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=b&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=12&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=3&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 67a378390893c1d66c1cca73812273d570f93c0f976254918fb0b0c621feb389 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 147 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 177 B	174ms 173ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=153911832824986&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C125x125%7C234x60%7C250x250%7C120x240%7C200x200%7C180x150&ris=1&rcs=2&prev_scp=iid13%3D1288547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26a%3D%257C2%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1288547%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D1%26ebss%3D10061%26bv%3D2%26bvm%3D0%26bvr%3D6%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D300%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D500%26reqt%3D1609365389452&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389455&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=482&adks=2452006746&ucis=c&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,37a5d7|color_text,,000000|color_url,,F0F0F0&ifi=13&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x273&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 5851c3d102a57b2424074fc0b9092ed0e8e48b3cd0a96f794f95daa4dd3fb937 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 143 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	350 B 184 B	204ms 204ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3439332276276440&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=1&rcs=2&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D450%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26lb%3D650%26reqt%3D1609365389457&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389460&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=d&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=14&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash e6966a5abb4c627647070666a67efef3370ca1e1eca19812e9dfd09d6cb48040 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 151 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 175 B	419ms 419ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2784713731079273&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=2&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3D8de2c8ca79e8623e3cb37120a35ebaa2%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D240%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%26lb%3D350%26reqt%3D1609365389464&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389468&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=e&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=15&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash e95d26ceb55ecfb48d581e2280b777e84cb679662e7d6c9a9fdb0eace3ac4d16 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 142 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	351 B 185 B	210ms 209ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2802095015225408&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C580x400%7C728x90%7C320x50%7C468x60%7C234x60&fluid=height&ris=1&rcs=2&prev_scp=iid13%3D1296797%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1296797%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D1%26ebss%3D10061%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D300%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%26lb%3D500%26reqt%3D1609365389470&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389473&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=733&adks=2979263878&ucis=f&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=16&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x408&msz=809x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=0&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash aa811d455e870a1f9d7a5e049676dbe7b9eb6deea1c1ef4759a774512bb66772 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:29 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 152 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	354 B 182 B	251ms 250ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2069716514562739&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=3&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D43aa1607a0c08c74b14a9039e7b909b4%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D220%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%26lb%3D350%26reqt%3D1609365389965%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389971&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=g&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=17&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=4&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 037db2373031fb5fd56c9dd736f2eed827e57503c135968060e353eb0f865185 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 148 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 195 B	195ms 195ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2025158537335160&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C125x125%7C234x60%7C250x250%7C120x240%7C200x200%7C180x150&ris=1&rcs=3&prev_scp=iid13%3D1288547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26a%3D%257C2%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1288547%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10061%26bv%3D2%26bvm%3D0%26bvr%3D6%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D160%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C20%26lb%3D300%26reqt%3D1609365389976%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389982&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=482&adks=2452006746&ucis=h&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,37a5d7|color_text,,000000|color_url,,F0F0F0&ifi=18&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x273&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 27745be8f48c8965b7d0d5a2fc6e5cada39c6cc3602a972f39da1fc3f5763c96 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 142 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	350 B 187 B	186ms 185ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3457651008728106&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=1&rcs=3&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D260%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%26lb%3D450%26reqt%3D1609365389986%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365389993&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=i&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=19&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash bb8124fad74f2f82cf26268b2db6fa2c8f809f065b293870b3eb47b6ab0e4fda Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 153 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 173 B	195ms 194ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3957377877409169&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=3&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D140%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%26lb%3D240%26reqt%3D1609365390003%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390011&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=j&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=20&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash bd004158267fe85fa51b7e770ae7c005eb40bb95d58f38b3cdd6584a40d3a09c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 143 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	351 B 183 B	186ms 185ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=176319978684401&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C580x400%7C728x90%7C320x50%7C468x60%7C234x60&fluid=height&ris=1&rcs=3&prev_scp=iid13%3D1296797%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1296797%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10061%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D120%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%26lb%3D300%26reqt%3D1609365390015%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390022&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=733&adks=2979263878&ucis=k&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=21&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x408&msz=809x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=0&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 