www.baba-mail.co.il Open in urlscan Pro
51.79.4.160 Public Scan

Software

ESF /

Resource Hash

f091f394c95ba69619ebdd9817ceea9110c65fb521bdd29ac6c0803c782ce105

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-afefs3U-gR0JPS8a5HLkSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
content-security-policy: script-src 'report-sample' 'nonce-afefs3U-gR0JPS8a5HLkSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 91 KB
29 KB 173ms
82ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f6147b60f69b6732cc649de5540acf825491e91509a4fa923cedbb5c48338a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29635
x-xss-protection: 0
server: cafe
etag: 60 / 19646 / m202310100101 / config-hash: 16434453456482711861
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:17 GMT

GET
H/1.1 200
OK opensanshebrew-bold.woff
www.baba-mail.co.il/fonts/ 14 KB
14 KB 30ms
29ms Font
font/x-woff 51.79.4.160
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.baba-mail.co.il/fonts/opensanshebrew-bold.woff
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/css/site.rtl.min.css?v=3.2.6.33
Protocol: HTTP/1.1
Server: 51.79.4.160 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ip160.ip-51-79-4.net
Software: Server /
Resource Hash: 22a63798dfc04117296d0d0aaa9e426e55d6bd43aa7e2f79d898e76adc918e86

Request headers

Referer: http://www.baba-mail.co.il/css/site.rtl.min.css?v=3.2.6.33
Origin: http://www.baba-mail.co.il
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 11:40:51 GMT
Last-Modified: Wed, 20 Feb 2019 11:29:50 GMT
Server: Server
ETag: "7d8fab97fc9d41:0"
Content-Type: font/x-woff
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Content-Length: 13856
Expires: Wed, 12 Sep 2040 00:00:00 GMT

GET
H/1.1 200
OK baba.woff
www.baba-mail.co.il/fonts/ 26 KB
27 KB 31ms
30ms Font
font/x-woff 51.79.4.160
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.baba-mail.co.il/fonts/baba.woff?65430906
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/css/site.rtl.min.css?v=3.2.6.33
Protocol: HTTP/1.1
Server: 51.79.4.160 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ip160.ip-51-79-4.net
Software: Server /
Resource Hash: 7209a40e70d0ed35bef2545a98bd135435fff85c88fb5302d2b5e35b71df56cd

Request headers

Referer: http://www.baba-mail.co.il/css/site.rtl.min.css?v=3.2.6.33
Origin: http://www.baba-mail.co.il
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 11:40:51 GMT
Last-Modified: Tue, 18 Aug 2020 11:38:24 GMT
Server: Server
ETag: "f53fe3145475d61:0"
Content-Type: font/x-woff
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Content-Length: 27024
Expires: Wed, 12 Sep 2040 00:00:00 GMT

GET
H/1.1 200
OK opensanshebrew-regular.woff
www.baba-mail.co.il/fonts/ 13 KB
14 KB 30ms
30ms Font
font/x-woff 51.79.4.160
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.baba-mail.co.il/fonts/opensanshebrew-regular.woff
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/css/site.rtl.min.css?v=3.2.6.33
Protocol: HTTP/1.1
Server: 51.79.4.160 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ip160.ip-51-79-4.net
Software: Server /
Resource Hash: 636f52528d61a565f93b83ec8fa646435c1b64f67ba5f4db64314f1692214fa7

Request headers

Referer: http://www.baba-mail.co.il/css/site.rtl.min.css?v=3.2.6.33
Origin: http://www.baba-mail.co.il
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 11:40:51 GMT
Last-Modified: Wed, 20 Feb 2019 11:29:50 GMT
Server: Server
ETag: "60b6b297fc9d41:0"
Content-Type: font/x-woff
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Content-Length: 13808
Expires: Wed, 12 Sep 2040 00:00:00 GMT

GET
H2 200 d1c41869-0fbb-4c64-a70b-a1b7e0699dd6.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
11 KB 59ms
26ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/d1c41869-0fbb-4c64-a70b-a1b7e0699dd6.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0001254102c8b4fdbc38449cf4eb1b6a40fc601b5ad98474244832dfb66c2b6c

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 588988
alt-svc: h3=":443"; ma=86400
content-length: 11096
last-modified: Mon, 09 Oct 2023 10:34:13 GMT
server: cloudflare
etag: "f9c838259cfad91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjirSJjaP43jozdmtzyRscYalA4OAtQRTxbt5RoytgzRYI%2BYZiRUNHY%2FQiiHGRkbO221%2FllXiRuEAx9JUNsGct7s3E8UQMlkZqKej7GFBDn2LXZ4hICqQ4HpwHe0stNWj7wVmH0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e2dec36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 b7fe80d1-b0ee-4096-8481-6b6497e87987.jpg
cdn.babamail.co.il/images/emails/320x192/ 20 KB
20 KB 62ms
26ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/b7fe80d1-b0ee-4096-8481-6b6497e87987.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c23214afbbd622927b1abec7f04b623e0490aadd9ed1dc0ebdcf23553c0d9c1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 197203
alt-svc: h3=":443"; ma=86400
content-length: 20022
last-modified: Mon, 02 Oct 2023 07:44:52 GMT
server: cloudflare
etag: "8cf45c544f5d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yT%2Bb%2BWpozp48HWvSxU6LZMStMmzxOyVrTwneN4chl2sBN3%2BmfOXtc2dtgr6xOzpVvo3sNdJuVomn4QXfbLHYiHwuT73G1Szh9aY6TQ%2F68fBgdfvgYW%2FkpoyY3zf%2BI6%2FfBjtU3MM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3df736d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 a1892f39-5eba-4fe9-8cc9-c5b63690942f.jpg
cdn.babamail.co.il/images/emails/320x192/ 12 KB
12 KB 68ms
32ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/a1892f39-5eba-4fe9-8cc9-c5b63690942f.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d1a8f4319692425d2355e6d05507a9fc71e764a785949f3f0a2b73fd33a596a

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 167701
alt-svc: h3=":443"; ma=86400
content-length: 12223
last-modified: Wed, 13 Sep 2023 08:02:27 GMT
server: cloudflare
etag: "be303da318e6d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JfevOVviJR2itVSlXcOUagZxq3Damd%2BL3sfwBEmHy9yuRDupJ09MTAU4xWx%2FtXvjz3omGTiPI5tJL6NVe55g5kTNBLKy6QN%2BR4e6S8VY5Z4BxrwjFFUM4fDmw1qx8QGlX%2FCjwVo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3df936d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 4188cd7e-61c7-471c-8865-d37752d46ea7.jpg
cdn.babamail.co.il/images/emails/320x192/ 14 KB
14 KB 75ms
39ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/4188cd7e-61c7-471c-8865-d37752d46ea7.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22ac05f423f5f55244ced109fc28604be598fd582553a94878b245cd4c234b25

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70274
alt-svc: h3=":443"; ma=86400
content-length: 13826
last-modified: Tue, 01 Aug 2023 08:30:10 GMT
server: cloudflare
etag: "5067ab6252c4d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Onw8GEUXcmWEFR4Meic85INI0NQTjDTSZIcWvzSegbVXd4sAnZLTM9P8w4QKe7d9mQn7F5Rm%2BZD1OnSW8aO5NFwrIFdCwkBcU1WZ1hVp3gTopx6ZmHnaRx34fSkN9tkrLchcqQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3dfb36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 c21deab2-d514-48e3-b6e3-fd65d235d9b6.jpg
cdn.babamail.co.il/images/emails/320x192/ 21 KB
21 KB 66ms
30ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/c21deab2-d514-48e3-b6e3-fd65d235d9b6.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd80a0964ce6d43bb41e411021c3e81edbe9c1150a2afcca9c7de3d69ab40742

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 24019
alt-svc: h3=":443"; ma=86400
content-length: 21441
last-modified: Tue, 08 Aug 2023 13:07:30 GMT
server: cloudflare
etag: "cc4b9d49f9c9d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OdP4W5drtbHjtlV8VWE99SOAis%2F6TnCtyzf%2BaQ8XB%2FawMsAIv5lP8HgiuxjirplyjrEP%2B9ybXkQsW4Nhzmfk36wHflz%2Fya7soWR%2BtcEQI5tzMP%2BLfEWd%2BdGhhwhy6cz9OIox1B8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3dfc36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 398b9200-e8a7-4f39-98f7-c71d5501185d.jpg
cdn.babamail.co.il/images/emails/320x192/ 17 KB
17 KB 90ms
54ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/398b9200-e8a7-4f39-98f7-c71d5501185d.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3850b2e4079a25b17cf62605b47d14dbd8cee73291131321ea88ee78455e114a

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 84089
alt-svc: h3=":443"; ma=86400
content-length: 17329
last-modified: Thu, 31 Aug 2023 12:25:19 GMT
server: cloudflare
etag: "a3abea346dcd91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pR6qF%2BfdB1MM%2FGG%2Fk26QcTRuaZAAIp7Gh9ZiLwtwib7luxRV3wLbNRERfWTLQCrB2CU8PHyV3nLlZ%2BYkZGtT6xBKhBAyTtQ82hPQ67Lu8zpyFDFVc9dsEmmVmOuGTedhbQe8IWY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3dfe36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 52c4c5a7-51dc-4587-8407-14d4ebd36652.jpg
cdn.babamail.co.il/images/emails/320x192/ 16 KB
16 KB 68ms
33ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/52c4c5a7-51dc-4587-8407-14d4ebd36652.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2a2f80b3fa8e92bb41dbefd7305a85012472d0869c5c18b4ecc5ca9d5a587ec

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 144258
alt-svc: h3=":443"; ma=86400
content-length: 16162
last-modified: Wed, 13 Sep 2023 11:52:49 GMT
server: cloudflare
etag: "bd67ebd138e6d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PDMqbt6MEQ%2FhVHKZZ9tcJE1WZLG4ZIUY2BaSnkYihYL5t65PGfewCS1vkqfqcxZqYNURMCRu7oWHaikayQR0s3VTOUKbloFNNPp%2FYxOtKvhTBbyTvlCgJdR71Qm7N4pbYteGkeo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3dff36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 59b772d1-927e-49e1-b1fc-1a5c38d3f4f7.jpg
cdn.babamail.co.il/images/emails/320x192/ 7 KB
8 KB 70ms
35ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/59b772d1-927e-49e1-b1fc-1a5c38d3f4f7.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8ea54cc3779aafc3209db9e3c6870d5d34b02303bedb757c7302073d0dd94a9

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70461
alt-svc: h3=":443"; ma=86400
content-length: 7425
last-modified: Tue, 29 Aug 2023 11:35:23 GMT
server: cloudflare
etag: "df7e33e66cdad91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DqIHNgxpXduCYn287WXocKg%2FVLqVqksN3cpXRWWpX9Pee3kgQyLUbBFFJrD5FY6SrBTYCZG0WUaxYiWUIqa6cGvTUweWAKgZmzuhHFStz7ON9ft%2B3UM3s76Olfl4yDaJxIZ8spE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0236d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 80be6e72-f0c6-4a7d-9cf4-b1fc0926c0b0.jpg
cdn.babamail.co.il/images/emails/320x192/ 12 KB
12 KB 91ms
56ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/80be6e72-f0c6-4a7d-9cf4-b1fc0926c0b0.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c3108c52c66c76f6190f2c70faca9e9aa1df78f742dceb93b696f38d36eb78ab

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70456
alt-svc: h3=":443"; ma=86400
content-length: 12236
last-modified: Tue, 01 Aug 2023 13:21:01 GMT
server: cloudflare
etag: "f26f537bc4d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MVQQXYBan5q37uEzMkxmDXjTM9yuCU0eiZp9OMtcYi5QOrJoGmAAWfuqoCzAjnfYm3Yz17xkBbZilNzptfftiAnvHb%2F3XUxuCkemWCoWh1qKQK%2BBEmMKtUf8Z4AJqdGkj6zf484%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0836d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 2f1bb853-e346-4dfa-b95f-b0194bd0d831.jpg
cdn.babamail.co.il/images/emails/320x192/ 19 KB
19 KB 92ms
57ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/2f1bb853-e346-4dfa-b95f-b0194bd0d831.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e2589afa14d50108d2aa3e40ed2e71feafcd8e6b0842bda43942ce9926c59e7

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70456
alt-svc: h3=":443"; ma=86400
content-length: 19085
last-modified: Tue, 18 Jul 2023 08:21:50 GMT
server: cloudflare
etag: "c5c796e650b9d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRvD0dPEWOqzEgRoFiR5OvguWKC2%2FYAexPmkYEBsxO%2BSB%2FSxqmdvYuvSzRC80HLyZeNnWoGj1lATAoizsG4IJ5nEruppMSUG1uI2WKR5CIiH6KOGfGKNzGiuPjh4QEhHF%2Buono4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0936d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 dd369f7f-2394-45d2-ba38-a26b404a2d71.jpg
cdn.babamail.co.il/images/emails/320x192/ 5 KB
6 KB 77ms
42ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/dd369f7f-2394-45d2-ba38-a26b404a2d71.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9e2cb867cdfac5e317165aeb7093685cb29f165888cc37854c918073918c932

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70418
alt-svc: h3=":443"; ma=86400
content-length: 5480
last-modified: Sun, 21 May 2023 08:15:13 GMT
server: cloudflare
etag: "09b575ebc8bd91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3noEITBFvTOix%2BQHnDm%2Bhy04rDOPGbLJgHixHtTfMiavkbzyu1ivpTms6rrzwT7MQIm3tSWV0%2Fazbq20InlWTQ5YmcdP4Ev48PbhijhS1DXD4MEO04O8uoOyjfZYB5fGJ2gjW9c%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0b36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 96f5ccd3-311c-47cd-811a-75fbaaebf5f8.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
11 KB 72ms
37ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/96f5ccd3-311c-47cd-811a-75fbaaebf5f8.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bd586c4b625421730889fbe8b5847dfa5081dfbe6caad9de1ab4cc8e332472c

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 64854
alt-svc: h3=":443"; ma=86400
content-length: 10903
last-modified: Sun, 16 Apr 2023 10:01:46 GMT
server: cloudflare
etag: "f331b744a70d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k9O5GkaPSws1SbKSDYDUCCpbriu3bY1aCHU%2Fi6iL18RD6Q7k8y77snqJLhzYyTkCYEwt8F9UMo%2BJQgdn3M7IkgQqERiVinU383%2F6Tco1clqQmt%2FuTRUbOc%2BqVQHf09Myz7HejBA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0c36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 86b9b42d-bcb6-4cfa-b1be-48708a0278d0.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
11 KB 84ms
50ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/86b9b42d-bcb6-4cfa-b1be-48708a0278d0.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7110ca3c52d3b11f0ccaeb6821061e0a34951a2dfb11733ed9ac74bad9bf21c3

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 313016
alt-svc: h3=":443"; ma=86400
content-length: 11074
last-modified: Mon, 02 Oct 2023 13:21:40 GMT
server: cloudflare
etag: "6269e76033f5d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0zWWFMwUHJLQ8jfoTn1ahRDoqYmdYNAbcMYbacy%2BbYMC6CSqccrhODS9y4P0s7rpINyFl4EWMUOE7jImcN6QnxIIZFUO3v53wCm%2BCEbGvRFLd1GzVIgxaFLwS66noh0m%2Fpyim80%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0d36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 22165097-916d-45d1-9cda-500d3cdc7a7a.jpg
cdn.babamail.co.il/images/emails/320x192/ 9 KB
9 KB 88ms
54ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/22165097-916d-45d1-9cda-500d3cdc7a7a.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70590eb4a10c9ec74cd975ba61e911451c4d91826993f5318b8fbe8c2efdc7a2

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 84074
alt-svc: h3=":443"; ma=86400
content-length: 9078
last-modified: Sun, 20 Aug 2023 09:06:56 GMT
server: cloudflare
etag: "d6c686ab45d3d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zBeZGaBtsPTheRSidoToY8gQ4tGARaLUBEWi8Xp3NPsvt3z2riTSbL1Iuo2ozuoJyoIP%2Fu3Ji4budTftbMMbN%2B9YPXm9vvP1QzovP%2Fnvvf%2BWMvWk29t2l4nY6MWmw1QhYlTTcpE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e0e36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 5edb6b23-f261-4b71-857a-a78b6c05d259.jpg
cdn.babamail.co.il/images/emails/320x192/ 16 KB
16 KB 85ms
51ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/5edb6b23-f261-4b71-857a-a78b6c05d259.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e152bf5caf469a5eb449a8e09bb51e48023a131c74bfd2d3c88dfe679950664b

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70456
alt-svc: h3=":443"; ma=86400
content-length: 16353
last-modified: Mon, 28 Aug 2023 11:08:33 GMT
server: cloudflare
etag: "a37c10fc9fd9d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sGG1kz2SjV%2FkD4PkKBM5HFbNwwDs4MDKN4CrGYFDj%2FhU4AI09Bju7Q0BBmrcfF1ck6wND5sv6kQy%2BGup81YkPZ3zsm%2FgyQWEHkCtxwpgodWvmquIUQLVLbl4BR4RER5jOYGOcZ8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e1036d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 d289105f-335e-446a-8c14-079745dd4768.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
11 KB 87ms
52ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/d289105f-335e-446a-8c14-079745dd4768.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7161be730da2a7cb2fe2192f0d9e5779f37f3232be12e26a8a815cfd24a57cdd

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70461
alt-svc: h3=":443"; ma=86400
content-length: 10829
last-modified: Wed, 30 Aug 2023 10:37:35 GMT
server: cloudflare
etag: "b3594afd2ddbd91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L%2FDzsknQwSQ%2Fj6CsTSVuycsOpiE4i1YEFnmOayLuSazz2zbdSKQ2KRbeAHvKTDda3VSdgnT8W9%2BOvw3LxBBWi5rFGrBGnOgYEU20nBHsYWRjFjXLP0O%2FIsvWy7ATnrWKTecnypk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e1136d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 442a8d59-f4f1-4c79-af9b-482b37054d75.jpg
cdn.babamail.co.il/images/emails/320x192/ 10 KB
10 KB 89ms
55ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/442a8d59-f4f1-4c79-af9b-482b37054d75.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d2756876d1a5f1fb9047e479d05dd2dbcac50ceb0e8a77c7afbe963c86fb6b9

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 70408
alt-svc: h3=":443"; ma=86400
content-length: 10251
last-modified: Sun, 10 Sep 2023 12:17:47 GMT
server: cloudflare
etag: "1c7723cfe0e3d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hwl34O4x23ixzBpbUZX5B0Q2igsFjlmTm165LqTvfhzAd46jDzWOYyfNT0ySACq5ivoEdS%2BDvQYRYazTFU%2B5tz8YUPPLM5gU3mJRO6um1%2F4NJzjrWzr8DMwqtCIuKav1g2lxfyE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e1236d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 29057638-02a3-4a3f-a82f-82fdfef812ce.jpg
cdn.babamail.co.il/images/emails/320x192/ 6 KB
7 KB 77ms
43ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/29057638-02a3-4a3f-a82f-82fdfef812ce.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cc209d3f373e7eaac6a4bb8c0f4ee39e652e6521820295db44fb4672e4eeec3

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 219437
alt-svc: h3=":443"; ma=86400
content-length: 6571
last-modified: Mon, 07 Aug 2023 07:29:05 GMT
server: cloudflare
etag: "999c5d80c9d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uBwOK14aybngn279Wheuf4P4xq6pxDX3wbaULmY%2BmwVRgaaTiW%2FAelPpln5A9GAXGSS%2BW3%2FqaXwji%2FLYBU8MFjisBjovU51VcUHrvdSBFK8gPizXVg%2FgPdC1By9qjyl0Js4cVRs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3e1336d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 4dd98508-68c5-46f1-b61d-f4108a488d6c.jpg
cdn.babamail.co.il/images/emails/320x192/ 8 KB
8 KB 93ms
59ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/4dd98508-68c5-46f1-b61d-f4108a488d6c.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e22b831a8b6f8f4318f466b909fc1b5c57c74da353cc037c60e23dd585b8eb31

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 84042
alt-svc: h3=":443"; ma=86400
content-length: 7949
last-modified: Sun, 13 Aug 2023 13:24:20 GMT
server: cloudflare
etag: "e3718077e9cdd91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H63ut1IvwIXr43pp8bnA2zXvVAhnjIVcXrr9LS3sqOXqGZZZxzcF8e1JALHCeyfhkj0ifoomZ9J39ktBr9k6kIL8LFT4KVYutZ4ZIYbvPQojSyb6oGzgIxef43Ntmm64gkG6QpM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2736d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 f9c5ee9f-dbb0-4e23-baba-625d46536cb8.jpg
cdn.babamail.co.il/images/emails/320x192/ 14 KB
14 KB 105ms
71ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/f9c5ee9f-dbb0-4e23-baba-625d46536cb8.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c403177216b4bb729b41e0ede809496f18fcefe0de7bb5d228819fb79890a89d

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: MISS
last-modified: Mon, 11 Sep 2023 08:14:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "46913cf687e4d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZGnQoDCxkGfL43zVkOcWv8uLXelHJy69W9xQ6GdvsuojHLwWnbO%2BhWFBzrkFIkEGFsTaFLmZU8zg8%2BSCXoxMcjgkAkWlCRWGVU5OleJd00u8LesE0QOv5Fy5IA8p5ba00sfURUc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2836d4-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 13955
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 0d3aa99c-5967-46a9-8b2e-4d304c5aefad.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
11 KB 96ms
62ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/0d3aa99c-5967-46a9-8b2e-4d304c5aefad.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 007453611f8539026e5364a78794feb073ec2c5794a6b53d0a69781cc9d12798

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 47799
alt-svc: h3=":443"; ma=86400
content-length: 11004
last-modified: Tue, 22 Aug 2023 09:16:23 GMT
server: cloudflare
etag: "3a396052d9d4d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IwtyR6WkdS9A1nDFVCEwvBB3fkn1gGc%2BjdtswqCu%2BxncXKGl7b%2FH4orpyy0QwF9GuOBAz%2BgZudLZw4VmAUSOLhDb8%2Fa3WqiaJKRLJoLKOrz0Sui1wW0kkavK3xa%2B4SsEg%2FKTv7g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2a36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 5fcfd39b-882d-4be4-ad6b-30848448ee7b.jpg
cdn.babamail.co.il/images/emails/320x192/ 8 KB
8 KB 103ms
69ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/5fcfd39b-882d-4be4-ad6b-30848448ee7b.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bd7cba6683d235aca0dea997915ab4879411211c1e65034b0a9d4fe45f488c5

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 124756
alt-svc: h3=":443"; ma=86400
content-length: 8034
last-modified: Mon, 18 Sep 2023 08:52:29 GMT
server: cloudflare
etag: "3867a574dead91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HvxsyWh2j83sxwwtQHNPN7xcDnV7mrKbIKvm9iOcZHIlwMW68c5JqysBpEIjrBsrNnPjSaY02gqLC%2FBajUOBR5H3at3VRYgpbuXeWXwsriXgA1GGIiVeKPvo3sJtFXSfhwaYZHc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2b36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 3d9ba842-fc6a-45f8-aecf-92bfcafb0f2c.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
12 KB 105ms
71ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/3d9ba842-fc6a-45f8-aecf-92bfcafb0f2c.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 156ca5fe01c3e63ade882fa739956f51390db0eda1f1fbaa01dbfd1956b1bd60

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: MISS
last-modified: Tue, 04 Jul 2023 07:12:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "beb994e946aed91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h0Hn7fEHshRzmQnFAmx7hkoZiWcSabc8aS3VtYRykPIolC2zF2sUpnxCGVzS4SH630rY%2BoxB%2Bs2f6ZuX%2FCrjZ9zqRcudmMi6PeHRA811u0g6N2MdqbJDTays5ItCc5zMtWhi3P4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2c36d4-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 11661
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 6154fd79-d76c-4805-9937-371bfe0f2241.jpg
cdn.babamail.co.il/images/emails/320x192/ 14 KB
14 KB 106ms
73ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/6154fd79-d76c-4805-9937-371bfe0f2241.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eaa64b40392d520011e0436a28e792b4add7364fc0d0d3db843cb2c534e1f479

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: MISS
last-modified: Wed, 19 Jul 2023 09:38:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "fa96c5b824bad91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WrN8wOBtGTrz6%2FyxL83Eds8I9fxq%2BlQSqQNW6%2FyrmWM3FBPLmOA7qYbEoi%2B8K5QvsMJb4pR861wbZdy22r3rDcbtBp4bQWhweNBRxxAReTYXHk8J0CdtbUBzivkkF498fkwTFaU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2d36d4-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 14274
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 c2874283-1d8d-4c8c-bbdd-aad8dfcdb40f.jpg
cdn.babamail.co.il/images/emails/320x192/ 12 KB
12 KB 101ms
68ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/c2874283-1d8d-4c8c-bbdd-aad8dfcdb40f.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48a8ce8f331efd100cdce8f1418e1ab9eb2240b78732eabb9ef8d9ddb2f2205d

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 493194
alt-svc: h3=":443"; ma=86400
content-length: 12203
last-modified: Tue, 10 Oct 2023 14:28:09 GMT
server: cloudflare
etag: "332fbffd85fbd91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sZgrLPD97fl4dAa7rL7%2FLVKUMbXHIiaoow%2BdQSFrRFExmSf%2BjwCI3uri%2BrS8rYxtrVNKoz%2BwB41skE4flep%2F1SbzDvTVYMkZxfoUVF%2B1e5A2%2FHb%2B%2F8WHJZKiZD6vcDoCwdNq4h8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2e36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 155e837b-c256-4c4a-92d0-aad0fae8351d.jpg
cdn.babamail.co.il/images/emails/320x192/ 16 KB
16 KB 97ms
64ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/155e837b-c256-4c4a-92d0-aad0fae8351d.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 931e14bea4986f34c0e2e0e30ee34165ec538883a3088c69727c8252a010698f

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 413981
alt-svc: h3=":443"; ma=86400
content-length: 15965
last-modified: Wed, 11 Oct 2023 10:33:27 GMT
server: cloudflare
etag: "8717c35e2efcd91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DLZuGqTHNqKFfMQWAIiYwtW7ThNeI3JVcJ9TYaQvuADWrcSIJJ0p7gpfERO46kk%2BrtujyQ3yVwYEejIbqkpkwR%2BdyQaxsM25PhBezX%2FXviZ2dF54s3y1xzCrTLTLMk9SMq0MfEM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e2f36d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 a4742852-15bc-4ee8-b72d-6b1f6457eb7e.jpg
cdn.babamail.co.il/images/emails/320x192/ 7 KB
7 KB 98ms
66ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/a4742852-15bc-4ee8-b72d-6b1f6457eb7e.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80553e2efbf99572b7d51670b1740094cecaf8b659a6da3de17de634d4a5d6f8

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 24018
alt-svc: h3=":443"; ma=86400
content-length: 6978
last-modified: Wed, 04 Oct 2023 12:07:06 GMT
server: cloudflare
etag: "23a644bbbf6d91:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OQwwY9m6QjrCPhJ5c6yHBD1TBNjODfNPbkbaElG2PHcmBrfR4U9DlwPg82zzsz1Fyv0x90fwXNBGB1Y3%2Bcm6hLS6xbyPKYCX2c%2B5Ek2OrwfhOkP6VwGI%2BLUfb2itUqNVMwFl%2FrQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e3036d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 2e7b77d2-6a2c-44d2-9c11-747d0d9929da.jpg
cdn.babamail.co.il/images/emails/320x192/ 12 KB
12 KB 57ms
25ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/2e7b77d2-6a2c-44d2-9c11-747d0d9929da.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c317de7baf81b72d9013a9a7660a1be360ed0c0d350765da326e09add08b06b

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 74395
alt-svc: h3=":443"; ma=86400
content-length: 12230
last-modified: Wed, 20 Feb 2019 11:44:02 GMT
server: cloudflare
etag: "f28a19311c9d41:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FCXuTT%2BzVXPJyU4T7QLs3aWv5yBcrh6P5IxoXPLXWDCKe38fA7qyRdtN7PG5R2Yo7BPIR%2BLv3%2F42b11f%2FROjGKHDHnSZv677InZzl1x36%2BltfFhuMylFudkywXEJ2D3YXFKW%2FOU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e3df636d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 5ced8d65-6204-4f51-b129-572ce3dacf09.jpg
cdn.babamail.co.il/images/emails/320x192/ 8 KB
8 KB 102ms
70ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/5ced8d65-6204-4f51-b129-572ce3dacf09.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1433876981ee8ec188385a4dd648f9fe1b226bb0c64b8c56b80db3024f0b2ad6

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 398536
alt-svc: h3=":443"; ma=86400
content-length: 7881
last-modified: Wed, 20 Feb 2019 11:45:45 GMT
server: cloudflare
etag: "9f9ced011c9d41:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bY%2BjMHvTV%2B6gNzEAL3WE23%2F5wlXR%2BeDmtiY4wKb1%2Bk1WXWDjRojEGXeqfQeigvUm3Wz8LWfGDl2qYjn7al4Vld2gK0xLeEkkvB%2FEhncPcelLNGXf3TOV8vSdL9gwz%2FjeHQyBH1s%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e3136d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 2c6247c2-4565-4676-8b85-85527d89da3b.jpg
cdn.babamail.co.il/images/emails/320x192/ 11 KB
11 KB 102ms
70ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/2c6247c2-4565-4676-8b85-85527d89da3b.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d5b942d2fa3c2ca77a2a6b66e0f67145b40eeae85768a3375414bad717feada

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 46812
alt-svc: h3=":443"; ma=86400
content-length: 11417
last-modified: Wed, 20 Feb 2019 11:43:57 GMT
server: cloudflare
etag: "e884769011c9d41:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MTmZAOi81YbQSArXWDkxmzjeFUxtjjAumKt9Q6c9DTWCv91v8F3MVei%2FfnPRoKJVULcmw2KwWmZuZNaGRBHg4dy5K4Zr%2BJFToxt0eE%2Fhhke%2BYuD2m8B%2F%2FQ%2BxKZRKH5x0zTCzgPM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e3236d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 a7808df9-8f81-42b4-aed4-dabb3ac169d3.jpg
cdn.babamail.co.il/images/emails/320x192/ 5 KB
6 KB 100ms
69ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/a7808df9-8f81-42b4-aed4-dabb3ac169d3.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 670ed3105e117dd06e4f4188abe161aadbfa15786f4a888552b24f18d8657903

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 235843
alt-svc: h3=":443"; ma=86400
content-length: 5479
last-modified: Wed, 20 Feb 2019 11:48:11 GMT
server: cloudflare
etag: "784f62712c9d41:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OoI7x5bOU3WE4du8Mdbug%2BQxU8%2Btdjm%2FAj7Vi6EiMvLJZH5mP0bdOACDJvPB5Smo3LmiWhq9e%2BEIiHpA2hP77HL316FVuhUoxP8tK1pDB8hKwgNeyZ3P05a7qXXCg4uED58kv6E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e3336d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 99c3ba85-bbdb-4dc8-97ad-200694e9d9c6.jpg
cdn.babamail.co.il/images/emails/320x192/ 14 KB
15 KB 78ms
67ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/99c3ba85-bbdb-4dc8-97ad-200694e9d9c6.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3ac8718eecb757947941db1984c8625f4e2abfa81f95ef5b56e84247c8f40dc

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 76856
alt-svc: h3=":443"; ma=86400
content-length: 14741
last-modified: Mon, 25 Apr 2022 14:18:23 GMT
server: cloudflare
etag: "2bada752af58d81:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jPRik26NOTFQ5Bii2ugb3MlaqQuSAdk27ouMlHZpD%2FICFCsTVUdsmZxJxLx13XhO%2Bhr7aEeLg5Pt%2BpGq3p3G2McmGGRizSDqDh%2BQYH2vSRn%2FzjRApQdXO2jb%2BJIdAS9AmUAJwzE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e4e3436d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 c63837c4-3998-462d-ba26-237259521c49.jpg
cdn.babamail.co.il/images/emails/320x192/ 9 KB
9 KB 79ms
68ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/c63837c4-3998-462d-ba26-237259521c49.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e954cbac8e724c3168b0d9fea551b155871978faa16146c62ee2a90499057951

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 222358
alt-svc: h3=":443"; ma=86400
content-length: 9353
last-modified: Wed, 20 Feb 2019 11:49:15 GMT
server: cloudflare
etag: "5565df4d12c9d41:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dDSB3%2BFVMPuZ9UpGoBqd3h0jvNeHymz0Fs831rzTRLo0FrQOyB5G9JHJU43i6nPTMHaIih%2BXTRatjLLh7RJkt%2BEQrKstgsMRUCjGFzstDGxi1A1vOHkMMXPbFnhpfaIUW6pdhzU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e5e3636d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

GET
H2 200 366a0ac7-c0de-4e96-9711-268bfaad7b56.jpg
cdn.babamail.co.il/images/emails/320x192/ 10 KB
10 KB 78ms
67ms Image
image/jpeg 172.67.205.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.babamail.co.il/images/emails/320x192/366a0ac7-c0de-4e96-9711-268bfaad7b56.jpg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.205.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7aca483362e43b99e448425b140c9ab81ed0bd069bcb3018a980ee959b9bc9c

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 491286
alt-svc: h3=":443"; ma=86400
content-length: 10284
last-modified: Wed, 20 Feb 2019 11:44:22 GMT
server: cloudflare
etag: "55de319f11c9d41:0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iiIM7y%2Fh%2F9TSSc8jYWs%2BC1L%2B7srqKC61YX3hJ9wGSsV17ArHlqvMgyXaYG6iRumBcJf9adI%2BM4wv3hKDGVEnd2zFXVCSXxYCZhHLx8%2Fgsf2W5Uo7OmJnTmlaEs4gCxHCiM0JGUA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 8170099e5e3736d4-YYZ
expires: Fri, 16 Mar 2040 00:00:00 GMT