217f9033676dd0721a9f87d3f1a628df55033aee3f52e4c1e1fd66e5a6cdcc48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 153 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	354 B 177 B	271ms 270ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3476734202817657&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=4&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D120%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%26lb%3D220%26reqt%3D1609365390480%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390483&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=l&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=22&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=5&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash f4f420820b183d4ef4948a6b78bbc680f2843824b73febb0d24b3540ce5c7fee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 147 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	23 KB 10 KB	298ms 298ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1987209768838901&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C125x125%7C234x60%7C250x250%7C120x240%7C200x200%7C180x150&ris=1&rcs=4&prev_scp=iid13%3D1288547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26a%3D%257C2%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Dreturnsandrefund_com-box-1-1288547%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26ebss%3D10061%26bv%3D2%26bvm%3D0%26bvr%3D6%26shp%3D2%26ftsn%3D3%26acptad%3D1%26br1%3D60%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C20%2C17%2C19%2C20%26lb%3D160%26reqt%3D1609365390497%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390500&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=482&adks=2452006746&ucis=m&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,37a5d7|color_text,,000000|color_url,,F0F0F0&ifi=23&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x273&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash b223860b37e2d413cd572c04853af9fb1c314e8411104653f1d5cf5c2ada545f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10478 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	350 B 182 B	206ms 206ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=4148181417704872&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=1&rcs=4&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D120%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%26lb%3D260%26reqt%3D1609365390502%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390505&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=n&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=24&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 143d262e41481e31e90c29bcc9ad1bc101e433a043503f09a002b4089ddd1db2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 152 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 173 B	208ms 208ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1805295280049072&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=4&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3D527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D70%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%26lb%3D140%26reqt%3D1609365390530%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390534&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=o&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=25&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 5866ab5c3d29ee5cfdc68ba1c39ce3aed674f18e475c26a093316c372c3e2b0b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 143 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	351 B 183 B	178ms 178ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2338523547198565&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C580x400%7C728x90%7C320x50%7C468x60%7C234x60&fluid=height&ris=1&rcs=4&prev_scp=iid13%3D1296797%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1296797%26eb_br%3Dd31e71883d00099e275b6c5878eed023%26eba%3D1%26ebss%3D10061%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D32%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%26lb%3D120%26reqt%3D1609365390536%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390539&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=733&adks=2979263878&ucis=p&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=26&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x408&msz=809x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=0&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash b3a41ced179159ee6453e0b8dc689477d6e511b417a0b2126a7a8c7a7eebe1bf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 153 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	container.html 89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 6043	0 0	54ms 40ms	Document text/html	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com :scheme https :path /safeframe/1-0-37/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin timing-allow-origin * content-length 2973 date Wed, 30 Dec 2020 21:56:25 GMT expires Thu, 30 Dec 2021 21:56:25 GMT last-modified Thu, 21 Nov 2019 16:01:11 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 5 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	28687274 Show response g.ezoic.net/dac/	0 93 B	108ms 35ms	XHR text/plain	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/dac/28687274 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=191-2&bv=94&v=36&PageSpeed=off Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Wed, 30 Dec 2020 21:56:30 GMT cache-control max-age=3600, public server nginx/1.16.0 content-length 0 vary Accept-Encoding content-type text/plain
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 126 B	38ms 34ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYyNTUifV19XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 77 B	38ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI4ODU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyODg1NDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImMzNTJiYTU4MWJkM2ZmZDhjZWE2MDhjZjJkNTVmNTE5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjg4NTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MDkzNjUzODMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDYsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDE2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI4ODU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyMDg2MTEwOTUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyODg1NDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 77 B	38ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI4ODU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMC0xMi0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 101 B	38ms 36ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTI4ODU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhdWN0aW9uX2Vwb2NoIjoxNjA5MzY1MzkxLCJhZF9wb3NpdGlvbiI6MTEwOCwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImJpZF9mbG9vcl9pbml0aWFsIjo5NTAsImJpZF9mbG9vcl9wcmV2IjoxNjAsImJpZF9mbG9vcl9maWxsZWQiOjYwLCJhdWN0aW9uX2NvdW50Ijo1LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozMTgsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:29 UTC
GET H2	200	audins.js Show response go.ezoic.net/detroitchicago/	821 B 1 KB	6ms 6ms	Script application/javascript	2600:9000:206f:c400:2:cb38:840:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://go.ezoic.net/detroitchicago/audins.js?cb=191-2 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:206f:c400:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.16.0 / Resource Hash d98f76f0461187c365efd671a87749384de00b589e87fb30c0486a892769c412 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 22 Dec 2020 00:56:05 GMT via 1.1 4162b603e4967e54c2386fa354705d6e.cloudfront.net (CloudFront) last-modified Thu, 17 Dec 2020 22:41:07 GMT server nginx/1.16.0 age 766825 etag "335-5b6b0b00266c0;5b6b0b00266c0-gzip" vary Accept-Encoding,Accept-Encoding x-cache Hit from cloudfront content-type application/javascript cache-control max-age=31536000, public x-amz-cf-pop FRA56-C1 accept-ranges bytes content-length 821 x-amz-cf-id cP_SdNOxiind0quqsVCar73mPkuOzYYKd2AJVlsLZ0Fnw_YqL63Pvg==