POST
H/1.1 200
OK general.ashx Show response
www.baba-mail.co.il/handlers/ 0
349 B 30ms
27ms XHR
text/x-json 51.79.4.160
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.baba-mail.co.il/handlers/general.ashx
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/handlers/static.ashx?t=js&f=v.min,utils.min,babagpt.min,enq.min,recentlyviewed.min&v=3.2.6.33
Protocol: HTTP/1.1
Server: 51.79.4.160 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ip160.ip-51-79-4.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: http://www.baba-mail.co.il/
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Mon, 16 Oct 2023 11:40:51 GMT
Server: Server
Content-Type: text/x-json
Access-Control-Allow-Origin: *
Cache-Control: public, no-cache="Set-Cookie"
X-Robots-Tag: noindex
Content-Length: 0
Expires: Mon, 01 Jan 0001 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
256 B 129ms
47ms Ping
text/plain 172.253.122.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-6HQWCMWRLE&gtm=45je3ab0&_p=248292069&_gaz=1&cid=1908442735.1697456537&ul=en-us&sr=1600x1200&_s=1&sid=1697456537&sct=1&seg=0&dl=http%3A%2F%2Fwww.baba-mail.co.il%2F&dt=%D7%91%D7%90%20%D7%91%D7%9E%D7%99%D7%99%D7%9C%20%7C%20%D7%91%D7%A8%D7%99%D7%90%D7%95%D7%AA%20%7C%20%D7%A2%D7%A9%D7%94%20%D7%96%D7%90%D7%AA%20%D7%91%D7%A2%D7%A6%D7%9E%D7%9A%20%7C%20%D7%98%D7%99%D7%A4%D7%99%D7%9D%20%7C%20%D7%9E%D7%93%D7%A8%D7%99%D7%9B%D7%99%D7%9D%20%7C%20%D7%94%D7%A2%D7%A6%D7%9E%D7%94%20%7C%20%D7%A1%D7%A8%D7%98%D7%95%D7%A0%D7%99%D7%9D%20%7C%20%D7%A1%D7%99%D7%A4%D7%95%D7%A8%D7%99%D7%9D%20%7C%20%D7%9E%D7%90%D7%9E%D7%A8%D7%99%D7%9D%20%7C%20%D7%9E%D7%A6%D7%97%D7%99%D7%A7%20%7C%20%D7%91%D7%93%D7%99%D7%97%D7%95%D7%AA%20%7C%20%D7%9C%D7%9B%D7%9C%20%D7%94%D7%9E%D7%A9%D7%A4%D7%97%D7%94&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6HQWCMWRLE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 123ms
44ms Ping
text/plain 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-6HQWCMWRLE&cid=1908442735.1697456537&gtm=45je3ab0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6HQWCMWRLE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 132ms
51ms Image
image/gif 172.253.63.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-6HQWCMWRLE&cid=1908442735.1697456537&gtm=45je3ab0&aip=1&z=274032862

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 403 6f7c8ec7-588a-46ef-95d2-ff36e0a39e58-web.js
cdn.permutive.com/ 0
0 75ms
25ms Script
text/html 104.17.118.17
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.permutive.com/6f7c8ec7-588a-46ef-95d2-ff36e0a39e58-web.js?d=2023-10-16
Requested by: Host: cf.dxmcdn.com
URL: https://cf.dxmcdn.com/dta/babamailwb.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.118.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/ 420 KB
132 KB 38ms
37ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a40e424d54800fc2704682930d3be386d0280b96a03869db6bf3894218f1eb7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 03:08:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30808
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 134722
x-xss-protection: 0
server: cafe
etag: 2928310903106852838
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 15 Oct 2024 03:08:49 GMT

GET
H2 200 AGSKWxUtj6jDF4P3sVM9hZ7CovYdoVGLYPZwCS2nbXTtRaetjZaZ0ajMgsJs-WcKIE2yoPsjK9P5yxgmeW99O_fWJnvNaIKSSMaW3E7crnUaI2NCX-Ajbh4eErao1mINT0CTsf4N0is8MA== Show response
fundingchoicesmessages.google.com/f/ 13 KB
7 KB 82ms
82ms Script
application/javascript 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUtj6jDF4P3sVM9hZ7CovYdoVGLYPZwCS2nbXTtRaetjZaZ0ajMgsJs-WcKIE2yoPsjK9P5yxgmeW99O_fWJnvNaIKSSMaW3E7crnUaI2NCX-Ajbh4eErao1mINT0CTsf4N0is8MA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NDU2NTM3LDQ1NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cDovL3d3dy5iYWJhLW1haWwuY28uaWwvIixudWxsLFtbOCwiNVlVVHJFZ3gxRzQiXSxbOSwiZW4tVVMiXSxbMTYsIlsxLDEsMV0iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.5YUTrEgx1G4.es5.O/am=gAE/d=1/rs=AJlcJMwWr-0BoGlkDRzkqg60JHDvlnG3IA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

de9dd1ef4d7916350553bedda11547ce404f93a89cc6724eaf8375a67f19fc29

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-SU8FJR9Dr5gjRzOXGM61oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
content-security-policy: script-src 'report-sample' 'nonce-SU8FJR9Dr5gjRzOXGM61oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 702 B
384 B 86ms
82ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=430837318%2CTOTAL_TAS%2CHyper_Content&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=1&didk=607409652&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537605&lmt=1697481737&adxs=0&adys=5059&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=1600x5059&msz=1600x0&fws=0&ohw=0&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content&adks=750729042&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3fd52a754381dd016162772dc81f478e487ee90ae2d510d79599e09e851d81db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 354
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 119 KB
39 KB 3722ms
3718ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2CRighttower.sticky&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=160x600&ifi=2&didk=1483636802&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537613&lmt=1697481737&adxs=1440&adys=146&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=647338911&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

15e329ae5147734811ae1d7c75845ba64ebdc66d44259934a55eeeb2b93c30e9

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNm9lbG--oEDFcSnnwodcZYGVw&gqi=&layout=/sadbundle/%24csp%253Der3%24/12897889696968867840/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNm9lbG--oEDFcSnnwodcZYGVw&gqi=&layout=/sadbundle/%24csp%253Der3%24/12897889696968867840/index.html
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40215
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 50 KB
12 KB 1452ms
1447ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2Cskyscraper.left&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=160x600&ifi=3&didk=3340414425&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537618&lmt=1697481737&adxs=0&adys=146&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=3631145821&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b5c443a2a22d843ac6bd49c23582508cbd9b683ecb67465724612c312cd0780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12655
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 119 KB
39 KB 992ms
988ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2CLeaderboard.content&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=970x250&ifi=4&didk=3464419654&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537620&lmt=1697481737&adxs=315&adys=166&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=1600x275&msz=970x250&fws=4&ohw=970&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=4250329652&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c200d07bacefc15034ce592561db59a603d23613a7da816c0694f3247ce66067

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKPZzq---oEDFc6inwodSQAElQ&gqi=&layout=/sadbundle/%24csp%253Der3%24/12897889696968867840/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CKPZzq---oEDFc6inwodSQAElQ&gqi=&layout=/sadbundle/%24csp%253Der3%24/12897889696968867840/index.html
date: Mon, 16 Oct 2023 11:42:18 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40309
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 182 KB
50 KB 2998ms
2994ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2Cinterstitial.adx&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=5&didk=3919858234&sfv=1-0-40&ists=1&fas=8&sc=0&cookie_enabled=1&abxe=1&dt=1697456537622&lmt=1697481737&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=931379226&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c072816752ee245b94493e18ee293dc1827f2b15aa51f94d24d2981ecfbd113a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50855
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 119 KB
39 KB 2071ms
2068ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2CAtf.video&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=6&didk=880125588&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537624&lmt=1697481737&adxs=637&adys=1070&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=759x90&msz=728x90&fws=4&ohw=728&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=272365241&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26bfabe554eb04c221f23ea3a52b9bd96be436b5ab70e94bdf7f322b6a26ff33

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN2pobC--oEDFRsUaAgd-l8IXw&gqi=&layout=/sadbundle/%24csp%253Der3%24/8412606271970082816/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CN2pobC--oEDFRsUaAgd-l8IXw&gqi=&layout=/sadbundle/%24csp%253Der3%24/8412606271970082816/index.html
date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
content-encoding: br
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40233
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
12 KB 3707ms
3705ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2CAtf.sidebox1.content&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=7&didk=2050042794&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537628&lmt=1697481737&adxs=260&adys=1865&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=390x270&msz=300x250&fws=4&ohw=300&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=3185568618&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4028d538505244f8943d7785514916c15cc763825726255713b92dcf3ef9d9cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:21 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12143
x-xss-protection: 0
google-lineitem-id: 6033129026
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138408212013
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 633 B
307 B 3340ms
3338ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cdesktop%2CBtf.content&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=8&didk=2695870265&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537633&lmt=1697481737&adxs=637&adys=2434&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=759x90&msz=728x90&fws=4&ohw=728&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=1963591266&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bea65dc00910e700e5c7e909e570e6721b53b3f4f2557ab31270941eb4d2056f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 276
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
12 KB 2352ms
2350ms Fetch
text/plain 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=147721188210530&correlator=1276056255452346&eid=31078704%2C44769662&output=ldjh&gdfp_req=1&vrg=202310100101&ptt=17&impl=fifs&iu_parts=6870%2Cbabamail%2Cmobileweb%2CBtf.side.content&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=9&didk=1746518673&sfv=1-0-40&sc=0&cookie_enabled=1&abxe=1&dt=1697456537636&lmt=1697481737&adxs=260&adys=3795&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=4&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&bc=23&nvt=1&url=http%3A%2F%2Fwww.baba-mail.co.il%2F&vis=1&psz=390x270&msz=300x250&fws=4&ohw=300&ga_vid=1908442735.1697456537&ga_sid=1697456538&ga_hid=248292069&ga_fc=true&dlt=1697456537085&idt=448&cust_params=section%3Dros%26lang%3Dhe%26signup%3Dfalse%26category%3D0%26source%3D%26tmDmn%3Dbaba-mail.co.il%26tmPtS%3D(direct)%26tmPtM%3D(none)%26tmClnt%3DHyper%2520Content%26viewport%3Dlg&adks=4072677455&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

40e4fc5341e3ec9f13a0561d234d35fd229b03b3d4978e6fdb5e8f71a9a7b3be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12200
x-xss-protection: 0
google-lineitem-id: 6033129026
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138393405600
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E274 6 KB
3 KB 128ms
40ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:17 GMT
expires: Tue, 15 Oct 2024 11:42:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/ 38 KB
13 KB 45ms
44ms Script
text/javascript 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5d389ae02c8f2cfe9a169a4688f29657b9b03c5fce50b8c8e3d020d360c22dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 14:02:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77958
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13424
x-xss-protection: 0
server: cafe
etag: 113957945738386553
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 14 Oct 2024 14:02:59 GMT

GET
H/1.1 200
OK stats.ashx Show response
www.baba-mail.co.il/handlers/ 1 B
418 B 28ms
27ms XHR
text/html 51.79.4.160
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://www.baba-mail.co.il/handlers/stats.ashx?t=hp&view=1
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/handlers/static.ashx?t=js&f=v.min,utils.min,babagpt.min,enq.min,recentlyviewed.min&v=3.2.6.33
Protocol: HTTP/1.1
Server: 51.79.4.160 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ip160.ip-51-79-4.net
Software: Server /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

Accept: */*
Referer: http://www.baba-mail.co.il/
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Mon, 16 Oct 2023 11:40:51 GMT
Content-Encoding: gzip
Server: Server
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public
X-Robots-Tag: noindex
Content-Length: 120
Expires: Mon, 01 Jan 0001 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 140ms
57ms XHR
application/json 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202310100101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ceaf113f23c6e038ebd71d14c4306297419e4fea3ad9120685206bc3308a7c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12103
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 117ms
40ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 16 Oct 2023 11:42:18 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 5C33 13 KB
5 KB 38ms
37ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 175372
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 10:59:26 GMT
expires: Sun, 13 Oct 2024 10:59:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6D78 829 B
1 KB 128ms
52ms Document
text/html 172.253.115.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f106.1e100.net

Software

GSE /

Resource Hash

877f5e1488b3a7565121e1f073e80541936daa60ea2bb0d08ef208be611eb15f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DGZAiGeeodDCjFkqUKyDdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-DGZAiGeeodDCjFkqUKyDdA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:18 GMT
expires: Mon, 16 Oct 2023 11:42:18 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js Show response
pagead2.googlesyndication.com/bg/ Frame 5C33 37 KB
14 KB 113ms
38ms Script
text/javascript 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4QJGLNlKfnVz3XQjPF9W03cPcyZJorHT7_BXddCCsBM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e102462cd94a7e7573dd74233c5f56d3770f732649a2b1d3eff05775d082b013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:04:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 175039
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14648
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 13 Oct 2024 11:04:59 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6D78 0
0 94ms
94ms Image
text/html 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202310100101&jk=147721188210530&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 5C33 0
10 B 38ms
38ms Image
text/plain 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?bRrvfw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 container.html Show response
c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6F81 6 KB
3 KB 39ms
37ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:17 GMT
expires: Tue, 15 Oct 2024 11:42:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 59ms
58ms Image
image/gif 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=1.8904955306628117

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8zH6s_ccJfa4SR7HMUbUpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:18 GMT
content-security-policy: script-src 'report-sample' 'nonce-8zH6s_ccJfa4SR7HMUbUpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 58ms
57ms Image
image/gif 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=6.135263698184284

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ao5J5m4lVhNvw9p6YR06jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:18 GMT
content-security-policy: script-src 'report-sample' 'nonce-Ao5J5m4lVhNvw9p6YR06jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 66 KB
17 KB 40ms
40ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b41ba07202911cbc1c181534938e7eb86280e44b8778d7221fe59a8a93a1a14

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 167576
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17608
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 13:09:22 GMT
expires: Sun, 13 Oct 2024 13:09:22 GMT
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 6F81 23 KB
9 KB 52ms
52ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1940
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:09:58 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D7B2 143 B
383 B 120ms
41ms Document
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2746
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 10:56:32 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 6F81 3 KB
1 KB 61ms
61ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84900
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 6F81 20 KB
8 KB 50ms
49ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 10:59:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2573
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 10:59:25 GMT

POST
H3 204 AGSKWxXzoGWcyC0XX0Wz-KMzg73GAiSCBc-tRmxQqQk7yEnDTnhffQ_aecvPDWom3w5FahAibNKvJY9OTfkxjvhm59E1UXCod-KsBcurTWAs809vbF4-36eXLmF9QfzoRXmP5ovtB2K-FQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 139ms
57ms XHR
text/html 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXzoGWcyC0XX0Wz-KMzg73GAiSCBc-tRmxQqQk7yEnDTnhffQ_aecvPDWom3w5FahAibNKvJY9OTfkxjvhm59E1UXCod-KsBcurTWAs809vbF4-36eXLmF9QfzoRXmP5ovtB2K-FQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RT9JukzL0aItidGdoT00zg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 11:42:18 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-RT9JukzL0aItidGdoT00zg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 923C 16 KB
6 KB 50ms
48ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39693
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Oct 2023 00:40:45 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 923C 34 KB
13 KB 43ms
40ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39693
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Oct 2023 00:40:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6F81 187 KB
59 KB 51ms
44ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:18 GMT

GET
DATA 200
OK truncated
/ Frame 6F81 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c793d8dd4c1bdd32807c0ba2d69bf1d60659f5d16e1863e24d1a536beed06fba

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 103ms
102ms Image
text/html 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202310100101&jk=147721188210530&bg=!iYqlisXNAAbFpEfJ5aQ7ADQBe5WfOM2yIP5Ak-jALN4i34fEkR2Tb226eh3xt6r86SYZbeIIm1uW98KiFe4JQj9LW4UCAgAAAENSAAAACGgBB5kC8hXhjDIhlNIos-hZriVIeeMg4ZVSxR-r8fi3Pl7vXXSDgHFUAs6tzSQusTAJWCOSTW1R50aK67u6n7hQPd_Ucaegldh_tEr-iUqvaXcwlD6laEwQgWJYyHrqb5f448mgBvI2S9NaCRLzQ_IdPgEaQ6FTfh9chrvtbq5C_pZuUuCKlGqeo4X14uFURfPdFvGpvffTf4uA5xnfa2Nrwy_aoKmlV4uRqxKE6ZnQaRcagCVXTrq-jk_b9hqFfsRGAxYo5KoN714BLoDYPx7CcndmrgEkuG6X--MwsJII2qv1XRwhjxjfc32F8VI4BqNaIu0Al8qLgoGPFvRq7TiljBgMF6NASFfaHqvsnN82JuBAuWe6_rUr9XLSoNvx8GW98qbOMGNMjL7j8uKe5QZ6A-m64d956ODnqKr1AcAs5_p3c7JpRrYCvTpPb3VFefXkCip3_9Fd9iYItlERBao23BOeg4WTG_uwivLTZ9kG2EyuH_XR7gUTx6esOlyNu0C8wfyj975MZbEShEQGv7Y4GMJnv5EsQxZMlSKysaiSNSoB446aTa2no2FaeH5KwhfHiazv-aOhfmPOxgX7QFen_oo9Z9HvWud5scBR8UNuJBBU8vQotC5aqmnZfkDgt1fM2QrRWADTUE59SCIn-_x1NSHQrpFOI7OrnddH-PXivb_p1Nh7VbKKID1uMGPfWAdcN5MUsYe3PuXvLjMhGbhugcGL27phDkn59jUTXWP2eIyQ4RAUbrssW9ES8Ks2KOzOemRdK3nG8jEnhfHwSVv4C5c3B31-R-NICZyZ-3ERdNu3gwAoa9ffjKTq5sP18s8TPXioPVcD4q3aeL5ORjfww8PKZqb9_zSnUMusmHA3_7jtUzE09kY6_sksTagTGFnSsx4s5TFJFILQhT9eBtijCZWIb0eRN8DC9tLrgtHPHWeDlaeJB9RIaG6aZa1Ct1H0r2sJ401VuDsNh7i5IxIiztLApOqFB7jCTfD_b6lDsUHPS9ByDos
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D7B2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
307 B

50ms
49ms

Document
text/html

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:18 GMT
expires: Mon, 16 Oct 2023 11:42:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:18 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 St_768x1024.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 132 KB
132 KB 123ms
121ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_768x1024.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c2b018082e437c7abe92e2307d89cc5b75ef6415a271b4be97db491f269e315

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135112
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:18 GMT

GET
H3 200 St_580x400.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 48 KB
48 KB 211ms
209ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_580x400.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81f5a6ede934717d5dd26e5b5a2d7f9840c0a0a0c967dbeaf47b40abc42008eb

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49406
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:19 GMT

GET
H3 200 St_970x250.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 47 KB
48 KB 105ms
103ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_970x250.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d20086d2e7e364f5d83cbf9dea0c044352e3a1dca3db96d429684986383c7122

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48622
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:18 GMT

GET
H3 200 St_728x90.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 16 KB
16 KB 206ms
204ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_728x90.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43bc5c1a8552b24a289b17b77241c5a8279511767ee6efb2673b75188dc9ee23

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16215
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:19 GMT

GET
H3 200 St_320x480.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 38 KB
39 KB 189ms
187ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_320x480.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92f32fb7cd75f496862a8eec288e5c3e12d893a2a9eab7cc34daeeea37d8d0d6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39417
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:19 GMT

GET
H3 200 St_300x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 48 KB
48 KB 218ms
216ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_300x600.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c65885e2fd108b28a1442376251aa50083f9e54433cd2f2edaa234e6532ff6b3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48713
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:19 GMT

GET
H3 200 St_300x250.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 923C 20 KB
20 KB 97ms
95ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_300x250.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38a2473618f1a9134c4d7bad9f3e95f714124d17a81e7e1496ce5ca90fad136e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20374
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:18 GMT

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 171ms
95ms Preflight
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CbB_1mSEtZeOoK87F_gTJgJCoCengqMNzjN21xMcRwJCe9osOEAEgmfugK2D9oJmB6AOgAaqC8NwByAEJ4AIAqAMByAMCqgS-Ak_Q75xOBR_R_ciru7g_D009uJuMdoplkZEJz1_BF2HLU0AS9kLdDjw4AWLAuWLzpU6PNhiEddP1b-mjj1rep02K87GWEmXXmDhMCRHkvM26sGlWueAsf3INCPdt_0C6UEBn0pf0iwpYpl7QBjOkenIykfr_FlNuBBAaixjjjKNZduce7KdoywBLti2_0hys_fAw3cKJfyHwgHrZTv5H3JWpqtnCQDijce9TNEf-yxAWB89WolVRIcetjWONiciaYHr-SPTsPQJB8tTFlEKwpYDG8gHK-ONAZiZfO89EklXEVvoXdHvmhMBXrxTSYxSk_Bg9mdGkDcTe6laV_lEvZSDlN-5mE5Em1fkyb2-LnoSaf0IR8G4S5X19mpP_j-TP-LY5mePm1Uz-Y86EcNYP51wXeXtZ6tWAZYrGNoDHocAE-YPMlr8E4AQBiAXPrqK0TJIFBAgEGAGSBQQIBRgEoAZdgAe-_Y-jAqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEN-URdIIFAiAYRABGB0yAooCOgKAQEi9_cE6mgmjAWh0dHBzOi8veW9nYS1nby5pbz9icmFuY2gtbmFtZT1jaGFpciZ0ZXN0LW5hbWU9Z280cXBtJnV0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09Y3BjJmNhbXBhaWduX2lkPTIwNTEwNzA5NTgzJmFkZ3JvdXBfaWQ9MTU0Mzk3NzcwMjMzJmFkX2lkPTY3NjAyNTgzNjk0NyZ1dG1fdGVybT2ACgPICwHaDBAKChDQxIPL3P3f1QcSAgED4g0TCM7Gza---oEDFc6inwodSQAEldgTDNAVAZgWAYAXAbIXHgocCAASFHB1Yi00MjA3NjU3OTcxMTI2OTMwGLmzDQ&sigh=xKckRS-6d6I&uach_m=[UACH]&ase=2&nis=4&cid=CAQSTADICaaN5aOCOpOaZPvzQJ_RpwIALeBxu8Kfv3tvhv_7zNaaHE7xAtWzOz5akMGVWA5YJKhob0ABLdFutbt81d0LZpCPGgc1izh5v7wYAQ&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 11:42:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 6F81
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CbB_1mSEtZeOoK87F_gTJgJCoCengqMNzjN21xMcRwJCe9osOEAEgmfugK2D9oJmB6AOgAaqC8NwByAEJ4AIAqAMByAMCqgS-Ak_Q75xOBR_R_ciru7g_D009uJuMdoplkZEJz1_BF2HL...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1...

0
0

171ms
93ms

Fetch
text/css

142.251.167.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1f1dc84c6c70000000000000000%22,%224%22:%220xd1fc2155e50607eb0000000000000000%22,%225%22:%220x9c8930349812dea10000000000000000%22},%22debug_key%22:%2212172188990005336170%22,%22debug_reporting%22:true,%22destination%22:%22https://yoga-go.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22463208746%22],%224%22:[%2210-16%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211295709665052019937%22}&andc=true

Protocol

Server

142.251.167.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x98b03cc5444c2c7c0000000000000000","2":"0xfd65cb585d4c6d650000000000000000","3":"0x5199b1f1dc84c6c70000000000000000","4":"0xd1fc2155e50607eb0000000000000000","5":"0x9c8930349812dea10000000000000000"},"debug_key":"12172188990005336170","debug_reporting":true,"destination":"https://yoga-go.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["463208746"],"4":["10-16"],"6":["true"]},"priority":"500","source_event_id":"11295709665052019937"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 11:42:19 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 16 Oct 2023 11:42:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x98b03cc5444c2c7c0000000000000000","2":"0xfd65cb585d4c6d650000000000000000","3":"0x5199b1f1dc84c6c70000000000000000","4":"0xd1fc2155e50607eb0000000000000000","5":"0x9c8930349812dea10000000000000000"},"debug_key":"12172188990005336170","debug_reporting":true,"destination":"https://yoga-go.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["463208746"],"4":["10-16"],"6":["true"]},"priority":"500","source_event_id":"11295709665052019937"}&andc=true
access-control-allow-origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012309290141000/ Frame 402F 196 KB
56 KB 125ms
39ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309290141000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19ff3397c011d5accec7152829fd1191a2a1a01ff4f5e5826d412318183e27ba

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 14 Oct 2023 10:59:23 GMT
age: 175376
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56111
x-xss-protection: 0
server: sffe
etag: "196a98f213e9af2a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 13 Oct 2024 10:59:23 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012309290141000/v0/ Frame 402F 15 KB
5 KB 161ms
74ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309290141000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db9cf405750f735875d15e818d2a914d9da5e585bb679bf133030313050129d7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 14 Oct 2023 11:28:13 GMT
age: 173646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5226
x-xss-protection: 0
server: sffe
etag: "b67abf1ac5d05c62"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 13 Oct 2024 11:28:13 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012309290141000/v0/ Frame 402F 94 KB
28 KB 164ms
78ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309290141000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edb2010c5df1126fb248d0ec434aae2f8293f4f7182081eeeb6f9bb64bf0e9ad

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 14 Oct 2023 12:07:17 GMT
age: 171302
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29036
x-xss-protection: 0
server: sffe
etag: "f80aeafaeae93075"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 13 Oct 2024 12:07:17 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012309290141000/v0/ Frame 402F 5 KB
2 KB 157ms
71ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309290141000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

062e8ad7db60ba4743150e409d430e84c3cdbbba05cba579d4ef3ab23016596e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 14 Oct 2023 11:28:13 GMT
age: 173646
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1915
x-xss-protection: 0
server: sffe
etag: "5fa0b581892e5d76"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 13 Oct 2024 11:28:13 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012309290141000/v0/ Frame 402F 40 KB
13 KB 161ms
75ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012309290141000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541344055050c46c93b77fddf2d7f018821eb38500e6fa795aa7883b16b934e6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 14 Oct 2023 11:15:18 GMT
age: 174421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12962
x-xss-protection: 0
server: sffe
etag: "f431afcc9b21c868"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 13 Oct 2024 11:15:18 GMT

GET
DATA 200
OK truncated
/ Frame 402F 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04bd84768b2f55e4b29f04f9dddb82388e60fd020a969d78f35f60e0c9e81d31

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 6719209584692599185
tpc.googlesyndication.com/simgad/ Frame 402F 69 KB
69 KB 41ms
41ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6719209584692599185?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qn4XLWnV7Jsu00wBNc4zx3ew0I82w

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf3e5d6ed946a7234ba1043689a0f810a59e93994eab4ed869ddd2a161fbda06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 11:50:00 GMT
x-content-type-options: nosniff
age: 85939
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70429
x-xss-protection: 0
last-modified: Thu, 21 Sep 2023 06:05:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 14 Oct 2024 11:50:00 GMT

GET
H3 200 iw.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 402F 3 KB
3 KB 42ms
41ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/iw.png

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19b49a74b4e17a37abe04b94bd3a67665f92b8368004c73a1112cf142fb9da1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:22:29 GMT
x-content-type-options: nosniff
server: cafe
age: 1190
etag: 415739381108731362
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2712
x-xss-protection: 0
expires: Tue, 17 Oct 2023 11:22:29 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 402F 344 B
368 B 39ms
39ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:07:23 GMT
x-content-type-options: nosniff
server: cafe
age: 2096
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Tue, 17 Oct 2023 11:07:23 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 176ms
95ms Preflight
text/html 142.251.167.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 11:42:19 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 402F
Redirect Chain

http://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

59ms
58ms

Image
text/html

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H3
Server: 172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Redirect headers

Date: Mon, 16 Oct 2023 11:42:19 GMT
X-Content-Type-Options: nosniff
Server: cafe
Content-Type: text/html; charset=UTF-8
Location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Cache-Control: private
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Content-Length: 0
X-XSS-Protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 402F 0
0 110ms
109ms Image
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CI2LcmiEtZZzDJLGeoPMP8t6IwASxgaPFc6nC4M_LEdzZHhABIJn7oCtg_aCZgegDoAGHg7_3A8gBAuACAKgDAcgDCKoEvgJP0Hc2hO1qq0k5_lah9FYEdJyvfuB-gRU5DoL-Vz4VFyupnVQyZl9Fr_GK6Ip5ZfaVAL5Yx6n6xDcbmH_UeQqhICkKJzcPL2c6ZF5UYpv5h6Qo3tg4q_ELsD8idBS-mnN_E47vi-kCwP0DoDgXmP4zBm5YXv4TtoAO6hAIHWgqBpZbA0Uo0hkmIzJSyfu4-JiKfzZTefveMlWk-jY1KEo1KKs1Amic4ApX6tAS_xgGXNXMZRuiMaEDzMtuUJk1ZSEZs3pe_LdU3VszThsYLfMmHsOayX22XCJ4Y6ZxPOyQ688xRIqKttxOnZz_a5ambLPjCRUlCT58e3vKlwLXdVgU1Kr9mycS95sRJKAUX33_u4WptsfQ1U14Slw7r8LLMCMXeXacIt-gEFUReTgk-OK0AS4RxogVolhXqc26sxLABIuZn_KsBOAEAYgF3u3siUuSBQQIBBgBkgUECAUYBKAGAoAHlKX6LqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEJPGEdIIFAiAYRABGB0yAooCOgKAQEi9_cE6mgm_AWh0dHBzOi8vd3d3Lm1pbmlpbnRoZWJveC5jb20vbWVuLXMtaG9vZGllcy1zd2VhdHNoaXJ0c19jMTIyNjk_cHJtPTIuMi43MC4wJnRvcF9waWQ9ODU4NDk1Miw5MzE5OTEyLDk2NTE1NjksOTY0Mzk5NCw5NDI0ODM3LDkzNDU1MjEsOTIwOTIxMiw5NjQ3NDEwLDk2NjcxODgsOTQwMzI0Miw5NDAwMzMxLDk2NTI5OTgmY2hhbmdlX2xhbj0xgAoDyAsB2gwQCgoQwJuuqqS2rat1EgIBA-INEwigy82vvvqBAxUxD2gIHXIvAkjYEwzQFQGAFwGyFx4KHAgAEhRwdWItNDIwNzY1Nzk3MTEyNjkzMBi5sw0&sigh=fjTH5v0svN4&uach_m=[]&ase=2&nis=5&cid=CAQSSwDICaaN2_h4HFvD8_4Nt7NeUoAZ8MtlBQ4Ylkvrjstsl0mQqUyt4Y4muCWxLP3WbeNcV2PjtfBvPwvofh8Si02qyk-Rgk-7DEPEYxgB&cbvp=2
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.16.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f156.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H3 200 ads Show response
fundingchoicesmessages.google.com/f/AGSKWxVU-WemBvWMl3kVPh6UIoJK3TZqgKDM92WTF1b6jAn-MvFlXovF22-GYcC83DO5rAgTR8wXIef181zQHiB4P7PRm_zhovgD9BAtbp0SPa2D1u3Fk4DLHpybQO1G7kbgF66LARTjpWZQLKhBrkmgwBw0DD-9R... 54 B
109 B 62ms
61ms Script
application/javascript 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVU-WemBvWMl3kVPh6UIoJK3TZqgKDM92WTF1b6jAn-MvFlXovF22-GYcC83DO5rAgTR8wXIef181zQHiB4P7PRm_zhovgD9BAtbp0SPa2D1u3Fk4DLHpybQO1G7kbgF66LARTjpWZQLKhBrkmgwBw0DD-9RONC6bpBlyl9osz6evVW8qjKJwpeDgS5/_/ads/aff-.com/js/ads//jsads-/ads?callback/google_radlinks_

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.5YUTrEgx1G4.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMwXCWVhy_SU_JAhez8qvQEgZ64ckg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7677a08220c3337c2a5e1237179c8737d9ebbf7860a295923562701b69c66640

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Lmj4-M-JbIYCzuqLR-Cl7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-Lmj4-M-JbIYCzuqLR-Cl7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 144 KB
50 KB 73ms
72ms Script
text/javascript 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

374673ccf1b9a64101a9356498f85420a7bbb560c5cc509e3d61f4c55fcdf706

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51229
x-xss-protection: 0
server: cafe
etag: 2207680665781435754
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:19 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXzoGWcyC0XX0Wz-KMzg73GAiSCBc-tRmxQqQk7yEnDTnhffQ_aecvPDWom3w5FahAibNKvJY9OTfkxjvhm59E1UXCod-KsBcurTWAs809vbF4-36eXLmF9QfzoRXmP5ovtB2K-FQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-rE86yRUcvhFqmOyaSFlunA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-rE86yRUcvhFqmOyaSFlunA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXzoGWcyC0XX0Wz-KMzg73GAiSCBc-tRmxQqQk7yEnDTnhffQ_aecvPDWom3w5FahAibNKvJY9OTfkxjvhm59E1UXCod-KsBcurTWAs809vbF4-36eXLmF9QfzoRXmP5ovtB2K-FQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QlMMD1P_rEvtzH7-v9LSTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QlMMD1P_rEvtzH7-v9LSTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231011/r20190131/ Frame 5FB2 9 KB
4 KB 38ms
38ms Document
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231011/r20190131/zrt_lookup_fy2021.html?hello=world

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

acefc092ffa6df74a87ef66c614fe3552153903ea3f4da381086eb63d1b8525e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 43836
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4090
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 15 Oct 2023 23:31:43 GMT
etag: 6119613530591461916
expires: Sun, 29 Oct 2023 23:31:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXzoGWcyC0XX0Wz-KMzg73GAiSCBc-tRmxQqQk7yEnDTnhffQ_aecvPDWom3w5FahAibNKvJY9OTfkxjvhm59E1UXCod-KsBcurTWAs809vbF4-36eXLmF9QfzoRXmP5ovtB2K-FQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UvC0xHsoItxN6Kp1FVfLzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-UvC0xHsoItxN6Kp1FVfLzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXzoGWcyC0XX0Wz-KMzg73GAiSCBc-tRmxQqQk7yEnDTnhffQ_aecvPDWom3w5FahAibNKvJY9OTfkxjvhm59E1UXCod-KsBcurTWAs809vbF4-36eXLmF9QfzoRXmP5ovtB2K-FQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zs68lSHURxcQvs79qVoWvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-zs68lSHURxcQvs79qVoWvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxX8IRL5MlHWKW8jteaeGgmlNWUjwVg1P8oq3cV_MD1jrGu9ZXSSczdzGQZsmwrHgAMWSst9KUoHeBGFNT1V6IdOdqKQWn2ZpnRljMAelx7XlWeUX9DlnC_GSPmhml7ri35nnieGjg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 79ms
78ms Script
application/javascript 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX8IRL5MlHWKW8jteaeGgmlNWUjwVg1P8oq3cV_MD1jrGu9ZXSSczdzGQZsmwrHgAMWSst9KUoHeBGFNT1V6IdOdqKQWn2ZpnRljMAelx7XlWeUX9DlnC_GSPmhml7ri35nnieGjg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjk3NDU2NTM5LDUyNzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHA6Ly93d3cuYmFiYS1tYWlsLmNvLmlsLyIsbnVsbCxbWzgsIjVZVVRyRWd4MUc0Il0sWzksImVuLVVTIl0sWzE2LCJbMSwxLDFdIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