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 78 B	39ms 34ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTY3OTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjE1MiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI1NjI5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExNSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNDYxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjg4NTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI0OSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjE0In1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 78 B	39ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI2NDkifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjgwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIyMzAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjczMyJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyNTYyOTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMTEyMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTU5MiJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyODg1NDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMTEyMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDgxIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMDkyIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	quant.js Show response secure.quantserve.com/	23 KB 9 KB	11ms 7ms	Script application/javascript	2620:116:800d:21:5a23:9c4e:e774:96c1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://secure.quantserve.com/quant.js Requested by Host: go.ezoic.net URL: https://go.ezoic.net/detroitchicago/audins.js?cb=191-2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 437afd9de21717c919be3f40f686b33170f2447dc03ded0fc00ac0cc41839854 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:30 GMT content-encoding gzip etag "8q1rat7Mm9i+FVcOidF8/g==" vary Accept-Encoding content-type application/javascript cache-control private, max-age=604800 accept-ranges bytes expires Wed, 06 Jan 2021 21:56:30 GMT
GET H/1.1	200 OK	beacon.js Show response sb.scorecardresearch.com/	1 KB 1 KB	104ms 33ms	Script application/x-javascript	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://sb.scorecardresearch.com/beacon.js Requested by Host: go.ezoic.net URL: https://go.ezoic.net/detroitchicago/audins.js?cb=191-2 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 30 Dec 2020 21:56:30 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=86400 Connection keep-alive Content-Length 884 Expires Thu, 31 Dec 2020 21:56:30 GMT
GET H2	200	rules-p-31iz6hfFutd16.js Show response rules.quantcount.com/	3 B 347 B	113ms 36ms	Script application/x-javascript	2600:9000:20a5:4000:6:44e3:f8c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rules.quantcount.com/rules-p-31iz6hfFutd16.js Requested by Host: secure.quantserve.com URL: https://secure.quantserve.com/quant.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20a5:4000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 20:38:19 GMT via 1.1 96c778ce6156d12f24b8b6cdaa0cbf67.cloudfront.net (CloudFront) last-modified Sat, 04 Mar 2017 19:50:24 GMT server AmazonS3 age 4693 etag "8a80554c91d9fca8acb82f023de02f11" x-cache Hit from cloudfront content-type application/x-javascript cache-control max-age=86400 x-amz-cf-pop OSL50-C1 accept-ranges bytes content-length 3 x-amz-cf-id oV0oc7k58a_QSggAEWbr1le1HbQtxf7WNdJXA7juw0jsBVFfX8Z_2A==
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	354 B 200 B	181ms 181ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=820718983309822&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=5&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D50%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%26lb%3D120%26reqt%3D1609365390987%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365390989&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=q&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=27&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=6&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 9078b8e8976468611e974bd544fb445cd08fd1eac820c9c12f01be2aa2fcf007 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 147 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	204 No Content	b2 sb.scorecardresearch.com/ Redirect Chain https://sb.scorecardresearch.com/b?c1=2&c2=20015427&ns__t=1609365391005&ns_c=UTF-8&cv=3.5&c8=All%20About%20Returns%20%26%20Refunds%20-&c7=https%3A%2F%2Freturnsandrefund.com%2F&c9= https://sb.scorecardresearch.com/b2?c1=2&c2=20015427&ns__t=1609365391005&ns_c=UTF-8&cv=3.5&c8=All%20About%20Returns%20%26%20Refunds%20-&c7=https%3A%2F%2Freturnsandrefund.com%2F&c9=&cs_ak_ss=1	0 528 B	32ms 32ms	Image text/plain	104.111.238.139 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://sb.scorecardresearch.com/b2?c1=2&c2=20015427&ns__t=1609365391005&ns_c=UTF-8&cv=3.5&c8=All%20About%20Returns%20%26%20Refunds%20-&c7=https%3A%2F%2Freturnsandrefund.com%2F&c9=&cs_ak_ss=1 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-238-139.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Wed, 30 Dec 2020 21:56:31 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://sb.scorecardresearch.com/b2?c1=2&c2=20015427&ns__t=1609365391005&ns_c=UTF-8&cv=3.5&c8=All%20About%20Returns%20%26%20Refunds%20-&c7=https%3A%2F%2Freturnsandrefund.com%2F&c9=&cs_ak_ss=1 Pragma no-cache Date Wed, 30 Dec 2020 21:56:31 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	350 B 183 B	189ms 189ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3101640712171166&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=1&rcs=5&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3Dee685f77592ce296910ee91457d66ba3%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D40%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%26lb%3D120%26reqt%3D1609365391019%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365391022&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=r&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=28&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 8a5c1696fa14699b8ae1ba58fd5b83e8389bad17bbc59e9a5ee2b7dc224b72d9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 153 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pixel;r=639310880;labels=Domain.returnsandrefund_com%2CDomainId.200400;rf=0;uht=2;a=p-31iz6hfFutd16;url=https%3A%2F%2Freturnsandrefund.com%2F;fpan=1;fpa=P0-1146094616-1609365391033;ns=0;ce=1;qjs=1;... pixel.quantserve.com/	35 B 210 B	24ms 23ms	Image image/gif	2620:116:800d:21:5a23:9c4e:e774:96c1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.quantserve.com/pixel;r=639310880;labels=Domain.returnsandrefund_com%2CDomainId.200400;rf=0;uht=2;a=p-31iz6hfFutd16;url=https%3A%2F%2Freturnsandrefund.com%2F;fpan=1;fpa=P0-1146094616-1609365391033;ns=0;ce=1;qjs=1;qv=58f0669e-20201210192756;cm=;gdpr=0;ref=;d=returnsandrefund.com;je=0;sr=1600x1200x24;dst=1;et=1609365391033;tzo=-60;ogl= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:31 GMT cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 strict-transport-security max-age=86400 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	342 B 173 B	188ms 187ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1165186792012834&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=5&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3D674294a1b21a1e89fc99c14c9b17be44%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D28%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%2C17%2C19%2C20%26lb%3D70%26reqt%3D1609365391058%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365391061&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=s&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=29&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 46dd847c9b2d5e5243df39b97923822d343646005fed1881d49b91ce2961dd5e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 143 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	76 KB 15 KB	236ms 235ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=2040788935048863&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C580x400%7C728x90%7C320x50%7C468x60%7C234x60&fluid=height&ris=1&rcs=5&prev_scp=iid13%3D1296797%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1101%26sap%3D1101%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-3-1296797%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D1%26ebss%3D10061%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D4%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D32%252C0%252C0%252C4%252C0%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D32%26reqt%3D1609365391063%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365391065&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=230&adys=733&adks=2979263878&ucis=t&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=30&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=809x408&msz=809x400&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=0&ohw=0&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 8a74970a7712e416ffbf40da9b69ff3ba122e16b621fc9412954d0333669b43b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14821 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame A21C	180 KB 50 KB	38ms 6ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8100 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:31 GMT