24cc49aa80296e5edfb2a598c10d9085cb750554f2960f7703de1715f2216836

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-4_RyzAkxg0a2OjNLkkKrmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-4_RyzAkxg0a2OjNLkkKrmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxUDAUNrvTV9B_0UngDpoKg4LjO-I9KldkfCBV9yHSpLm06KeqafV9whwXtPYDk_wI34EGARmDDiNWasOPitP__jlkvUojcEGvaTMmk-j4pj05GoPy36Oyg7BKsIaNzMyu3FCdh22Q== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 58ms
57ms XHR
text/html 172.253.63.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUDAUNrvTV9B_0UngDpoKg4LjO-I9KldkfCBV9yHSpLm06KeqafV9whwXtPYDk_wI34EGARmDDiNWasOPitP__jlkvUojcEGvaTMmk-j4pj05GoPy36Oyg7BKsIaNzMyu3FCdh22Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-YUqeWM_ij2Igd0T8qvLc5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-YUqeWM_ij2Igd0T8qvLc5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: http://www.baba-mail.co.il
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C9B5 6 KB
3 KB 47ms
46ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:17 GMT
expires: Tue, 15 Oct 2024 11:42:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 62 KB
17 KB 40ms
39ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8184d264ff24fc997dc0d5fff0ac1f3bd534c5c1637cbc31889547ff9ab64e0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 24109
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17093
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 05:00:30 GMT
expires: Tue, 15 Oct 2024 05:00:30 GMT
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame C9B5 23 KB
9 KB 39ms
39ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1941
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:09:58 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3FB7 143 B
166 B 39ms
39ms Document
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 10:56:32 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame C9B5 3 KB
1 KB 39ms
39ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84901
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame C9B5 20 KB
8 KB 40ms
39ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 10:59:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 10:59:25 GMT

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 72FA 16 KB
6 KB 42ms
41ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39694
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Oct 2023 00:40:45 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 72FA 34 KB
13 KB 45ms
44ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39694
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Oct 2023 00:40:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C9B5 187 KB
59 KB 40ms
40ms Script
text/javascript 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:19 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3FB7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

50ms
49ms

Document
text/html

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:20 GMT
expires: Mon, 16 Oct 2023 11:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:19 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C9B5 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4e4a2f111b3420bb7cf98d058568ba1a7dd2c53fd802ec58153285c9e8d2c9ef

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6F81 42 B
174 B 103ms
102ms Fetch
image/gif 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvhPP8NpHLtTFUN29ICjC2JNoq-bMRVqL_esvM2TvC6trVoLJ20S-BsfrG--zHLiAYFsjmKishI5UvkYQvZaBy4wC6CtoOrxRvZcDwklZvXq2sNoW8FNl_Esg8JqVCzD7laccknQdGBPA&sai=AMfl-YQD25dgRpzn0DY_QydnwyBgHzTuPU5JMYWHtLGC4Hg-OihH9W7w1cRvRbEfGgdys6drMpNtZa553P3yWHazrRxqYevebG-1egZ6rGVYgQgM5Sv9SbqoRK6jAtPdrdhLg7_9O3f55YxPiodRhA&sig=Cg0ArKJSzPBJn9Z2qWjhEAE&cid=CAQSTADICaaN5aOCOpOaZPvzQJ_RpwIALeBxu8Kfv3tvhv_7zNaaHE7xAtWzOz5akMGVWA5YJKhob0ABLdFutbt81d0LZpCPGgc1izh5v7wYAQ&id=lidar2&mcvt=1000&p=166,315,416,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=4250329652&rs=4&la=1&cr=0&vs=4&r=v&rst=1697456538676&rpt=265&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 751A 0
0 99ms
99ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsua9F9mZcOqzTKgjNwdYq_0hrgmmgzgu1pqHLhX9VY2y0SAaH19QTV4uW5KrthcC50zJ2j9XDwGe9BVJeYQeye3Ty893KS4xZUS2Pz9vtJyB2B3NSwd0wlDD7iRL9LCY9wc4fZiWls9CoFno31CB4WkFCsWlgscuEJd8Jd4YNjLdRoooWmyGdU5Xc6Dv5v7u7YrgRxyWVn1zOJCDt-YB9vX6TD06TdR11cuHpE36_VXxmuEduZYqqsSjukgBRx42oigTa4Uc7KA5tFi7bpews5nD1aVn6cY55aT9lZFQCLjlBzMe52zWCfhEtIvGbL3G3x6QhiIwNOwU80cw071x0o73RcQOEovXbgi9u1YJSGlcdR6-5hwBNpPtvhTWaFAfhJj-3k&sai=AMfl-YQBVRg7s5KkMxsA1k4YoAHfafz0yyAzcuY8z3Q9e-ITHWHXBUTyo5CSVqv7mwu8MppDcCqmWo8mv4JemsOy1nFVe7vH26fWlG99Or1-Z37Lu82YG9FEl60PUfzkiRgM5qiucH_7X2MwmX7PILRW&sig=Cg0ArKJSzBi3XOjgxE1MEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK loader.js Show response
cdn.taboola.com/libtrc/ynet-babamailarticles/ Frame 751A 158 KB
46 KB 74ms
53ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://cdn.taboola.com/libtrc/ynet-babamailarticles/loader.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js
Protocol: HTTP/1.1
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 62055fd1cf58255618928582456967098539f4a08d6007a9e8dbf4d130a9fe5c

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 43ZANGNm3D0LyjqDTLP4RnwjbdbCOfhc
content-encoding: gzip
Via: 1.1 varnish
Date: Mon, 16 Oct 2023 11:42:20 GMT
x-amz-request-id: G8AQDQN4Q5NM51D4
Age: 0
x-amz-server-side-encryption: AES256
X-Cache: MISS
x-from-cache: 1
x-envoy-upstream-service-time: 6
x-amz-replication-status: FAILED
Connection: keep-alive
Content-Length: 45682
x-amz-id-2: RpMv8SWg7KSDwBwq3W9DbCD355OmIyo91IPeNDQ6slVtcsz1Tgc6cqg1Rn9YdGktisgk4w8PNTc=
X-Served-By: cache-yyz4558-YYZ
last-modified: Mon, 16 Oct 2023 11:42:20 UTC
Server: nginx
X-Timer: S1697456540.104247,VS0,VE34
etag: "a8a9156cac3d47a643fa903b8d9ef2e5644fe60c"
Vary: Accept-Encoding, Accept-Encoding
Content-Type: application/javascript; charset=utf-8
access-control-allow-origin: *
abp: 4
Cache-Control: private,max-age=14400
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 751A 187 KB
59 KB 42ms
41ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:20 GMT

GET
H3 200 UI_YG_Logo_018_2.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 110 KB
110 KB 46ms
46ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/UI_YG_Logo_018_2.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb8c93b615ed76276a52a998787e523154224ae4671e8a5f8cdbf852a14ddb76

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:03:25 GMT
x-content-type-options: nosniff
age: 2335
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112833
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:03:25 GMT

GET
H3 200 YG_18279_9153_WO_EN_chy_JAM_Gif_Res_300x600_w-cha-yog_cgc_top__sen.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 88 KB
88 KB 43ms
42ms Image
image/gif 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/YG_18279_9153_WO_EN_chy_JAM_Gif_Res_300x600_w-cha-yog_cgc_top__sen.gif

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9607ae5a916c18f10b8960f2484eba4e8e33d2d8307ac1b79ed4f50ad1e94f1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Sun, 15 Oct 2023 14:10:31 GMT
x-content-type-options: nosniff
age: 77509
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90183
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 14 Oct 2024 14:10:31 GMT

GET
H3 200 YG_18279_9153_WO_EN_chy_JAM_Gif_Res_320x480_w-cha-yog_cgc_top__sen.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 71 KB
71 KB 49ms
48ms Image
image/gif 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/YG_18279_9153_WO_EN_chy_JAM_Gif_Res_320x480_w-cha-yog_cgc_top__sen.gif

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6630efb96271e85e7b729e0bb1263e846be0b1c9cef759755f2ec1d03028b6f9

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 05:00:31 GMT
x-content-type-options: nosniff
age: 24109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72976
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 05:00:31 GMT

GET
H3 200 YG_18279_9153_WO_EN_chy_JAM_Gif_Res_970x250_w-cha-yog_cgc_top__sen.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 114 KB
114 KB 50ms
49ms Image
image/gif 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/YG_18279_9153_WO_EN_chy_JAM_Gif_Res_970x250_w-cha-yog_cgc_top__sen.gif

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b47c324276b7d677c67281acdcae1db9c0360a2520277852c40d3588aaf9cf6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:03:25 GMT
x-content-type-options: nosniff
age: 2335
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 116397
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:03:25 GMT

GET
H3 200 YG_18279_9153_WO_EN_chy_JAM_Gif_Res_300x250_w-cha-yog_cgc_top__sen.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 49 KB
49 KB 52ms
51ms Image
image/gif 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/YG_18279_9153_WO_EN_chy_JAM_Gif_Res_300x250_w-cha-yog_cgc_top__sen.gif

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7dec0364bd798e74b9c1d2c31077862c53639b7dec877a82f2dd8c53d47db6b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 05:00:31 GMT
x-content-type-options: nosniff
age: 24109
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49683
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 05:00:31 GMT

GET
H3 200 YG_18279_9153_WO_EN_chy_JAM_Gif_Res_728x90_w-cha-yog_cgc_top__sen.gif
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/ Frame 72FA 42 KB
42 KB 47ms
47ms Image
image/gif 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/8412606271970082816/YG_18279_9153_WO_EN_chy_JAM_Gif_Res_728x90_w-cha-yog_cgc_top__sen.gif

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd01f0babab61832711f688426980b50d4def7242e16bd445076496fc8079beb

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:03:25 GMT
x-content-type-options: nosniff
age: 2335
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43335
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 10:08:36 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:03:25 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame C9B5
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=Cq_9umyEtZZ3wA5uooPMP-r-h-AXp4KjDc4nay6uGEsCQnvaLDhABIJn7oCtg_aCZgegDoAGqgvDcAcgBCeACAKgDAcgDAqoErQJP0BRrs3wQAJP57myf05XUvGPr5nu_SVVKhNkS8SYG...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1...

0
0

94ms
94ms

Fetch
text/css

142.251.167.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1f1dc84c6c70000000000000000%22,%224%22:%220xd1fc2155e50607eb0000000000000000%22,%225%22:%220x9c8930349812dea10000000000000000%22},%22debug_key%22:%229486278089785375569%22,%22debug_reporting%22:true,%22destination%22:%22https://yoga-go.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22463208746%22],%224%22:[%2210-16%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%228247963613822659441%22}&andc=true

Protocol

Server

142.251.167.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x98b03cc5444c2c7c0000000000000000","2":"0xfd65cb585d4c6d650000000000000000","3":"0x5199b1f1dc84c6c70000000000000000","4":"0xd1fc2155e50607eb0000000000000000","5":"0x9c8930349812dea10000000000000000"},"debug_key":"9486278089785375569","debug_reporting":true,"destination":"https://yoga-go.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["463208746"],"4":["10-16"],"6":["true"]},"priority":"500","source_event_id":"8247963613822659441"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 11:42:20 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 16 Oct 2023 11:42:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x98b03cc5444c2c7c0000000000000000","2":"0xfd65cb585d4c6d650000000000000000","3":"0x5199b1f1dc84c6c70000000000000000","4":"0xd1fc2155e50607eb0000000000000000","5":"0x9c8930349812dea10000000000000000"},"debug_key":"9486278089785375569","debug_reporting":true,"destination":"https://yoga-go.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["463208746"],"4":["10-16"],"6":["true"]},"priority":"500","source_event_id":"8247963613822659441"}&andc=true
access-control-allow-origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 94ms
94ms Preflight
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=Cq_9umyEtZZ3wA5uooPMP-r-h-AXp4KjDc4nay6uGEsCQnvaLDhABIJn7oCtg_aCZgegDoAGqgvDcAcgBCeACAKgDAcgDAqoErQJP0BRrs3wQAJP57myf05XUvGPr5nu_SVVKhNkS8SYGQ9kgC6SBkAxwGgtZtCuRpmq4W8UxChK4etcSLS6W2ERzYp_6kEyKdE9lvKFb39UGXAYniLnVq5loNlE7uCwXvkkkuUmMRwXNlbm0tfgUNXp-KXuzVj5Fc0DFjtZw1iWgBqNhriQIFkAT0Lh0LguPwcj0Vl-cBQRXXtgLRkj7WexfKjQmu1u8kUYJxa7-i-OJdlvf7ZSWnzTd0WwwC2TWf2Jufz1ygTOKQnNPqZSS3hh1nYwfqAYK1AWxdo6q237HS6Zgcbjbl4XZo9ISpb9Ntjld5JhsgXelB0uQbb6yHO8Ka9nssd3qJ_JGDYf8fgMb4ZME8ABezL4hSbopbKxPy0U4p-d9EagyoAhP8e5wwAT5g8yWvwTgBAGIBc-uorRMkgUECAQYAZIFBAgFGASgBl2AB779j6MCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQhtIb0ggUCIBhEAEYHTICigI6AoBASL39wTqaCaMBaHR0cHM6Ly95b2dhLWdvLmlvP2JyYW5jaC1uYW1lPWNoYWlyJnRlc3QtbmFtZT1nbzRxcG0mdXRtX3NvdXJjZT1nb29nbGUmdXRtX21lZGl1bT1jcGMmY2FtcGFpZ25faWQ9MjA1MTA3MDk1ODMmYWRncm91cF9pZD0xNTQzOTc3NzAyMzMmYWRfaWQ9Njc1NDUzNjA5Nzc5JnV0bV90ZXJtPYAKA8gLAdoMEQoLENCs26Kikv72kQESAgED4g0TCLXSza---oEDFRsUaAgd-l8IX9gTDNAVAZgWAYAXAbIXHgocCAASFHB1Yi00MjA3NjU3OTcxMTI2OTMwGLmzDQ&sigh=Yf52Q7CjMyY&uach_m=[UACH]&ase=2&nis=4&cid=CAQSTADICaaNEPjI7tmPrSZIZlld5_l0gmywPDlModCTb9s5_3z-fu_kz94qM9feeQd85jWV9ewyxbx1CdRnuJ7fTNcTu8vxJrQs8-AqUDoYAQ&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 11:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 tr5
cdn.taboola.com/libtrc/ Frame 751A 3 B
182 B 73ms
23ms Image
text/html 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.taboola.com/libtrc/tr5?abgroup=block-clicks-recurring-click-200_var
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-served-by: cache-yyz4523-YYZ
date: Mon, 16 Oct 2023 11:42:20 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1697456540.252872,VS0,VE0
x-cache: HIT
content-type: text/html
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
content-length: 3
retry-after: 0
x-cache-hits: 0

GET
DATA 200
OK truncated
/ Frame 751A 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 719f7c29ff76a20fec3437f614e21d0e7fae4be22e18026742acdaccb75da6b2

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js Show response
cdn.taboola.com/libtrc/ Frame 751A 812 KB
168 KB 31ms
24ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/ynet-babamailarticles/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: ad228660e683bd9a0852042aad9cca032549a56e64a410522ff2cf70c9afd9dc

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 0O0axFETXFXtpIrGBsMdYCXByw6a8Qre
content-encoding: br
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:20 GMT
x-amz-request-id: 3B0YDTF2XTTT0Y4G
age: 16486
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 172018
x-amz-id-2: jFEWKSKtvIdSKQEemUsZ+/sLl9eTlZ+/abaG9EMncnmENyFBPcob6R4rhm9ygyXHRv0DSEZ+Hv4=
x-served-by: cache-yyz4523-YYZ
last-modified: Mon, 09 Oct 2023 08:08:11 GMT
server: AmazonS3-br
x-timer: S1697456540.252852,VS0,VE0
etag: "ae93f3412c0202e1aa9fdc8e8f5d769c"
vary: Accept-Encoding
content-type: application/javascript
abp: 67
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
x-cache-hits: 65

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 95ms
93ms Preflight
text/html 142.251.167.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1f1dc84c6c70000000000000000%22,%224%22:%220xd1fc2155e50607eb0000000000000000%22,%225%22:%220x9c8930349812dea10000000000000000%22},%22debug_key%22:%229486278089785375569%22,%22debug_reporting%22:true,%22destination%22:%22https://yoga-go.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22463208746%22],%224%22:[%2210-16%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%228247963613822659441%22}&andc=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 11:42:20 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sync Show response
gum.criteo.com/ Frame 751A
Redirect Chain

http://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS
https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS

46 B
288 B

104ms
35ms

Script
text/javascript

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 212881
expires: 60

Redirect headers

location: https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS
cache-control: no-cache
content-length: 0

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 402F 42 B
64 B 97ms
97ms Image
image/gif 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstV841jpZxOxl7KpMDReqXA5Y1hvd5pQNFBYVqFabkzzau4MfdbKF14dhBFs5oBH-vN7crOujVRdOR8ugK_XRJYwrL2Di28kVa2YYuNwD5jZOSF_QYAyMEtDwfSpCLEUegXPmkBXl2ifg&sai=AMfl-YS_7ZYQobHOYnFrwWKzzrZSirQTFHnDchgx9uE840dMyQbHMeglU_bBbmRJwHu3Trc-l6k6nbBntwVnqKWamWAbw2rWVN3-DqK4CbJUSOczVEk7KbhXWr0CZbokx1Lh1-lASRd-DeIp-RDY&sig=Cg0ArKJSzIbE2DukOtTLEAE&cid=CAQSSwDICaaN2_h4HFvD8_4Nt7NeUoAZ8MtlBQ4Ylkvrjstsl0mQqUyt4Y4muCWxLP3WbeNcV2PjtfBvPwvofh8Si02qyk-Rgk-7DEPEYxgB&id=ampim&o=0,146&d=160,600&ss=1600,1200&bs=1600,1200&mcvt=1021&mtos=0,0,1021,1021,1021&tos=0,0,1021,0,0&tfs=264&tls=1285&g=100&h=100&tt=1285&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=&uaw=&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:20 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 751A 0
0 97ms
97ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstWOHTpNK7G04Io6NofaLfJ714IlYOPAu1vxeUgT-xBuR1oLDmKtqiz1SSr2G8MgNqeS3yrSsgz0SdxdBwyjwTNKWYh3Z7DLsdqqc7VAlSKVD6hoCxnSmCPLWjdTOy65jl1gtrm-NV5DoIFOn2IOYkJJoVTmjtt1tw9G63Eh_b5BxV1p9A1rlKXp2o_EBzfB8HUlwbnqKqvOx4RbbxiHjNDPUoylgQk4AnrXSr0JftVyVmsZudTmtTmG60HIr-Bg3ZImHbpBTZqy2c7SIlPHSbaRqCgJzbXqpUbMDL1XxJ6eiXvFbhUky7sznwgPob0ll4ZyWQTN2S0qBrnHtQIER20n8FiTKlqYYEGlG-lQFtiWPQ7Zmecx9lBJiCDmWw0JQqQaZnFNg&sai=AMfl-YRF2EFFnM-h3UQRPo-V1X0DABS9T_aEUzYF0CbHmKzD_zPBauanfQH-E2uXvBztPD09TFnlwP44iMVl0Xr7dGV0CCkVYwK2AyT1hqGvi-F-PtBvm6t7FFQJaAptA-IYbQa70DsOkeI1VDoPTQ6d&sig=Cg0ArKJSzCTy_E0-FsHLEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 11:42:20 GMT

GET
H3 200 container.html Show response
c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 576F 6 KB
3 KB 38ms
37ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:17 GMT
expires: Tue, 15 Oct 2024 11:42:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 576F 4 KB
1 KB 128ms
48ms Stylesheet
text/css 172.253.122.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f95.1e100.net

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 10:11:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Oct 2023 11:42:20 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame EC63 14 KB
1 KB 113ms
50ms Stylesheet
text/css 172.253.122.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%7CHeebo%3A400

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f95.1e100.net

Software

ESF /

Resource Hash

3fd59922fbd55bd99d24e8cb2df6d53c0ae9500d5fa028b286639a6d4cfe044b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 11:34:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Oct 2023 11:42:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame EC63 2 KB
901 B 38ms
38ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:25:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1004
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:25:36 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame EC63 23 KB
9 KB 38ms
38ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1942
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:09:58 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B9E0 143 B
166 B 43ms
40ms Document
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2748
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 10:56:32 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame EC63 3 KB
1 KB 43ms
40ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84902
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame EC63 20 KB
8 KB 44ms
41ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 10:59:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2575
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 10:59:25 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EC63 187 KB
59 KB 45ms
42ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:20 GMT

GET
H2 200 ccbada329de78be299cbea1a52c9a584.js Show response
www.gstatic.com/mysidia/ Frame EC63 35 KB
15 KB 117ms
38ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ccbada329de78be299cbea1a52c9a584.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

003fffcd4e614a4719da6f886bd221851da79915061393b248af55fe0ddf9476

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:30:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 252703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14787
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 21:09:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 11 Jan 2024 13:30:37 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/ Frame 576F 20 KB
8 KB 42ms
41ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e08fab994eb10dfab342ea8c594178451e92a54746244e47f90d513c187ae228

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 12:07:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8568
x-xss-protection: 0
server: cafe
etag: 3657364187347500438
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 12:07:17 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 576F 205 B
296 B 126ms
56ms Image
image/png 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:33:10 GMT
x-content-type-options: nosniff
age: 252550
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 12 Oct 2024 13:33:10 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 576F 604 B
1 KB 107ms
37ms Image
image/png 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:53:38 GMT
x-content-type-options: nosniff
age: 251322
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 12 Oct 2024 13:53:38 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B9E0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

48ms
48ms

Document
text/html

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:20 GMT
expires: Mon, 16 Oct 2023 11:42:20 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:20 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 json Show response
trc.taboola.com/ynet-babamailarticles/trc/3/ Frame 751A 6 KB
4 KB 117ms
114ms XHR
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/ynet-babamailarticles/trc/3/json?tim=04%3A42%3A20.866&lti=block-clicks-recurring-click-200_var&data=%7B%22id%22%3A547%2C%22ii%22%3A%22%2F%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1697365555162%2C%22vi%22%3A1697456540862%2C%22cv%22%3A%2220231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22http%3A%2F%2Fwww.baba-mail.co.il%2F%22%2C%22bv%22%3A%220%22%2C%22wc%22%3Atrue%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22pev%22%3A%2213485%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22plf%22%3A%7B%22ack_exm%22%3Atrue%7D%2C%22bu%22%3A%22http%3A%2F%2Fwww.baba-mail.co.il%2F%22%2C%22vpi%22%3A%22%2F%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A300%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A250%2C%22dw%22%3A300%2C%22dh%22%3A250%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A1%2C%22uim%22%3A%22thumbnails-300X250%3Aabp%3D0%22%2C%22uip%22%3A%22Taboola%20DFP%20300x250%20MW%22%2C%22orig_uip%22%3A%22Taboola%20DFP%20300x250%20MW%22%2C%22cd%22%3A0%2C%22mw%22%3A300%7D%5D%2C%22cacheKey%22%3A%22text%3D%2F%2CTaboola%20DFP%20300x250%20MW%3Dthumbnails-300X250%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22block-clicks-recurring-click-200_var%22%7D&llvl=2
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 66aa09a7f7000ec57d6b53d59e03edb595f2d07241e05d21679100205076ec87

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

x-vcl-time-ms: 96
date: Mon, 16 Oct 2023 11:42:20 GMT
content-encoding: gzip
via: 1.1 varnish
cpu: 0.6433333333333333
x-fastly-to-nlb-rtt: 13558
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4523-YYZ
x-log-content-encoding: gzip
server: nginx
x-timer: S1697456541.881074,VS0,VE96
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: http://www.baba-mail.co.il
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H3 200 p04HFUVHB2kdNiXzU6p470k3by9Z9P4MzDHJjw8x7-0.js Show response
pagead2.googlesyndication.com/bg/ Frame B946 37 KB
14 KB 39ms
39ms Script
text/javascript 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/p04HFUVHB2kdNiXzU6p470k3by9Z9P4MzDHJjw8x7-0.js

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a74e0715454707691d3625f353aa78ef49376f2f59f4fe0ccc31c98f0f31efed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:04:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 175055
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14689
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 13 Oct 2024 11:04:45 GMT

GET
H/1.1 200
OK c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
cdn.taboola.com/static/c5/ Frame 751A 3 KB
2 KB 19ms
19ms Image
image/svg+xml 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.taboola.com/static/c5/c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
Protocol: HTTP/1.1
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 3GoWmPpnzFDs5CP3.ebHbCmhALWQMuvH
Content-Encoding: gzip
Via: 1.1 varnish
Date: Mon, 16 Oct 2023 11:42:21 GMT
x-amz-request-id: C1HQGJD0TG08YQ1R
Age: 57
X-Cache: HIT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 1502
x-amz-id-2: IqZCATUvXib4os3ZsGEZo/FfUsWuv0jfVwwf1VVuFUQAYKRvEQZ5hxhOi7s8VL222Vg6PyzwjOg=
X-Served-By: cache-yyz4558-YYZ
Last-Modified: Sun, 10 Jun 2018 13:23:55 GMT
Server: AmazonS3
X-Timer: S1697456541.077121,VS0,VE0
ETag: "11d8569a7da0739259e3ac0b0d666e94"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
abp: 95
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Cache-Hits: 9

GET
H2 200 userx.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.es6.js Show response
cdn.taboola.com/libtrc/ Frame 751A 18 KB
6 KB 20ms
20ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.es6.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/ynet-babamailarticles/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e67df0ddffabcf53b73490cc5cae0f8c280104e23f1d6fbf9790e6a4bf558ac

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: Z2BxWhDsxKLntqgOv2sfcfrzSoJnhxqH
content-encoding: gzip
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:21 GMT
x-amz-request-id: NHJJ6FRB68A0GK7J
age: 22
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: FAILED
content-length: 5453
x-amz-id-2: gV3r7sEA0tC9bhlkRej4Z6p7qfNYuo8s+ekDISvV2cwVii+InNTIK9lQuViFroaUFnRyf5R+WtM=
x-served-by: cache-yyz4523-YYZ
last-modified: Mon, 09 Oct 2023 08:08:48 GMT
server: AmazonS3
x-timer: S1697456541.080688,VS0,VE1
etag: "2822577173286f6e7fb38f18c9ad95f6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 57
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
x-cache-hits: 1

GET
H2 204 abtests
ch-trc-events.taboola.com/ynet-babamailarticles/log/3/ Frame 751A 0
505 B 100ms
32ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/ynet-babamailarticles/log/3/abtests?route=US:CH:V&tvi48=10638&tvi50=9058&lti=block-clicks-recurring-click-200_var&ri=a25a4afeaa990835779158f443e18457&sd=v2_1a73f8a6ea56b0156472fab70afd3454_ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c_1697456540_1697456540_CNawjgYQyKdZGL6ZrcKzMSABKAEwJjiJ6AdAsvEHSOzZ2ANQ____________AVgAYABooKCVq-PzhYw8cAE&ui=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&pi=/&wi=-3676633171463953713&pt=text&vi=1697456540862&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1697456541058%7D&tim=04%3A42%3A21.059&id=3411&llvl=2&cv=20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61&
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 16 Oct 2023 11:42:21 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
images.taboola.com/taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame 751A 12 KB
13 KB 20ms
18ms Image
image/webp 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b6abe96ef57e5da94e9d6e2a6f99d5e81f19f8618c99e072917ef38a50f5984b

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Mon, 16 Oct 2023 11:42:21 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
age: 940585
edge-cache-tag: 305739624204443205665925302523284571015,581020326624456120581803963053862324929,29ecf9b93bbf306179626feeda1fab70
cache-tag: 305739624204443205665925302523284571015,581020326624456120581803963053862324929,29ecf9b93bbf306179626feeda1fab70
x-cache: HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 136
expiration: expiry-date="Wed, 11 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.manchestereveningnews.co.uk/sport/football/man-united-news-ten-hag-27842901
content-length: 12456
x-backend-name: CH_nlb801
x-served-by: cache-iad-kjyo7100061-IAD, cache-iad-kiad7000067-IAD, cache-iad-kcgs7200037-IAD, cache-yyz4523-YYZ
last-modified: Sun, 10 Sep 2023 12:59:46 GMT
server: nginx
surrogate-reporting: width=360,height=180,owidth=1067,oheight=600,obytes=280324
x-timer: S1697456541.096615,VS0,VE0
etag: "fb64304cca8cb80eb0957249862e074c"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 129, 11

GET
H2 204 debug
ch-trc-events.taboola.com/ynet-babamailarticles/log/2/ Frame 751A 0
90 B 74ms
31ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/ynet-babamailarticles/log/2/debug?tim=04%3A42%3A21.094&type=warn&msg=TRC.TranslationsManager%20-%20missing%20feature%20in%20translationMap%3A%20userx.&llvl=2&id=3857&cv=20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61&lt=block-clicks-recurring-click-200_var&pct=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:21 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 13484

GET
H2 200 287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
images.taboola.com/taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame 751A 12 KB
12 KB 19ms
19ms Image
image/webp 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b6abe96ef57e5da94e9d6e2a6f99d5e81f19f8618c99e072917ef38a50f5984b

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Mon, 16 Oct 2023 11:42:21 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
age: 940585
edge-cache-tag: 305739624204443205665925302523284571015,581020326624456120581803963053862324929,29ecf9b93bbf306179626feeda1fab70
cache-tag: 305739624204443205665925302523284571015,581020326624456120581803963053862324929,29ecf9b93bbf306179626feeda1fab70
x-cache: HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 136
expiration: expiry-date="Wed, 11 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.manchestereveningnews.co.uk/sport/football/man-united-news-ten-hag-27842901
content-length: 12456
x-backend-name: CH_nlb801
x-served-by: cache-iad-kjyo7100061-IAD, cache-iad-kiad7000067-IAD, cache-iad-kcgs7200037-IAD, cache-yyz4523-YYZ
last-modified: Sun, 10 Sep 2023 12:59:46 GMT
server: nginx
surrogate-reporting: width=360,height=180,owidth=1067,oheight=600,obytes=280324
x-timer: S1697456541.124136,VS0,VE0
etag: "fb64304cca8cb80eb0957249862e074c"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 129, 12

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C9B5 42 B
64 B 96ms
95ms Fetch
image/gif 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv3oiPbTHKOd0yz-Ih5TxmC50un-0idA8frWUIxvXUCgu-f7Zit_pifM7HU77mMqhOHROS9U4o_yY9jJo0G06NI05ANZhLUcLQxqtG0xoTLCO6UzkZXMe5FrFgIbFDyDFbDHTSzqi44Ew&sai=AMfl-YQdFj__AShMqf0HNSZnBai7xsjpfyLbrmcg4DjKjEjGuxeM6cViBc2FVvD2diPl8aMN1cfHgEYnqzm6NcqD5icdOnithMJ5B-4y0UTBBk6RevZRHOy7lI6Eiz5N-IJbt2Pxr97Lhf_g0qKwZg&sig=Cg0ArKJSzGpbuSL_32IUEAE&cid=CAQSTADICaaNEPjI7tmPrSZIZlld5_l0gmywPDlModCTb9s5_3z-fu_kz94qM9feeQd85jWV9ewyxbx1CdRnuJ7fTNcTu8vxJrQs8-AqUDoYAQ&id=lidar2&mcvt=1000&p=1070,636,1160,1364&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=272365241&rs=4&la=0&cr=0&vs=4&r=v&rst=1697456539755&rpt=338&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6CFD 0
0 98ms
98ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsttEoX1r38lBR1GthoW_V7yBSEuEXXsqcNwwDuHqkcDF3OXJS44-K_9Xar2QGGCdA7IFDDpzsHDVfoU8ArTfXlbBHQchSXcRu9m4nwzTVriOnZyMhkRLtmiHSmVCLUu5JuGEeIeSyrZovO7gqULicAvzMwQ_SxZfZy44W_4Wyjh5Hnx759XKfd8F7MKzPmpJgbHAwbjjWJnfHUGPg5Qg59XrsUdKeAx-y2grVktFI2GCBsZ0VEZXv2hMgIGu2n-mEe4_Vb9YqvJhgi4v83ZyZk_slhPBem8ikRysq3bHwr3XKEIta_Ng3XH8QDOePB1X2tlUgPqxPE9dQb5pUpjj2rH59mT9RFi18WVjC1lc5jT&sai=AMfl-YR1nrBvhgOkAvSBGnwgSHXAgrSNQFdGXfPx6LrXNLYLVwFTy0iSbyo9GHGqKekTjysIiKViJhEGHFN_tXtKZBIIbiIJypBs_c7R4Ij_72f7WbOnx0a0ZkaWJkwP5l9-7LZ1a8RIv4aSm5OKeGw&sig=Cg0ArKJSzKkQIzcUt9yHEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK loader.js Show response
cdn.taboola.com/libtrc/ynet-babamailarticles/ Frame 6CFD 157 KB
45 KB 81ms
80ms Script
application/javascript 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: http://cdn.taboola.com/libtrc/ynet-babamailarticles/loader.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js
Protocol: HTTP/1.1
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 16b432fd8da7c24c4bdfb3a020af76f5bb4c9349a2ad653d15a71dc942395e7b

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 43ZANGNm3D0LyjqDTLP4RnwjbdbCOfhc
Content-Encoding: gzip
Via: 1.1 varnish
Date: Mon, 16 Oct 2023 11:42:21 GMT
x-amz-request-id: NK11NSZ7SJFTMEWG
Age: 0
x-amz-server-side-encryption: AES256
X-Cache: HIT
x-amz-replication-status: FAILED
Connection: keep-alive
Content-Length: 44945
x-amz-id-2: VrmAG6Lf+L38bqA+xf3MmnrvaWfqqIY0VB3P+K1w2jdQ+GB6ybJuMfKIS4PiJP0r44BRac3cvFA=
X-Served-By: cache-yyz4558-YYZ
Last-Modified: Sun, 15 Oct 2023 10:25:56 GMT
Server: AmazonS3
X-Timer: S1697456541.380667,VS0,VE62
ETag: "92aff39448c6e98b5667b0d5bfaec2b0"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
abp: 34
Access-Control-Allow-Origin: *
Cache-Control: private,max-age=14401
Accept-Ranges: bytes
X-Cache-Hits: 1

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6CFD 187 KB
59 KB 924ms
923ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:22 GMT

GET
H3 200 container.html Show response
c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7914 6 KB
3 KB 37ms
37ms Document
text/html 142.251.16.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310100101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.baba-mail.co.il/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:17 GMT
expires: Tue, 15 Oct 2024 11:42:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 66 KB
17 KB 48ms
46ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b41ba07202911cbc1c181534938e7eb86280e44b8778d7221fe59a8a93a1a14