GET H2	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A21C	13 KB 6 KB	37ms 5ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8539 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:34:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:34:12 GMT
GET H2	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A21C	90 KB 27 KB	50ms 18ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8101 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:30 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:30 GMT
GET H2	200	amp-animation-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A21C	72 KB 16 KB	49ms 17ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-animation-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1ed84e4aa1f7fe5f0907cb64ee40941cf5cf83395e98292472157d2be68dbdd7 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 435989 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16597 x-xss-protection 0 server sffe date Fri, 25 Dec 2020 20:50:02 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "9b07487c3da4c1d6" accept-ranges bytes timing-allow-origin * expires Sat, 25 Dec 2021 20:50:02 GMT
GET H2	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A21C	3 KB 1 KB	48ms 17ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8566 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:33:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:33:45 GMT
GET H2	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame A21C	41 KB 13 KB	45ms 14ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8086 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:45 GMT
GET DATA	200 OK	truncated / Frame A21C	211 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 24f9ae4dc32194ec0c7953f8b16772dcada0e2666839c3f9017ac7a3e8b74249 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	slide1.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	20 KB 20 KB	12ms 6ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/slide1.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 71dfda8fd5c5c7c9c57bce83835ef523c647814db4b641c63fe87890e8682a7a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 24 Dec 2020 17:56:52 GMT x-content-type-options nosniff age 532779 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20062 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Dec 2021 17:56:52 GMT
GET H3-Q050	200	slide2.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	14 KB 14 KB	15ms 9ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/slide2.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d602f8422003828e7d35f194ad73b12f1a6b6477ca302ef96832f86a36686acb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 29 Dec 2020 11:26:04 GMT x-content-type-options nosniff age 124227 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14469 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 29 Dec 2021 11:26:04 GMT
GET H3-Q050	200	slide3.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	15 KB 15 KB	14ms 8ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/slide3.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 43d3460747fb8324df6cf2afdb88c6e12253b146dfeb2ad102f54425e9b204c2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 24 Dec 2020 13:09:49 GMT x-content-type-options nosniff age 550002 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15561 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Dec 2021 13:09:49 GMT
GET H3-Q050	200	logo.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	2 KB 2 KB	21ms 14ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/logo.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9c7ca60b062547f5d1c959768a6c8c38ef8236aa8bd7a78753d7bc712d3c75b3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Dec 2020 08:13:58 GMT x-content-type-options nosniff age 481353 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2036 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 25 Dec 2021 08:13:58 GMT
GET H3-Q050	200	cirkel.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	913 B 996 B	20ms 14ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/cirkel.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 79549d48848bce0da3416d3d930f126e011f8ef0ab1e7fcd786606da43c23e97 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Dec 2020 08:13:58 GMT x-content-type-options nosniff age 481353 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 913 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 25 Dec 2021 08:13:58 GMT
GET H3-Q050	200	pris2.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	1 KB 1 KB	19ms 13ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/pris2.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3587af44af3d2e063c3216bc813037f60d52fa3eadbd282a11627df5e18f2dbd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 25 Dec 2020 09:30:23 GMT x-content-type-options nosniff age 476768 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1095 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Sat, 25 Dec 2021 09:30:23 GMT
GET H3-Q050	200	pil.png tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/ Frame A21C	346 B 615 B	18ms 13ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/11456418361993745303/ASE_300x250_samletpakke/pil.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e59dd7f855e7f872fd01be632e6e07a000878eb5fe8c107792a744a27e5e1203 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 24 Dec 2020 16:18:22 GMT x-content-type-options nosniff age 538689 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 346 x-xss-protection 0 last-modified Tue, 22 Sep 2020 08:02:58 GMT server sffe content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Fri, 24 Dec 2021 16:18:22 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A21C	2 KB 3 KB	15ms 10ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Tue, 29 Dec 2020 23:34:27 GMT x-content-type-options nosniff server cafe age 80524 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Wed, 30 Dec 2020 23:34:27 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A21C	295 B 399 B	15ms 10ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:53:21 GMT x-content-type-options nosniff server cafe age 190 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Thu, 31 Dec 2020 21:53:21 GMT
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame A21C	0 0	64ms 61ms	Image text/html	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CCR68j_fsX7TpB4mp3gOA8Iz4A9m_0M1gjfbl9J0M8t3S4LIBEAEg9PnGJWDRgbmC0AegAZK0nu4DyAEJqQIgbx_RdyeGPuACAKgDAcgDCKoE9AFP0P5enidDcVTxMbSH3g1cUEhQwGay6BqZuYqiqOW26LsgmGZXlsFacbXsC8qr_HFluzt_P0nnMJ3QED0GF6eg6mb3y9Z2H7kLsLnbbEHEYlHWBe0CAxVKm_i9p-0xyUh3ZxFkIoXycicOzb3WkgUQRUn6SgNLjl6yzgr4m6TBh2Ly0loTmrCmuFszlIuGRU65ZILXbiIlQhTRFDbZ3WkNRRYsUmq0Y97wHeOmAk2YtXDjFOc7lFu8B1vjULLXLbCh6NVxiklXgI9I2Sv0Y-powSvqWei7P9DZc3_Xj1Sj5atqZViNXwrsOk_dStXPAjgH6uB6wASPuLeikwPgBAGSBQQIBBgBkgUECAUYBKAGLoAH1svhEagH1ckbqAfw2RuoB_LZG6gHlJixAqgHpd8bqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcDEPAu0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi01ODkzMjk0NDYyMDYxMTQwgAoDyAsB2BMNshcaChgIARIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=gA6DNKBFVfk&template_id=419&tpd=AGWhJmv4mrKOcHsIKjsjITYxfiQHrWuS3mfzhDm-126m8wp6Bg Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	28687274 Show response g.ezoic.net/dac/	0 40 B	42ms 40ms	XHR text/plain	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/dac/28687274 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=191-2&bv=94&v=36&PageSpeed=off Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Wed, 30 Dec 2020 21:56:31 GMT cache-control max-age=3600, public server nginx/1.16.0 content-length 0 vary Accept-Encoding content-type text/plain
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 124 B	41ms 39ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjYifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTY3OTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjljM2U0ZWU4ZWFlN2YxNDMzY2IyZmU2OWIxMzI2NjA1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjk2Nzk3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2MDkzNjUzODMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA0LCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDQsImJpZF9mbG9vcl9wcmV2IjowLjAwMDMyLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1ODUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTY3OTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 78 B	43ms 40ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMC0xMi0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 78 B	41ms 40ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhdWN0aW9uX2Vwb2NoIjoxNjA5MzY1MzkxLCJhZF9wb3NpdGlvbiI6MTEwMSwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImJpZF9mbG9vcl9pbml0aWFsIjo5NTAsImJpZF9mbG9vcl9wcmV2IjozMiwiYmlkX2Zsb29yX2ZpbGxlZCI6NCwiYXVjdGlvbl9jb3VudCI6NiwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MjY1LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A21C	2 KB 3 KB	6ms 6ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Tue, 29 Dec 2020 23:34:27 GMT x-content-type-options nosniff server cafe age 80524 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Wed, 30 Dec 2020 23:34:27 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame A21C	295 B 321 B	6ms 6ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:53:21 GMT x-content-type-options nosniff server cafe age 190 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Thu, 31 Dec 2020 21:53:21 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	354 B 178 B	191ms 191ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3160633844700792&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=6&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D8de355ef1cf56b7da61277050d9957b1%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D18%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D50%26reqt%3D1609365391515%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365391518&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=u&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=31&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=7&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash c7ed0aef8dc95b45856d51bd0c04a4f178f469e3a24c5f598137b3c77a2e5e5d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 148 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	47 KB 11 KB	230ms 229ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=3056215280605649&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ris=1&rcs=6&prev_scp=iid14%3D1330547%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26a%3D%257C6%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreturnsandrefund_com-medrectangle-2-1330547%26eb_br%3D2e8b8c60843e52e5aaa1e3a52287a2bb%26eba%3D1%26ebss%3D10061%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D1%26ftsn%3D3%26br1%3D8%26br2%3D650%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D40%26reqt%3D1609365391530%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365391533&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1100&adks=1612927107&ucis=v&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,858585|color_text,,000000|color_url,,F0F0F0&ifi=32&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=516&ohw=970&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 533d4c2ae5660198b2fe2cada86fe7c0ed10411e20944ab50393aed95fc5a79d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11102 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	42 KB 11 KB	209ms 209ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1766750635462942&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=6&prev_scp=iid13%3D1292147%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1112%26sap%3D1112%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreturnsandrefund_com-box-2-1292147%26eb_br%3D2e8b8c60843e52e5aaa1e3a52287a2bb%26eba%3D1%26ebss%3D10061%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D8%26br2%3D350%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D28%26reqt%3D1609365391563%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365391566&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=650&adys=81&adks=3891574843&ucis=w&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=33&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1140x260&msz=302x252&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash 36dc5479c5e98d28392dccd5840c3b9cef6a2c591e6fdbd0b62ca0fc6e9e8c53 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10750 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe google-creative-id -1 content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com access-control-expose-headers x-google-amp-ad-validated-version cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame 6012	180 KB 50 KB	227ms 212ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8100 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:31 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 6012	13 KB 5 KB	227ms 212ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8539 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:34:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:34:12 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 6012	90 KB 27 KB	223ms 208ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8101 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:30 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:30 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 6012	3 KB 2 KB	223ms 208ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8566 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:33:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:33:45 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame 6012	41 KB 13 KB	228ms 213ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8086 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:45 GMT
GET H3-Q050	200	css fonts.googleapis.com/ Frame 6012	4 KB 697 B	15ms 15ms	Stylesheet text/css	2a00:1450:4001:81d::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2190c16423c2557bcb20ccba2edc176fbeb16e6a3de2b2af297f650aae85a43e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 30 Dec 2020 20:00:44 GMT server ESF date Wed, 30 Dec 2020 21:56:31 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 30 Dec 2020 21:56:31 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6012	2 KB 2 KB	7ms 7ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Tue, 29 Dec 2020 23:34:27 GMT x-content-type-options nosniff server cafe age 80524 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Wed, 30 Dec 2020 23:34:27 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6012	295 B 321 B	7ms 7ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:53:21 GMT x-content-type-options nosniff server cafe age 190 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Thu, 31 Dec 2020 21:53:21 GMT
GET DATA	200 OK	truncated / Frame 6012	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 35dd2f821439ae8561e6e55aa7458ff714a291977458216eb9ffb7e937afa6f3 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 6012	0 0	109ms 108ms	Image text/html	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C51btj_fsX-ibJJe13gOchoRI-YSb91zYjJ2m8gn_0IqS7BcQASD0-cYlYNGBuYLQB6ABo4fz_QPIAQGpAiBvH9F3J4Y-4AIAqAMByAMKqgTxAU_QSKPglP-TfIEtuP37TSWYBQUhXVLU_0iXjbsn_EdRoR2L3S0jDkrurlOG_2gzgAxFGsrfss-YL62iXusO9FHyEOiHA8hK03w8VCxpA2U-5jvmcFqyKAIC1qFuMqvD1_WWJ15Epahqx3xUtd9qeBPyh0l9z-E5sUeR3JVYAFr566sW97Xp-nrRsU1b6dYoGxYxqx2NlHZbOC6o45C521bEJahkXlILsqQ81Ef4wg20M9V89hplBXXhSGLl9CtuplcXbeRLd-dJ3Jzis_jT3etjwa_4cr3y_gYJqPidh1OcBHZ4mJ3uonqM3gdeNUF9D7TABLjkmaelAuAEAYAHxfiMAqgH1ckbqAfw2RuoB_LZG6gHlJixAqgHpd8bqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcDEPAu0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi01ODkzMjk0NDYyMDYxMTQwgAoDyAsB2BMDshcaChgIARIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=C4DHhDEgsuU&tpd=AGWhJmuhloT0Oz5FnbTtizfXMkudKw5FKgdFy_r6Uc8_7Zs2zA Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	28687274 Show response g.ezoic.net/dac/	0 17 B	92ms 84ms	XHR text/plain	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/dac/28687274 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=191-2&bv=94&v=36&PageSpeed=off Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Wed, 30 Dec 2020 21:56:31 GMT cache-control max-age=3600, public server nginx/1.16.0 content-length 0 vary Accept-Encoding content-type text/plain