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 167579
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 17608
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Sat, 14 Oct 2023 13:09:22 GMT
expires: Sun, 13 Oct 2024 13:09:22 GMT
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 7914 23 KB
9 KB 46ms
46ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc069e0e04d13807f2632483a883ed5fbd1d72c4eade64a9ac7f6aa71ac47fa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:09:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1943
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9145
x-xss-protection: 0
server: cafe
etag: 13066256994748809036
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 11:09:58 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B8D9 143 B
166 B 43ms
42ms Document
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2749
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 10:56:32 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7914 3 KB
1 KB 48ms
48ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 15 Oct 2023 12:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 84903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 29 Oct 2023 12:07:18 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 7914 20 KB
8 KB 47ms
47ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def028b193b87150eeb974ece780b8476797f52aa2edc9d7031e35bb5d0edd15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 10:59:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2576
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8337
x-xss-protection: 0
server: cafe
etag: 13483435759450910196
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Oct 2023 10:59:25 GMT

GET
H2 200 impl.20231015-3-RELEASE.js Show response
cdn.taboola.com/libtrc/ Frame 6CFD 811 KB
168 KB 23ms
22ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/impl.20231015-3-RELEASE.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/ynet-babamailarticles/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3-br /
Resource Hash: 7bab19098c317dcd4522ff95c1e6a9ae9ffe7a6d3a28056bc9eb98295d09b743

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: __2VBbf6wb84v5rRZm0fV4SjbK3IpcxJ
content-encoding: br
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:21 GMT
x-amz-request-id: QWCBT6KZCKRRVTJX
age: 7072
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 171903
x-amz-id-2: pvDXeipY7ZQ0j0Cd/aMrRxK4DDHSpYXodSm9z30/vhIjIkgSpsre1gqUXtrekgpp24gkUEuNOig=
x-served-by: cache-yyz4523-YYZ
last-modified: Sun, 15 Oct 2023 09:43:39 GMT
server: AmazonS3-br
x-timer: S1697456542.544719,VS0,VE0
etag: "b25190d8bb0cab9eabbcf6a614338e83"
vary: Accept-Encoding
content-type: application/javascript
abp: 14
access-control-allow-origin: *
cache-control: private,max-age=31536000
accept-ranges: bytes
x-cache-hits: 3562

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 9818 16 KB
6 KB 39ms
38ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39696
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5660
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Oct 2023 00:40:45 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 9818 34 KB
13 KB 41ms
40ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fee86fd46a67912ffd9ae2997c583f59abe6e11c532496c52759e94136837d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 00:40:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39696
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13035
x-xss-protection: 0
server: cafe
etag: 2319883687766034370
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Oct 2023 00:40:45 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7914 187 KB
59 KB 732ms
732ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e633b623c0a583bfd0faa2e8ddbedf076e711868262bc8122ef486d7ace2e85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60003
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697024009209687"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 16 Oct 2023 11:42:22 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame B8D9
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

49ms
48ms

Document
text/html

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
URL: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:21 GMT
expires: Mon, 16 Oct 2023 11:42:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 16 Oct 2023 11:42:21 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7914 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5409b6ea742e87e154e70371e79058f58bb028d35fa15192bc9a6e321b3b09ef

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sync Show response
gum.criteo.com/ Frame 6CFD
Redirect Chain

http://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS
https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS

46 B
287 B

35ms
35ms

Script
text/javascript

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS

Requested by

Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:21 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 525996
expires: 60

Redirect headers

Location: https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H3 200 St_768x1024.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 132 KB
132 KB 41ms
41ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_768x1024.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c2b018082e437c7abe92e2307d89cc5b75ef6415a271b4be97db491f269e315

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135112
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

GET
H3 200 St_580x400.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 48 KB
48 KB 44ms
44ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_580x400.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81f5a6ede934717d5dd26e5b5a2d7f9840c0a0a0c967dbeaf47b40abc42008eb

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49406
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

GET
H3 200 St_970x250.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 47 KB
48 KB 46ms
46ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_970x250.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d20086d2e7e364f5d83cbf9dea0c044352e3a1dca3db96d429684986383c7122

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48622
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

GET
H3 200 St_728x90.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 16 KB
16 KB 47ms
47ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_728x90.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43bc5c1a8552b24a289b17b77241c5a8279511767ee6efb2673b75188dc9ee23

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16215
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

GET
H3 200 St_320x480.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 38 KB
39 KB 48ms
48ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_320x480.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92f32fb7cd75f496862a8eec288e5c3e12d893a2a9eab7cc34daeeea37d8d0d6

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39417
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

GET
H3 200 St_300x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 48 KB
48 KB 49ms
49ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_300x600.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c65885e2fd108b28a1442376251aa50083f9e54433cd2f2edaa234e6532ff6b3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48713
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

GET
H3 200 St_300x250.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/ Frame 9818 20 KB
20 KB 52ms
52ms Image
image/png 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/St_300x250.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12897889696968867840/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38a2473618f1a9134c4d7bad9f3e95f714124d17a81e7e1496ce5ca90fad136e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
date: Mon, 16 Oct 2023 11:42:21 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20374
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 15:35:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 15 Oct 2024 11:42:21 GMT

POST
H2 204 bulk Show response
trc.taboola.com/ynet-babamailarticles/log/3/ Frame 751A 0
596 B 34ms
33ms XHR
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/ynet-babamailarticles/log/3/bulk?tvi48=10638&tvi50=9058&route=US%3ACH%3AV&lti=block-clicks-recurring-click-200_var&bulkSize=1
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.baba-mail.co.il/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-vcl-time-ms: 15
date: Mon, 16 Oct 2023 11:42:22 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 13596
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v1
x-served-by: cache-yyz4523-YYZ
pragma: no-cache
server: nginx
x-timer: S1697456542.095529,VS0,VE15
content-type: image/gif
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-cache
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

GET
H/1.1 200
OK f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ Frame 751A 254 B
1 KB 19ms
18ms Image
image/png 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Protocol: HTTP/1.1
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
Date: Mon, 16 Oct 2023 11:42:22 GMT
Via: 1.1 varnish
x-amz-request-id: C4YX393BV63BMCS9
Age: 14840
X-Cache: HIT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 254
x-amz-id-2: hJZ9rVKYX0/8YTS367+n1JLWaWxjxwlUGV9luK6w6nrhJtmZXbtiGq/h5BjCJKdhOOZFYFppGpg=
X-Served-By: cache-yyz4558-YYZ
Last-Modified: Wed, 24 Jun 2015 07:14:11 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
X-Timer: S1697456542.124019,VS0,VE0
ETag: "dfa7b52c86e56bd67fa4002f6ed19854"
Content-Type: image/png
abp: 64
Access-Control-Allow-Origin: *
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 568

GET
H/1.1 200
OK c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
cdn.taboola.com/static/c5/ Frame 6CFD 3 KB
2 KB 18ms
18ms Image
image/svg+xml 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.taboola.com/static/c5/c5ef96bc-30ab-456a-b3d5-a84f367c6a46.svg
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: HTTP/1.1
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d89405054b0eccfd66baa763bf4781b8dff83824636284b79800ecdc25579f1

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 3GoWmPpnzFDs5CP3.ebHbCmhALWQMuvH
Content-Encoding: gzip
Via: 1.1 varnish
Date: Mon, 16 Oct 2023 11:42:22 GMT
x-amz-request-id: C1HQGJD0TG08YQ1R
Age: 58
X-Cache: HIT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 1502
x-amz-id-2: IqZCATUvXib4os3ZsGEZo/FfUsWuv0jfVwwf1VVuFUQAYKRvEQZ5hxhOi7s8VL222Vg6PyzwjOg=
X-Served-By: cache-yyz4558-YYZ
Last-Modified: Sun, 10 Jun 2018 13:23:55 GMT
Server: AmazonS3
X-Timer: S1697456542.150348,VS0,VE0
ETag: "11d8569a7da0739259e3ac0b0d666e94"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
abp: 69
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Cache-Hits: 10

GET
H2 200 userx.20231015-3-RELEASE.es6.js Show response
cdn.taboola.com/libtrc/ Frame 6CFD 17 KB
6 KB 19ms
18ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/userx.20231015-3-RELEASE.es6.js
Requested by: Host: cdn.taboola.com
URL: http://cdn.taboola.com/libtrc/ynet-babamailarticles/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 336bc80c3c562401ccfe75bfa1873a4536837b926aaf7b82cd9b0d80b8425167

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: hRQ3g8IiDJ.Axs9Icbb_QEW690FmNili
content-encoding: gzip
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:22 GMT
x-amz-request-id: MN5ZMHT6ZAF0CNV6
age: 3013
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: PENDING
content-length: 5398
x-amz-id-2: NO0oN2jXSwnulFZMNhT+JD5pLbQzsWgTPMMdii1YJn2S5kxwy4CrUeLcnLMliex1Kn2Sx3uD50I=
x-served-by: cache-yyz4523-YYZ
last-modified: Mon, 16 Oct 2023 10:52:09 GMT
server: AmazonS3
x-timer: S1697456542.151654,VS0,VE0
etag: "168539d90a015fdcd648b5314510ac0a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
abp: 45
access-control-allow-origin: *
cache-control: private,max-age=2629743
accept-ranges: bytes
x-cache-hits: 284

GET
H2 204 abtests
ch-trc-events.taboola.com/ynet-babamailarticles/log/3/ Frame 6CFD 0
505 B 37ms
36ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/ynet-babamailarticles/log/3/abtests?route=US:CH:V&tvi48=10638&tvi50=9058&lti=deflated&ri=a25a4afeaa990835779158f443e18457&sd=v2_1a73f8a6ea56b0156472fab70afd3454_ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c_1697456540_1697456540_CNawjgYQyKdZGL6ZrcKzMSABKAEwJjiJ6AdAsvEHSOzZ2ANQ____________AVgAYABooKCVq-PzhYw8cAE&ui=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&pi=/&wi=-3676633171463953713&pt=text&vi=1697456540862&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1697456542132%7D&tim=04%3A42%3A22.132&id=3977&llvl=2&cv=20231015-3-RELEASE&
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Mon, 16 Oct 2023 11:42:22 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

GET
H2 200 287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
images.taboola.com/taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame 6CFD 12 KB
13 KB 27ms
27ms Image
image/webp 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.taboola.com/taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231015-3-RELEASE.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: b6abe96ef57e5da94e9d6e2a6f99d5e81f19f8618c99e072917ef38a50f5984b

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-vcl-time-ms: 0
date: Mon, 16 Oct 2023 11:42:22 GMT
via: 1.1 varnish, 1.1 varnish
x-debug: /taboola/image/fetch/h_180,w_360,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/287e7e5e5b2af5ad4cfb0dfc3b254ab2.jpg
age: 940586
edge-cache-tag: 305739624204443205665925302523284571015,581020326624456120581803963053862324929,29ecf9b93bbf306179626feeda1fab70
cache-tag: 305739624204443205665925302523284571015,581020326624456120581803963053862324929,29ecf9b93bbf306179626feeda1fab70
x-cache: HIT, HIT, HIT, HIT
x-envoy-upstream-service-time: 136
expiration: expiry-date="Wed, 11 Oct 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer: https://www.manchestereveningnews.co.uk/sport/football/man-united-news-ten-hag-27842901
content-length: 12456
x-backend-name: CH_nlb801
x-served-by: cache-iad-kjyo7100061-IAD, cache-iad-kiad7000067-IAD, cache-iad-kcgs7200037-IAD, cache-yyz4523-YYZ
last-modified: Sun, 10 Sep 2023 12:59:46 GMT
server: nginx
surrogate-reporting: width=360,height=180,owidth=1067,oheight=600,obytes=280324
x-timer: S1697456542.161699,VS0,VE0
etag: "fb64304cca8cb80eb0957249862e074c"
x-ratelimit-remaining: 100
vary: ImageFormat
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
x-ratelimit-reset: 1
x-ratelimit-limit: 101
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: X-Requested-With
x-cache-hits: 1, 1, 129, 13

GET
H2 204 debug
ch-trc-events.taboola.com/ynet-babamailarticles/log/2/ Frame 6CFD 0
89 B 38ms
38ms Image
text/plain 141.226.124.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ch-trc-events.taboola.com/ynet-babamailarticles/log/2/debug?tim=04%3A42%3A22.162&type=warn&msg=TRC.TranslationsManager%20-%20missing%20feature%20in%20translationMap%3A%20userx.&llvl=2&id=8723&cv=20231015-3-RELEASE&lt=deflated&pct=1
Requested by: Host: www.baba-mail.co.il
URL: http://www.baba-mail.co.il/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.124.48 Chicago, United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:22 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 15400

GET
DATA 200
OK truncated
/ Frame 6CFD 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14a8112866d6d30b1313612bafa49b9d4cac4418277d4ebf2e692f6a1f1ab8a3

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 6CFD 0
0 98ms
97ms Fetch
image/gif 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvkzbViRzfrt7gvda-zw2FTGyAvgDGWwn5Z-91gdzUzA7Ywp4Y-2iBfjBzUDa-fndRvJgao6yvzr8vJjMLaAIxmnd0Gmi7rFG0C0qjIZi0Pfr-gl5KCu_onZmR5ImdCbUI_BwiPfLdGMbx-_rQN1q1vsDS3tL3v6bJmtF3TcSEputpil60jgPEI3fyq_zt_CsUm2jAGruFrRZD0feX7V3CFGgeQ5_-ZMK1fChy_jeCscYi8hWZCwzCfkJO6_k5tCVhBt70oASFuqw60xIZVdopwL900DGQayKFt1kwIdrIy-Db1dOMtB0oIKn9QOGOgqeMqI2SIZPU-FRpBtfsKvt7QXYiejfJscBwvJudr7EJhxMk&sai=AMfl-YSkMRfIvaTA_6pLyFyCbbZyK7pdWP-0ZSChtItlh3MdJwwY8wKw819MwFieb0yNgIFGliDYja2HSK_A3GqcpNNf1Ic1W31oAYoetvLaUhWGYuWwSzBcbD_-htW9WB0KR6hxVqHJh3Voy-ICQBM&sig=Cg0ArKJSzPrhFuGrhS4xEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 11:42:22 GMT

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 95ms
95ms Preflight
text/html 142.251.16.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CMTQqnCEtZdn_OsTP_gTxrJq4BengqMNzjN21xMcRwJCe9osOEAEgmfugK2D9oJmB6AOgAaqC8NwByAEJ4AIAqAMByAMCqgS8Ak_QQEOUbiZ-_lgPijz2MB6GRKLY_s-X0mHKK7X0V-u6Qr-8y2BjpHjlKEoSBLtznHV_y4oS2AjUXyvpJYUsHmFyBX7y0Wc72I3DBRw8vgoZyEiSmyOgBHctJElSOMJ-e8SeJHPhJwk861RmiTWZiDM5Jh5G70Pj2bat07oTBzaPD42QwfoBtG9kG_ZpYj58lbtW9z8zA5I0ZqRHkBc-KbhP88mgUmj5B1rhztymHxTHOcNtjB2Ku-wX7bgHPoCjHuKpHjhsSlCPkigpBJCD_TsAMFmBHWuMKZIm2gkEXUFdeQBjhaS1myAYNySr-093D6lMpicD75BRuYx0UeeSNGlzUx7L1L9HFancLFYNtJoUTN_XDu_rHWSc9oNLRf-8e65saqTg2ogVkEkPGIyw1Gg8-IFy_VW-sLNDIcHABPmDzJa_BOAEAYgFz66itEySBQQIBBgBkgUECAUYBKAGXYAHvv2PowKoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBC5xBDSCBQIgGEQARgdMgKKAjoCgEBIvf3BOpoJowFodHRwczovL3lvZ2EtZ28uaW8_YnJhbmNoLW5hbWU9Y2hhaXImdGVzdC1uYW1lPWdvNHFwbSZ1dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZjYW1wYWlnbl9pZD0yMDUxMDcwOTU4MyZhZGdyb3VwX2lkPTE1NDM5Nzc3MDIzMyZhZF9pZD02NzYwMjU4MzY5NDcmdXRtX3Rlcm09gAoDyAsB2gwQCgoQkKzSvtu0m55QEgIBA-INEwiTx82vvvqBAxXEp58KHXGWBlfYEwzQFQGYFgGAFwGyFx4KHAgAEhRwdWItNDIwNzY1Nzk3MTEyNjkzMBi5sw0&sigh=F9skvDUutV4&uach_m=[UACH]&ase=2&nis=4&cid=CAQSSwDICaaNCcip04a1of8Ese8IN2lydodRPTCRXH16BgCzsPWKqZXU_FgdAn94EE3FKypasCMABb6oR8yio29as4CgNQUcoJ3eftICbRgB&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 11:42:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 7914
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CMTQqnCEtZdn_OsTP_gTxrJq4BengqMNzjN21xMcRwJCe9osOEAEgmfugK2D9oJmB6AOgAaqC8NwByAEJ4AIAqAMByAMCqgS8Ak_QQEOUbiZ-_lgPijz2MB6GRKLY_s-X0mHKK7X0V-u6...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1...