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	95ms 87ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzMzA1NDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjJlOGI4YzYwODQzZTUyZTVhYWExZTNhNTIyODdhMmJiIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzMwNTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MDkzNjUzODMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA4LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDgsImJpZF9mbG9vcl9wcmV2IjowLjAwMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzMwNTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 101 B	93ms 86ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMC0xMi0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	95ms 87ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhdWN0aW9uX2Vwb2NoIjoxNjA5MzY1MzkyLCJhZF9wb3NpdGlvbiI6MTEwMCwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImJpZF9mbG9vcl9pbml0aWFsIjoxMzAwLCJiaWRfZmxvb3JfcHJldiI6NDAsImJpZF9mbG9vcl9maWxsZWQiOjgsImF1Y3Rpb25fY291bnQiOjcsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjI0MSwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjAsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H3-Q050	200	amp4ads-v0.mjs Show response cdn.ampproject.org/rtv/012010270040000/ Frame E27A	180 KB 50 KB	196ms 194ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/amp4ads-v0.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b2ab9ac436910017b9a2ca7db0e981bad3638db97f576d713eaa9b302e06c094 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8100 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51478 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:31 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "0305d7d21a7fe4a1" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:31 GMT
GET H3-Q050	200	amp-ad-exit-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame E27A	13 KB 5 KB	196ms 194ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-ad-exit-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ebab910fdc7c7e9e079caa9f7321177b135b2e1542f86ce36937ceb41865086d Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8539 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4850 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:34:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "77bd676d834aaa8d" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:34:12 GMT
GET H3-Q050	200	amp-analytics-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame E27A	90 KB 27 KB	196ms 194ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-analytics-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 477549a4d5fb644cda6bf64af01631b8411022d88e608bbd8e5a06e327b391cb Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8101 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27668 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:30 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1304c1c0caf7ca3c" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:30 GMT
GET H3-Q050	200	amp-fit-text-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame E27A	3 KB 1 KB	196ms 194ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-fit-text-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a86753d4effe5e607d4eaf03fe37eccb8cac743a528f874f736f4d7f35e094b1 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8566 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1350 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:33:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "12c034eb739190af" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:33:45 GMT
GET H3-Q050	200	amp-form-0.1.mjs Show response cdn.ampproject.org/rtv/012010270040000/v0/ Frame E27A	41 KB 13 KB	196ms 195ms	Script text/javascript	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012010270040000/v0/amp-form-0.1.mjs Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b61eb57ae77f31b91b04781da33023ecd897fda21f6c817e6c27623204046f42 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff age 8086 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13075 x-xss-protection 0 server sffe date Wed, 30 Dec 2020 19:41:45 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/javascript access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=31536000 etag "1e8a1dae72af56cd" accept-ranges bytes timing-allow-origin * expires Thu, 30 Dec 2021 19:41:45 GMT
GET H3-Q050	200	en.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E27A	2 KB 2 KB	72ms 71ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/en.png Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Tue, 29 Dec 2020 23:34:27 GMT x-content-type-options nosniff server cafe age 80524 etag 14819457070020093239 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2502 x-xss-protection 0 expires Wed, 30 Dec 2020 23:34:27 GMT
GET H3-Q050	200	icon.png tpc.googlesyndication.com/pagead/images/adchoices/ Frame E27A	295 B 321 B	74ms 73ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Wed, 30 Dec 2020 21:53:21 GMT x-content-type-options nosniff server cafe age 190 etag 426692510519060060 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control public, max-age=86400 cross-origin-resource-policy cross-origin content-type image/png alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 295 x-xss-protection 0 expires Thu, 31 Dec 2020 21:53:21 GMT
GET DATA	200 OK	truncated / Frame E27A	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1c9d2bce84299fc5f28fb34923995f1214d43281737cb284514bbf290c2d6667 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	17511748044716973146 tpc.googlesyndication.com/simgad/ Frame E27A	43 KB 43 KB	72ms 72ms	Image image/png	2a00:1450:4001:81f::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/17511748044716973146?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qktbJQMp6At2OXqdjcwAPjCb7z6oA Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash dd0a0491a94b168a6127bb932042904e522c8cd9d5cc1886e16ea56ce23308c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 24 Dec 2020 22:43:55 GMT x-content-type-options nosniff last-modified Fri, 13 Nov 2020 12:15:30 GMT server sffe age 515556 content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44140 x-xss-protection 0 expires Fri, 24 Dec 2021 22:43:55 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame E27A	0 0	58ms 0ms	Image text/html	2a00:1450:4001:814::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRemOnpnwVieAO_XtMbVNsV27VWGIl0Q3ap1K1-oGRnmdwLgD2oWseMiMCtoxMeCI4T9dpl-us6pdcQ4A5hMc5Zau6dag Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame E27A	0 0	76ms 75ms	Image text/html	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=C7FYpj_fsX7epJqaN3gOfqZLQBLevkedg0tXduu4MiajZyZYOEAEg9PnGJWDRgbmC0AegAYeDv_cDyAEC4AIAqAMByAMIqgT2AU_QIkfnk8j3D9Vy12Fppwe38tzUCbmwik81psTiXeq3fpl0xco60-EC9rVH54efJfbs10EyQqKPIn7_l33sBAsVEfijirpUcEWjs_I0Uc4wreW0aYwg2_x4ipLqgTL0M9l4_lq4sz_vz5O_MYUlgRAFK1BT03wByN4GzNWf3EUWS_sbDTZ4C-pgOW7UnDjT8wvNoMziMr4QivzGNCbKMQnqS1s1YzfYgckFvS2ZABNDf5NHYlMElO92gZ6DoC5dV9C0kY95uoOCdPGuKSdk32JyrOdBJIL0DQiObGSD2gALhtlqTxeAPBOzTNwaEBgOwbm7uIDYW8AEtNzbgsQD4AQBkgUECAQYAZIFBAgFGASgBgKAB-T0l4kBqAfVyRuoB_DZG6gH8tkbqAeUmLECqAel3xuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwMQ8C7SCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTU4OTMyOTQ0NjIwNjExNDCACgPICwHYEwuyFxoKGAgBEhRwdWItNjM5Njg0NDc0MjQ5NzIwOA&sigh=Gim1rbRFXWA&tpd=AGWhJmsr8E8Guzz4khgB5zBvnRu7lyTPQRc3GFbk4qy8y5L3EA Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 6012	11 KB 11 KB	16ms 6ms	Font font/woff2	2a00:1450:4001:825::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://returnsandrefund.com Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 28 Dec 2020 22:21:20 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:48 GMT server sffe age 171311 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11056 x-xss-protection 0 expires Tue, 28 Dec 2021 22:21:20 GMT
GET H3-Q050	200	KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 fonts.gstatic.com/s/roboto/v20/ Frame 6012	11 KB 11 KB	11ms 7ms	Font font/woff2	2a00:1450:4001:825::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://returnsandrefund.com Referer https://fonts.googleapis.com/css?family=Roboto%3A400%2C500 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 29 Dec 2020 17:20:25 GMT x-content-type-options nosniff last-modified Wed, 24 Jul 2019 01:18:50 GMT server sffe age 102966 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11016 x-xss-protection 0 expires Wed, 29 Dec 2021 17:20:25 GMT
GET H2	200	28687274 Show response g.ezoic.net/dac/	0 17 B	61ms 58ms	XHR text/plain	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/dac/28687274 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=191-2&bv=94&v=36&PageSpeed=off Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Wed, 30 Dec 2020 21:56:31 GMT cache-control max-age=3600, public server nginx/1.16.0 content-length 0 vary Accept-Encoding content-type text/plain
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	59ms 56ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTIxNDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjJlOGI4YzYwODQzZTUyZTVhYWExZTNhNTIyODdhMmJiIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjkyMTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MDkzNjUzODMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA4LCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDgsImJpZF9mbG9vcl9wcmV2IjowLjAwMDI4LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1NDcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTIxNDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:30 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	59ms 57ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMC0xMi0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	59ms 57ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhdWN0aW9uX2Vwb2NoIjoxNjA5MzY1MzkyLCJhZF9wb3NpdGlvbiI6MTExMiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImJpZF9mbG9vcl9pbml0aWFsIjo3MDAsImJpZF9mbG9vcl9wcmV2IjoyOCwiYmlkX2Zsb29yX2ZpbGxlZCI6OCwiYXVjdGlvbl9jb3VudCI6NywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MjQzLCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	49ms 48ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI4ODU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:31 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H3-Q050	200	si googleads.g.doubleclick.net/pagead/drt/ Frame E27A Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	45ms 45ms	Image text/html	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Wed, 30 Dec 2020 21:56:32 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	82 KB 26 KB	209ms 208ms	XHR text/plain	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3231529339743241&correlator=1325604818423378&output=ldjh&impl=fif&adsid=NT&eid=21068773%2C21064372&vrg=2020120801&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201230&iu_parts=1254144%2Creturnsandrefund_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=7&prev_scp=iid13%3D1256297%26t%3D134%26d%3D200400%26t1%3D134%26pvc%3D0%26ap%3D1115%26sap%3D1115%26a%3D%257C3%257C%26as%3Drevenue%26plat%3D1%26bra%3Dmod1%26ic%3D8%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1034%26compid%3D0%26tap%3Dreturnsandrefund_com-large-billboard-2-1256297%26eb_br%3D33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10061%26bv%3D19%26bvm%3D0%26bvr%3D9%26shp%3D2%26ftsn%3D3%26br1%3D6%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%252C14%252C0%252C4%252C97%252C122%252C66%252C20%252C71%252C30%252C0%252C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26lb%3D18%26reqt%3D1609365392041%26ft%3D1&eri=1&cookie=ID%3D8860435517aff61f%3AT%3D1609365385%3AS%3DALNI_MaQkthSey5dCT8h5lN-vf4cHUeW9A&bc=31&abxe=1&lmt=1609317976&dt=1609365392044&dlt=1609365384568&idt=997&frm=20&biw=1600&bih=1200&oid=3&adxs=1121&adys=1593&adks=2751293819&ucis=x&sps=channel,,5182165687|color_bg,,FFFFFF|color_border,,FFFFFF|color_link,,0000FF|color_text,,000000|color_url,,828282&ifi=34&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&url=https%3A%2F%2Freturnsandrefund.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x267&msz=302x252&ga_vid=808650277.1609365385&ga_sid=1609365385&ga_hid=1229858485&ga_fc=true&ga_wpids=UA-169284892-10&fws=4&ohw=302&btvi=8&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software cafe / Resource Hash b4a21b1d8119f2b4ff78cd577c09c928394fa0a0b50d2d52267bf84dcc37dce6 Security Headers Name Value Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3167790014025824344/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3167790014025824344/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLrZiqTZ9u0CFTYMiwodo2wACA&gqi=&layout=/sadbundle/%24csp%253Der3%24/3167790014025824344/index.html X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3167790014025824344/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/3167790014025824344/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLrZiqTZ9u0CFTYMiwodo2wACA&gqi=&layout=/sadbundle/%24csp%253Der3%24/3167790014025824344/index.html content-encoding br x-content-type-options nosniff google-creative-id -1 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 25583 x-xss-protection 0 google-lineitem-id -1 pragma no-cache server cafe date Wed, 30 Dec 2020 21:56:32 GMT content-type text/plain; charset=UTF-8 access-control-allow-origin https://returnsandrefund.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	si googleads.g.doubleclick.net/pagead/drt/ Frame 6012 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si	0 0	50ms 49ms	Image text/html	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://googleads.g.doubleclick.net/pagead/drt/si Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Redirect headers date Wed, 30 Dec 2020 21:56:32 GMT x-content-type-options nosniff server safe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/drt/si cache-control private alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 246 x-xss-protection 0
GET H3-Q050	200	container.html 89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame FC00	0 0	7ms 6ms	Document text/html	2a00:1450:4001:808::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020120801.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 89f87c7b46df82a7ba5be1f86be0d8d3.safeframe.googlesyndication.com :scheme https :path /safeframe/1-0-37/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://returnsandrefund.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://returnsandrefund.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin timing-allow-origin * content-length 2973 date Wed, 30 Dec 2020 21:56:25 GMT expires Thu, 30 Dec 2021 21:56:25 GMT last-modified Thu, 21 Nov 2019 16:01:11 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 7 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	28687274 Show response g.ezoic.net/dac/	0 40 B	65ms 61ms	XHR text/plain	3.127.76.126 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://g.ezoic.net/dac/28687274 Requested by Host: returnsandrefund.com URL: https://returnsandrefund.com/porpoiseant/banger.js?cb=191-2&bv=94&v=36&PageSpeed=off Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-76-126.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * date Wed, 30 Dec 2020 21:56:32 GMT cache-control max-age=3600, public server nginx/1.16.0 content-length 0 vary Accept-Encoding content-type text/plain
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 102 B	65ms 62ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI1NjI5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExNSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyNTYyOTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjMzZGQ1MjNmOGU0ZGRhMTU4ZjBhYTk5Njg2ZGRhN2YyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjU2Mjk3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbGFyZ2UtYmlsbGJvYXJkLTItMCIsInRfZXBvY2giOjE2MDkzNjUzODMsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA2LCJhZF9wb3NpdGlvbiI6MTExNSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDYsImJpZF9mbG9vcl9wcmV2IjowLjAwMDE4LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI1NjI5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExNSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1NDcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyNTYyOTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	65ms 62ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI1NjI5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExNSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMC0xMi0zMCJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	65ms 63ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTI1NjI5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhdWN0aW9uX2Vwb2NoIjoxNjA5MzY1MzkyLCJhZF9wb3NpdGlvbiI6MTExNSwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImJpZF9mbG9vcl9pbml0aWFsIjo4NTAsImJpZF9mbG9vcl9wcmV2IjoxOCwiYmlkX2Zsb29yX2ZpbGxlZCI6NiwiYXVjdGlvbl9jb3VudCI6OCwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MjMzLCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:31 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	42ms 41ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI4ODU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0xLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MjA4NjExMDk1LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyODg1NDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMS0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODIwODYxMTA5NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjg4NTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTEtMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgyMDg2MTEwOTUsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzIifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame A21C	42 B 71 B	21ms 21ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst-oawyiO2eHXzZyLiWiEbKKG9aMrqxjneKJUjyJRVrlsvuH-dptg7ZZXgeOJmmZKZBTbX5CKeh46pWZDGF1RhcxryNol22XaVJ_RFleTbW4wJbNm1xaQ8ucPoF0Q&sai=AMfl-YQjj7v8b2fY4a9QaQgsNBo8BJ21ZN67ZvoKb1Xyqj2zJnJBTnQ9PthMPYdOUZohjDRR7o7FVcj5wdxjZY09jsnyvPKT7qeoNqI9t-P0U5jCZxXkIIvDUN2NvKN5&sig=Cg0ArKJSzOSxxWlNs_d2EAE&cid=CAASF-Ro9mu1u_m6vvc3hfmYwlWUeCTOJokm&id=ampim&o=485,733&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=128&tls=1129&g=100&h=100&tt=1129&r=v&avms=ampa&adk=2979263878 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:32 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	35ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	36ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5Njc5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0zLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg1LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTY3OTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMy0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDEsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjk2Nzk3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbWVkcmVjdGFuZ2xlLTMtMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImFkX3Bvc2l0aW9uIjoxMTAxLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzIifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H2	200	greenoaks.gif returnsandrefund.com/detroitchicago/	43 B 79 B	37ms 36ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJkb21haW5faWQiOiIyMDA0MDAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjM1MjI1MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI0In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjUxNDU1MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiNjAwMTYwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiIzNzUxIn1dfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:32 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame E27A	42 B 66 B	20ms 19ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvxCNB8Qr3AMwNw3mBY8b6S8sO6kSaDZlmT949f_pYwPMyVi8k4Tm1otOgSan73Zg8UPcNFjriYGl75osARC-EE7juupTOUiy_jBeKHQGqnClcLLZCLmaYcAdtrbA&sai=AMfl-YQ5HlSsp1f2r14sz76e2thEqF_EnuSdxD3X7QOwfDzJKWBWs0PzmMmuxBJGK43Dc3F_lKueHABJnnEyGvVJIfScDEoOpf5tCSICe7q64QdKKVWyD1n2PG880mky&sig=Cg0ArKJSzFKD774Z57SOEAE&cid=CAASF-RoLLLoxgxjl4JxjtvPZ4xta39M4l0j&id=ampim&o=650,81&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=106&tls=1106&g=100&h=100&tt=1107&r=v&avms=ampa&adk=3891574843 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 135 B	36ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:33 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:33 UTC
GET H3-Q050	200	adview securepubads.g.doubleclick.net/pagead/ Frame 6012	0 0	59ms 58ms	Image text/html	172.217.21.226 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CzsiVj_fsX-ibJJe13gOchoRI-YSb91zYjJ2m8gn_0IqS7BcQASD0-cYlYNGBuYLQB6ABo4fz_QPIAQGpAiBvH9F3J4Y-4AIAqAMBqgTxAU_QSKPglP-TfIEtuP37TSWYBQUhXVLU_0iXjbsn_EdRoR2L3S0jDkrurlOG_2gzgAxFGsrfss-YL62iXusO9FHyEOiHA8hK03w8VCxpA2U-5jvmcFqyKAIC1qFuMqvD1_WWJ15Epahqx3xUtd9qeBPyh0l9z-E5sUeR3JVYAFr566sW97Xp-nrRsU1b6dYoGxYxqx2NlHZbOC6o45C521bEJahkXlILsqQ81Ef4wg20M9V89hplBXXhSGLl9CtuplcXbeRLd-dJ3Jzis_jT3etjwa_4cr3y_gYJqPidh1OcBHZ4mJ3uonqM3gdeNUF9D7TABLjkmaelAuAEAYAHxfiMAqgH1ckbqAfw2RuoB_LZG6gHlJixAqgHpd8bqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcB8gcDEPAu0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi01ODkzMjk0NDYyMDYxMTQwgAoDyAsB2BMDshcaChgIARIUcHViLTYzOTY4NDQ3NDI0OTcyMDg&sigh=AaX9bjYYjEA&vt=1 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 172.217.21.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s13-in-f226.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame 6012	42 B 66 B	21ms 20ms	Image image/gif	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstaEbD8ntpTtQIdWCPcgq3j58gg4hV4-z-LRRdvJxTAxcMy2SBoOdKzkJlwRD2vCVogvwjdaxPvD6Wv5Yv50jPGjIXy08l1xhyfeWGhmGGxO_ucGfXW5Wu9WgGi7t6Avaa0eLDAGa-ovb6BRG36vZL7&sai=AMfl-YShufBs2VVQCmeDRsSkwAH5zqHhj2PtK--M6hb_A-zIaZJJfDrO_PsTdQZNhl_N8kJgz8FgN0CpPy7CpEHlV5IJw6tsdyWs5RLD_Y8n-fDaaEPm4i7nk4RQbkkw&sig=Cg0ArKJSzHXQeme-PEPvEAE&cid=CAASF-RoVUNhO63TRcC_wwoeAmSrVVKl5RFZ&id=ampim&o=315,1100&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=106&tls=1106&g=100&h=100&tt=1106&r=v&avms=ampa&adk=1612927107 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 30 Dec 2020 21:56:33 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	35ms 35ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:33 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:33 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	40ms 38ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbOTcwLDkwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTMzMDU0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzMzA1NDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxMjIifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:33 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:32 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	35ms 34ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI5MjE0NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExMiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyOTIxNDciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTIsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjkyMTQ3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImFkX3Bvc2l0aW9uIjoxMTEyLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NDcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:33 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:33 UTC
GET H2	200	army.gif returnsandrefund.com/porpoiseant/	43 B 79 B	36ms 36ms	Image image/gif	18.156.95.187 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://returnsandrefund.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTI1NjI5NyIsImRvbWFpbl9pZCI6IjIwMDQwMCIsInVuaXQiOiJkaXYtZ3B0LWFkLXJldHVybnNhbmRyZWZ1bmRfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjA5MzY1MzgzLCJhZF9wb3NpdGlvbiI6MTExNSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRLIiwicGFnZXZpZXdfaWQiOiJlZTBlNGMzOC1iNWZmLTQ1MDgtNjVjNi01YTNlMjcwMmNjODEiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEyNTYyOTciLCJkb21haW5faWQiOiIyMDA0MDAiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZXR1cm5zYW5kcmVmdW5kX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTYwOTM2NTM4MywiYWRfcG9zaXRpb24iOjExMTUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJESyIsInBhZ2V2aWV3X2lkIjoiZWUwZTRjMzgtYjVmZi00NTA4LTY1YzYtNWEzZTI3MDJjYzgxIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMjU2Mjk3IiwiZG9tYWluX2lkIjoiMjAwNDAwIiwidW5pdCI6ImRpdi1ncHQtYWQtcmV0dXJuc2FuZHJlZnVuZF9jb20tbGFyZ2UtYmlsbGJvYXJkLTItMCIsInRfZXBvY2giOjE2MDkzNjUzODMsImFkX3Bvc2l0aW9uIjoxMTE1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREsiLCJwYWdldmlld19pZCI6ImVlMGU0YzM4LWI1ZmYtNDUwOC02NWM2LTVhM2UyNzAyY2M4MSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NDcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNjMifV0sImlzX29yaWciOmZhbHNlfV0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.156.95.187 , United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-95-187.eu-central-1.compute.amazonaws.com Software nginx/1.16.0 / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Referer https://returnsandrefund.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 30 Dec 2020 21:56:33 GMT content-encoding br server nginx/1.16.0 vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/gif x-middleton-display ezp_sol cache-control max-age=0, must-revalidate, no-cache, no-store content-length 47 expires Tue, 29 Dec 2020 21:56:33 UTC