0
0

93ms
93ms

Fetch
text/css

142.251.167.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1f1dc84c6c70000000000000000%22,%224%22:%220xd1fc2155e50607eb0000000000000000%22,%225%22:%220x9c8930349812dea10000000000000000%22},%22debug_key%22:%22569410799938624471%22,%22debug_reporting%22:true,%22destination%22:%22https://yoga-go.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22463208746%22],%224%22:[%2210-16%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22574204669814859601%22}&andc=true

Protocol

Server

142.251.167.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x98b03cc5444c2c7c0000000000000000","2":"0xfd65cb585d4c6d650000000000000000","3":"0x5199b1f1dc84c6c70000000000000000","4":"0xd1fc2155e50607eb0000000000000000","5":"0x9c8930349812dea10000000000000000"},"debug_key":"569410799938624471","debug_reporting":true,"destination":"https://yoga-go.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["463208746"],"4":["10-16"],"6":["true"]},"priority":"500","source_event_id":"574204669814859601"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 16 Oct 2023 11:42:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 16 Oct 2023 11:42:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x98b03cc5444c2c7c0000000000000000","2":"0xfd65cb585d4c6d650000000000000000","3":"0x5199b1f1dc84c6c70000000000000000","4":"0xd1fc2155e50607eb0000000000000000","5":"0x9c8930349812dea10000000000000000"},"debug_key":"569410799938624471","debug_reporting":true,"destination":"https://yoga-go.io","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["463208746"],"4":["10-16"],"6":["true"]},"priority":"500","source_event_id":"574204669814859601"}&andc=true
access-control-allow-origin: https://c8222745382eaf5bbe821fc6ad2b0201.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 92ms
92ms Preflight
text/html 142.251.167.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x98b03cc5444c2c7c0000000000000000%22,%222%22:%220xfd65cb585d4c6d650000000000000000%22,%223%22:%220x5199b1f1dc84c6c70000000000000000%22,%224%22:%220xd1fc2155e50607eb0000000000000000%22,%225%22:%220x9c8930349812dea10000000000000000%22},%22debug_key%22:%22569410799938624471%22,%22debug_reporting%22:true,%22destination%22:%22https://yoga-go.io%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22463208746%22],%224%22:[%2210-16%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22574204669814859601%22}&andc=true

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 16 Oct 2023 11:42:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rtb-h
sync.taboola.com/sg/supershiprtb-display-network/1/ Frame 68E5
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=taboola
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZS0hn8Co8YUAAEL3db4AAAAA

0
373 B

37ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZS0hn8Co8YUAAEL3db4AAAAA
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 33147

Redirect headers

X-SO-Cluster-ID: 0
Date: Mon, 16 Oct 2023 11:42:23 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=taboola","cluster_id":0,"gdpr":false,"ipv4":"62.3.36.16","key":"ZS0hn8Co8YUAAEL3db4AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad281"}
X-SO-Key: ZS0hn8Co8YUAAEL3db4AAAAA
Server: nginx
X-SO-Upstream-ID: m-ad281
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZS0hn8Co8YUAAEL3db4AAAAA
Cache-Control: private
X-SO-HostName: m-ad281.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 2
Content-Length: 0
X-SO-LB-Hostname: m-tgng33.dc4p.scaleout.jp
X-SO-IP: 62.3.36.16

GET
H2

204

/
sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__
https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=fcbead29287b4155a6...
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=fcbead29287b4155a6783433f318b1ef

0
364 B

37ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=fcbead29287b4155a6783433f318b1ef
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 29082

Redirect headers

location: https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=fcbead29287b4155a6783433f318b1ef
date: Mon, 16 Oct 2023 11:42:23 GMT
content-length: 0

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 68E5 0
0 250ms
34ms Image
text/html 216.22.16.37
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 216.22.16.37 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H2

200

/
sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=16698
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LNSTSR8C-14-2MUU

0
373 B

38ms
38ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LNSTSR8C-14-2MUU
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 20835

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LNSTSR8C-14-2MUU
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 368ba1c92c09ff88b641150fbbf94341
Expires: 0

GET
H2

200

/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/taboola/ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c?gdpr=0&gdpr_consent=&us_privacy=
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-MuJVNvtE2oQb__kDvByyLJhS.aYnuQhCSlXOMQ--~A

0
373 B

38ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-MuJVNvtE2oQb__kDvByyLJhS.aYnuQhCSlXOMQ--~A
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 20835

Redirect headers

date: Mon, 16 Oct 2023 11:42:23 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-MuJVNvtE2oQb__kDvByyLJhS.aYnuQhCSlXOMQ--~A
content-length: 0

GET
H2

200

/
sync.taboola.com/sg/baidurtb-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://trace.mediago.io/ju/cs/taboola
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=f85ea03563363a9d21enlp00lnstsr7s

0
373 B

38ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=f85ea03563363a9d21enlp00lnstsr7s
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 20835

Redirect headers

date: Mon, 16 Oct 2023 11:42:23 GMT
via: 1.1 google
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
location: https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=f85ea03563363a9d21enlp00lnstsr7s
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

/
sync.taboola.com/sg/google-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
https://sync.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECDY-lOdXF0biCe8V4IRi7Q&google_cver=1

0
373 B

37ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECDY-lOdXF0biCe8V4IRi7Q&google_cver=1
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 20835

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:23 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESECDY-lOdXF0biCe8V4IRi7Q&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 305
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 68E5 42 B
245 B 92ms
30ms Image
image/gif 162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c:$UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Mon, 16 Oct 2023 11:42:21 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 68E5
Redirect Chain

https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c

170 B
243 B

49ms
49ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c
date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 18648

GET
H2

200

/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=f2b0b3bc-ed3f-47a8-a105-9aaaa0495c29

0
385 B

33ms
33ms

Image
text/plain

151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=f2b0b3bc-ed3f-47a8-a105-9aaaa0495c29
Protocol: H2
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-vcl-time-ms: 15
date: Mon, 16 Oct 2023 11:42:23 GMT
via: 1.1 varnish
x-served-by: cache-yyz4523-YYZ
server: nginx
x-timer: S1697456543.293505,VS0,VE15
x-fastly-to-nlb-rtt: 13608
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-service-version: v1
x-cache-hits: 0

Redirect headers

location: https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=f2b0b3bc-ed3f-47a8-a105-9aaaa0495c29
date: Mon, 16 Oct 2023 11:42:23 GMT
server: Kestrel
content-length: 239

GET
H2 200 rtset
bh.contextweb.com/bh/ Frame 68E5 49 B
692 B 107ms
35ms Image
image/gif 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-7ff97786c7-f4qxk
expires: -1

GET
H2

200

/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%...
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=5cc14efa-33aa-43a6-a9a4-78773484982e&gdpr=0&gdpr_consent=&us_privacy=

0
373 B

40ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=5cc14efa-33aa-43a6-a9a4-78773484982e&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 21781

Redirect headers

pragma: no-cache
date: Mon, 16 Oct 2023 11:42:23 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=5cc14efa-33aa-43a6-a9a4-78773484982e&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1302013
content-length: 0
expires: Mon, 16 Oct 2023 00:00:00 GMT

GET
H2

200

/
sync.taboola.com/sg/id5-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://id5-sync.com/s/464/9.gif?puid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
https://id5-sync.com/c/464/464/7/1.gif?puid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=f2b0b3bc-ed3f-47a8-a105-9aaaa0495c29&ttl=%%TTL%%
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F5%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/464/441/5/3.gif?puid=u_f8f5d2ca-0ff6-4404-8bfc-42846ee367e9&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F4%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F4%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0&rdf=1
https://id5-sync.com/c/464/429/4/4.gif?puid=3C61D81B-5B23-4FCB-BA5D-A5BA7F9D1043&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F434%2F3%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/464/434/3/5.gif?puid=3d165e20-8d66-415c-9b5d-4ece842363b3&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F108%2F2%2F6.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F108%2F2%2F6.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gd...
https://id5-sync.com/c/464/108/2/6.gif?puid=b45fdd18-1e2b-4468-ac77-19a4822b100d&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F1%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/464/112/1/7.gif?puid=DB534081BFC9A70B&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/0/8.gif?puid=$UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F464%2F2%2F0%2F8.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/464/2/0/8.gif?puid=7969772602252830386&gdpr=0&gdpr_consent=
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-908fLh3BFd2mttd9jnYO5MPSvZZgCsAxjGeUWxFjGg

0
373 B

38ms
38ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-908fLh3BFd2mttd9jnYO5MPSvZZgCsAxjGeUWxFjGg
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:25 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 28838

Redirect headers

location: https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-908fLh3BFd2mttd9jnYO5MPSvZZgCsAxjGeUWxFjGg
date: Mon, 16 Oct 2023 11:42:25 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2

200

rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 68E5
Redirect Chain

https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=taboola&bsw_custom_parameter=7912f7c2-d510-4368-ad12-618e4c38652b&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=taboola&bsw_custom_parameter=7912f7c2-d510-4368-ad12-618e4c38652b&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=ee81bc69-32a6-4024-a425-cf5d6ba05ac8&ssp=taboola&expires=30&user_group=5&bsw_param=7912f7c2-d510-4368-ad12-618e4c38652b
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=7912f7c2-d510-4368-ad12-618e4c38652b&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

0
373 B

38ms
38ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=7912f7c2-d510-4368-ad12-618e4c38652b&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 31327

Redirect headers

Location: //sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=7912f7c2-d510-4368-ad12-618e4c38652b&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Date: Mon, 16 Oct 2023 11:42:23 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame 68E5
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=taboola
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1c075fe9-f06f-4acf-ad98-d12860a91e2b
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1c075fe9-f06f-4acf-ad98-d12860a91e2b&tbid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&query=taboola_hm%3D1c075fe9-f06f-...

0
59 B

42ms
41ms

Image
text/plain

151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1c075fe9-f06f-4acf-ad98-d12860a91e2b&tbid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&query=taboola_hm%3D1c075fe9-f06f-4acf-ad98-d12860a91e2b&isDirect=0
Protocol: H2
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-cache-hits: 0
date: Mon, 16 Oct 2023 11:42:23 GMT
via: 1.1 varnish
server: nginx
x-timer: S1697456543.488655,VS0,VE20
x-cache: MISS
accept-ranges: bytes
content-length: 0
x-served-by: cache-yyz4523-YYZ

Redirect headers

location: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=1c075fe9-f06f-4acf-ad98-d12860a91e2b&tbid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&query=taboola_hm%3D1c075fe9-f06f-4acf-ad98-d12860a91e2b&isDirect=0
date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 28009

GET
H2

200

xuid
eb2.3lift.com/ Frame 68E5
Redirect Chain

https://eb2.3lift.com/xuid?mid=7772&xuid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&dongle=tbla&gdpr=0&gdpr_consent=&us_privacy=
https://eb2.3lift.com/xuid?ld=1&mid=7772&xuid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&dongle=tbla&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

43ms
42ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7772&xuid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&dongle=tbla&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

content-type: image/gif
date: Mon, 16 Oct 2023 11:42:23 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7772&xuid=ff9ede69-febf-4415-8b00-b3bc4a766628-tuctc26a71c&dongle=tbla&gdpr=0&cmp_cs=&us_privacy=
date: Mon, 16 Oct 2023 11:42:23 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/ Frame 68E5
Redirect Chain

https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Fr...
https://u.openx.net/w/1.0/cm?cc=1&gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F...
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=b7375cfd-08fa-0237-2f44-26492df11390

0
373 B

37ms
37ms

Image
text/plain

141.226.224.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=b7375cfd-08fa-0237-2f44-26492df11390
Protocol: H2
Server: 141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 16 Oct 2023 11:42:23 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 25384

Redirect headers

date: Mon, 16 Oct 2023 11:42:23 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=b7375cfd-08fa-0237-2f44-26492df11390
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 cds-pips.js Show response
cdn.taboola.com/scripts/ Frame 751A 3 KB
2 KB 19ms
19ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/cds-pips.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: z5FoayaLm_Bvew3pbkytkoHczFCvkPwT
content-encoding: gzip
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:23 GMT
x-amz-request-id: 345CDBWW70P2J4KQ
age: 1279
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 1340
x-amz-id-2: RXZ9eF1pCd0CDN+zmZsBdUvWy9zP/THQYOkdE0w5cIOOD+5zdquMw/vB8dFwYkBREq+fn3ZvR+o=
x-served-by: cache-yyz4523-YYZ
last-modified: Wed, 12 Oct 2022 13:57:57 GMT
server: AmazonS3
x-timer: S1697456543.076517,VS0,VE0
etag: "383fa66d2a0a09f4a6e64a9593ad43bb"
vary: Accept-Encoding
content-type: application/javascript
abp: 88
access-control-allow-origin: *
cache-control: private, max-age=3600
accept-ranges: bytes
x-cache-hits: 1775

GET
H2 200 eid.es5.js Show response
cdn.taboola.com/scripts/ Frame 751A 17 KB
7 KB 20ms
20ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/eid.es5.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: Bqo64Ai0BniIkPPSnUb8_cZLJGu.sClo
content-encoding: gzip
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:23 GMT
x-amz-request-id: F0ERNPAEKW73Z8P2
age: 1562
x-amz-server-side-encryption: AES256
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 6467
x-amz-id-2: plsZvdnyCt2i8Bpor4XZ/Hw8FQ82hV+hAUU7z72e8PcCioobdkLHvDkUimb10ggYrfGsRVEk5hI=
x-served-by: cache-yyz4523-YYZ
last-modified: Sun, 02 Apr 2023 13:09:57 GMT
server: AmazonS3
x-tbl-debug: bestatus=200,beresp=OK
x-timer: S1697456543.076503,VS0,VE0
etag: "2fdf3e79d5e851201a0d52a886453d8b"
vary: Accept-Encoding
content-type: application/javascript
abp: 35
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
x-cache-hits: 1745

GET
H2 200 fraud-detect.js Show response
cdn.taboola.com/scripts/ Frame 751A 121 B
497 B 20ms
20ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/scripts/fraud-detect.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20231008-7_b5-PR-62456-DEV-144718-block-clicks-experiment-for-blocking-subsequent-fast-clicks-409faea3c61.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: vOXBAr_FxKHpU348.XTQhP6DWnVyKple
content-encoding: gzip
via: 1.1 varnish
date: Mon, 16 Oct 2023 11:42:23 GMT
x-amz-request-id: S9J5BFAA7WPTMDGJ
age: 390
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 125
x-amz-id-2: wWtPRy+nUtfHDp77gPzlWCF3v6EWhngazARKv0aGBw+bq/wfsPbkn4AZ0roXloZfIZagWP16wbs=
x-served-by: cache-yyz4523-YYZ
last-modified: Thu, 15 Dec 2022 16:50:08 GMT
server: AmazonS3
x-timer: S1697456543.076490,VS0,VE0
etag: "f7a185d92ac2162dc0bc36c5d7ef7dfe"
vary: Accept-Encoding
content-type: application/javascript
abp: 13
access-control-allow-origin: *
cache-control: private,max-age=14400
accept-ranges: bytes
x-cache-hits: 464

GET
H2 200 / Show response
pips.taboola.com/ Frame 751A 4 B
181 B 59ms
19ms XHR
text/plain 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pips.taboola.com/
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: fb329000228cc5a24c264c57139de8bf854fc86fc18bf1c04ab61a2b5cb4b921

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-served-by: cache-yyz4528-YYZ
date: Mon, 16 Oct 2023 11:42:23 GMT
via: 1.1 varnish
server: Varnish
access-control-allow-methods: GET
x-cache: HIT
access-control-allow-origin: http://www.baba-mail.co.il
cache-control: no-store
accept-ranges: bytes
content-length: 4
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ Frame 6CFD 254 B
1 KB 20ms
20ms Image
image/png 151.101.129.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Protocol: HTTP/1.1
Server: 151.101.129.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

accept-language: en-CA,en;q=0.9
Referer: http://www.baba-mail.co.il/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
Date: Mon, 16 Oct 2023 11:42:23 GMT
Via: 1.1 varnish
x-amz-request-id: C4YX393BV63BMCS9
Age: 14841
X-Cache: HIT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 254
x-amz-id-2: hJZ9rVKYX0/8YTS367+n1JLWaWxjxwlUGV9luK6w6nrhJtmZXbtiGq/h5BjCJKdhOOZFYFppGpg=
X-Served-By: cache-yyz4558-YYZ
Last-Modified: Wed, 24 Jun 2015 07:14:11 GMT
Server: AmazonS3
x-amz-meta-s3cmd-attrs: uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
X-Timer: S1697456543.176453,VS0,VE0
ETag: "dfa7b52c86e56bd67fa4002f6ed19854"
Content-Type: image/png
abp: 29
Access-Control-Allow-Origin: *
Cache-Control: private,max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 569

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7914 42 B
64 B 96ms
96ms Fetch
image/gif 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuEyuhvTU53J7gcLXDBQYQd1WgpbU_CjbzBKa9a-GgI_FZCBN1yf5CNgTrxtftsqYMvTrCWEMZk9jvIw1gNYlU_qG44Ov5D2Nd0cOhSk9L7CvqJ9Lxygrx7axAk-x8o6Csuf-drgAlCoQ&sai=AMfl-YRXgAUxDsoRC4g9rDXLQ9vSpU5gkzK49oPm5xGdC1aFxxp-wENUpS2K6EnnOQEAojQl8SxXp3itYeEBcBoCQOVgMlcYcWJ074HRhG9X1QInmqPhNJmn6Cx_Xxzl37tZ8bfBAzhypU7iD2By&sig=Cg0ArKJSzBksZKYH7LOrEAE&cid=CAQSSwDICaaNCcip04a1of8Ese8IN2lydodRPTCRXH16BgCzsPWKqZXU_FgdAn94EE3FKypasCMABb6oR8yio29as4CgNQUcoJ3eftICbRgB&id=lidar2&mcvt=1000&p=146,1440,746,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231011&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=647338911&rs=4&la=0&cr=0&vs=4&r=v&rst=1697456541388&rpt=966&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.156 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS