downfile.site Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://get.megafly.in/H1niYNIw
Effective URL:
https://downfile.site/
Submission: On June 10 via manual (June 10th 2023, 6:39:57 pm UTC) from US — Scanned from NL

Summary HTTP 159 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 22 IPs in 5 countries across 21 domains to perform 159 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is downfile.site.
TLS certificate: Issued by E1 on May 7th 2023. Valid for: 3 months.

This is the only time downfile.site was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 57	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:8d::84 2a04:4e42:8d::84	54113 (FASTLY) (FASTLY)
1 4	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	23.109.82.119 23.109.82.119	7979 (SERVERS-COM) (SERVERS-COM)
5	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
22	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	167.172.77.229 167.172.77.229	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
13	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
29	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.198 172.217.16.198	15169 (GOOGLE) (GOOGLE)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1 6	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:93ca:31d8:d86e:38f6	16509 (AMAZON-02) (AMAZON-02)
1 1	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 2	2606:4700::68... 2606:4700::6812:19ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
1 1	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
2	172.217.16.195 172.217.16.195	15169 (GOOGLE) (GOOGLE)
1	167.172.77.196 167.172.77.196	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
159	22

1 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

get.megafly.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2a06:98c1:3121::3 (United States) 5 redirects

ASN13335 (CLOUDFLARENET, US)

get.megafly.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.megafly.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
downfile.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:8d::84 (United States)

ASN54113 (FASTLY, US)

i.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.109.82.119 (Netherlands)

ASN7979 (SERVERS-COM, US)

printsmull.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.77.229 (Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

api.trackpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f198.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:93ca:31d8:d86e:38f6 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.132.245 (United Kingdom) 1 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:19ad (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.74.118 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

ius.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f3.1e100.net

p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.77.196 (Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

pushtimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	downfile.site 4 redirects downfile.site	378 KB
48	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 127 tpc.googlesyndication.com — Cisco Umbrella Rank: 154	651 KB
21	doubleclick.net 2 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 54 ad.doubleclick.net — Cisco Umbrella Rank: 182 cm.g.doubleclick.net — Cisco Umbrella Rank: 248	201 KB
14	gstatic.com fonts.gstatic.com www.gstatic.com p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com	217 KB
7	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3 adservice.google.com — Cisco Umbrella Rank: 106	4 KB
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67	6 KB
5	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	274 KB
3	megafly.in 2 redirects get.megafly.in go.megafly.in	3 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 851 s.tribalfusion.com — Cisco Umbrella Rank: 1995	1 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 1017 r.turn.com — Cisco Umbrella Rank: 3884	869 B
1	pushtimize.com pushtimize.com — Cisco Umbrella Rank: 145172	59 KB
1	ctnsnet.com 1 redirects ius.ctnsnet.com — Cisco Umbrella Rank: 7720	624 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 953	718 B
1	everesttech.net 1 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 748	540 B
1	mathtag.com 1 redirects sync.mathtag.com — Cisco Umbrella Rank: 548	730 B
1	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 817	465 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1086	601 B
1	trackpush.com api.trackpush.com — Cisco Umbrella Rank: 100840	23 KB
1	printsmull.com printsmull.com	2 KB
1	pinimg.com i.pinimg.com — Cisco Umbrella Rank: 2304	78 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 993	20 KB
159	21

	Domain	Requested by
55	downfile.site	4 redirects get.megafly.in downfile.site www.google.com
29	tpc.googlesyndication.com	pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
19	pagead2.googlesyndication.com	downfile.site get.megafly.in pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
13	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
7	www.gstatic.com	googleads.g.doubleclick.net
6	cm.g.doubleclick.net	1 redirects googleads.g.doubleclick.net
6	fonts.googleapis.com	downfile.site googleads.g.doubleclick.net
5	www.googletagservices.com	googleads.g.doubleclick.net
5	fonts.gstatic.com	fonts.googleapis.com
4	www.google.com	1 redirects get.megafly.in tpc.googlesyndication.com googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com
2	p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com
2	ad.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	get.megafly.in	1 redirects
1	pushtimize.com	downfile.site
1	ius.ctnsnet.com	1 redirects
1	um.simpli.fi	1 redirects
1	sync-tm.everesttech.net	1 redirects
1	s.tribalfusion.com
1	a.tribalfusion.com	1 redirects
1	sync.mathtag.com	1 redirects
1	cms.quantserve.com	googleads.g.doubleclick.net
1	r.turn.com	googleads.g.doubleclick.net
1	ad.turn.com	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	api.trackpush.com	get.megafly.in
1	printsmull.com	downfile.site
1	go.megafly.in	1 redirects
1	i.pinimg.com	get.megafly.in
1	maxcdn.bootstrapcdn.com	get.megafly.in
159	30

This site contains links to these domains. Also see Links.

Domain
generatepress.com
gpsites.co

Subject Issuer	Validity	Valid
megafly.in GTS CA 1P5	`2023-05-23` - `2023-08-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-12-30` - `2023-12-30`	a year	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-28` - `2023-08-08`	a year	crt.sh
downfile.site E1	`2023-05-07` - `2023-08-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
printsmull.com R3	`2023-05-01` - `2023-07-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
*.trackpush.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-11` - `2023-06-29`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.pushtimize.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-11` - `2023-06-29`	a year	crt.sh

This page contains 22 frames:

Primary Page: https://downfile.site/
Frame ID: FD073A782E5BD1C90FC1D23A36480337
Requests: 63 HTTP requests in this frame

Frame: https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js
Frame ID: DA4F4C28A6B1672B59BF1B2F3A4EAB13
Requests: 3 HTTP requests in this frame

Frame: https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js
Frame ID: C4E6C150FDDE0FDEE18DE864BAF39E99
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20190131/zrt_lookup.html
Frame ID: A13F9D610F5EDA42F99A0DBEE3086B66
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&adk=1812271804&adf=3025194257&lmt=1686422391&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fdownfile.site%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390657&bpp=8&bdt=480&idt=463&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5878854364812&frm=20&pv=2&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&fsapi=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=484
Frame ID: 14095D4F04C3F09E602F3B0BDED0BC65
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=3468950800&adk=1423715733&adf=2653041513&pi=t.ma~as.3468950800&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390665&bpp=1&bdt=488&idt=484&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=65&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ml7Vqmz7B1&p=https%3A//downfile.site&dtd=492
Frame ID: EABE87C2EA6090D89F8E0D00B1EBB484
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=200&slotname=7515226464&adk=2849340346&adf=785635387&pi=t.ma~as.7515226464&w=1200&fwrn=4&lmt=1686422391&rafmt=11&format=1200x200&url=https%3A%2F%2Fdownfile.site%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390666&bpp=1&bdt=489&idt=497&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=367&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TNRQ24C9W3&p=https%3A//downfile.site&dtd=501
Frame ID: DEC96309F97A4A36933B8EDB4BED2594
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=9791897833&adk=1958193327&adf=2602375796&pi=t.ma~as.9791897833&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390667&bpp=1&bdt=491&idt=502&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x200&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=613&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&fsb=1&xpc=tSsK3x24yS&p=https%3A//downfile.site&dtd=505
Frame ID: FE93889B843CC9A1CDBB1D43BDEAAF05
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=600&adk=930274632&adf=806768345&pi=t.aa~a.3529635075~rp.3&w=258&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&to=qs&pwprc=5667035941&format=258x600&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422391960&bpp=1&bdt=1783&idt=0&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc001ee1e439609c2-221fe09950e100ae%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw&gpic=UID%3D00000c46928c2e21%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw&prev_fmts=0x0%2C1200x280%2C1200x200%2C1200x280&nras=2&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1090&ady=1242&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=1&fsb=1&xpc=utgo0UyTt8&p=https%3A//downfile.site&dtd=5
Frame ID: 0C5F725C4CAA478BB1DEEC7350BF5736
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1
Frame ID: F8AF459AAAA366DC697228F93D06DA80
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js
Frame ID: 4DBBBC4F0300049597CE4500D98E0754
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1BDC7C7329915E69C6C9D0C6B0B3766A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 34ABDADF267D8D4D2A17FD37D2159DA7
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js
Frame ID: 7977A68CA895A15E9C4643920EAF130C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js
Frame ID: B5B15727B6622200FDAB41111FD1BFC7
Requests: 1 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 1D5394F7564274BB08E1B72E099C65B2
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: E720D3D04C9B1E5F85A0AA454D595663
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js
Frame ID: F2056EA75621E52574CEBF9D01509AAB
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: CFFEA58151E4C1626D34A7D1635E7788
Requests: 9 HTTP requests in this frame

Frame: https://p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 8B23C01C837B5C3EEC03E876CFBE87BB
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js
Frame ID: A597D36149757AD7FD8507D6237D3B17
Requests: 1 HTTP requests in this frame

Frame: https://pushtimize.com/images/intro-img.png
Frame ID: 56F8F07D378228394E9D833F86345D08
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DOWNFILE - Learn what is Vulnerability and read more latest new

Page URL History Show full URLs

http://get.megafly.in/H1niYNIw HTTP 301
https://get.megafly.in/H1niYNIw Page URL
https://go.megafly.in/H1niYNIw HTTP 302
http://downfile.site/verify/?/H1niYNIw HTTP 301
https://downfile.site/verify/?/H1niYNIw Page URL
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjWpsDh3NT-AhVcV2wGHeDEDHc... Page URL
https://downfile.site/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

159
Requests

94 %
HTTPS

62 %
IPv6

21
Domains

30
Subdomains

22
IPs

5
Countries

1915 kB
Transfer

4711 kB
Size

29
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://generatepress.com/
Title: GeneratePress

Search URL Search Domain Scan URL

URL: https://gpsites.co/marketer/
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://get.megafly.in/H1niYNIw HTTP 301
https://get.megafly.in/H1niYNIw Page URL
https://go.megafly.in/H1niYNIw HTTP 302
http://downfile.site/verify/?/H1niYNIw HTTP 301
https://downfile.site/verify/?/H1niYNIw Page URL
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjWpsDh3NT-AhVcV2wGHeDEDHcQFnoECAoQAQ&url=https://downfile.site/&usg=AOvVaw1SZTvmPMlq65ypV9VmJNnu Page URL
https://downfile.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://get.megafly.in/H1niYNIw HTTP 301
https://get.megafly.in/H1niYNIw

Request Chain 3

https://go.megafly.in/H1niYNIw HTTP 302
http://downfile.site/verify/?/H1niYNIw HTTP 301
https://downfile.site/verify/?/H1niYNIw

Request Chain 5

https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

Request Chain 50

https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

Request Chain 53

https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

Request Chain 135

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 144

https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B30016034.368171683;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B30016034.368171683;dc_pre=CP-8oP2suf8CFa7juwgdbvYFHA;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1

Request Chain 149

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDUadj5B-MBpx-LRzIPcihc&google_cver=1&google_push=ATf1kGPryRhcAfnUPwooSizw-boNyE7W8RYE-wxa_YOXmkFMy86y7vkHqpD4fuxb6FZWLeFiuG2vpExAH-4eL8QwooKxxi_r_KFfaOs HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzk0OTM2Mzk2NDg2MjUwMTI2Mw==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDUadj5B-MBpx-LRzIPcihc&google_cver=1

Request Chain 151

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGiRfOtMLz3z4z1ctrN8948&google_cver=1&google_push=ATf1kGOOaytCs_RTET492dAxSwzirKQ4HGRioehx-AUf69BXHGVDll25X6jDLIGCiyph4osmCBnUMeeZ8F9M3AQLjFk0vsGJLgVk4FI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOOaytCs_RTET492dAxSwzirKQ4HGRioehx-AUf69BXHGVDll25X6jDLIGCiyph4osmCBnUMeeZ8F9M3AQLjFk0vsGJLgVk4FI

Request Chain 152

https://a.tribalfusion.com/i.match?p=b6&u=CAESEBjGCbS8VNZdkcIJoWoT43Q&google_cver=1&google_push=ATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEBjGCbS8VNZdkcIJoWoT43Q&google_cver=1&google_push=ATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 153

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEKaPSuy6HsYq9ZFREyhE45Y&google_cver=1&google_push=ATf1kGNJmtIlPiD3QG-N7ZKAX7MseherwwbJDxArwzOJg7VOZbg5VusHR7yqOLai2llF41mOSMj9G85IM6DrFbJ_tW6xCNl1jbDGFcY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKaPSuy6HsYq9ZFREyhE45Y&google_push=ATf1kGNJmtIlPiD3QG-N7ZKAX7MseherwwbJDxArwzOJg7VOZbg5VusHR7yqOLai2llF41mOSMj9G85IM6DrFbJ_tW6xCNl1jbDGFcY

Request Chain 154

https://um.simpli.fi/gp_match?google_gid=CAESEKBK89KBg9ZnkDO_m63JW-g&google_cver=1&google_push=ATf1kGNC6fQScTfiv24wHZu9D6sPLwv2IB6Yw01FkQnQr3KakblRPlPO3X4FuZwzI5YyPRnOlqVq62IxDXmuOo5755sZD3VsW8N7fcA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6A3488F9C75C48C58C7F56E4E7400DAB&google_push=ATf1kGNC6fQScTfiv24wHZu9D6sPLwv2IB6Yw01FkQnQr3KakblRPlPO3X4FuZwzI5YyPRnOlqVq62IxDXmuOo5755sZD3VsW8N7fcA

Request Chain 155

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESECx1eE2xLkCJcYMq3J5zcys&google_cver=1&google_push=ATf1kGMk0JqWNlO3xG4fMYG1qEHaSlR8-2eSIoJu9aHei3yS2lKUmPMgOechW9xwAmw85T0hgCEkJE6e1NRQtiiIQY_-ulIiAJxCwV9T HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGMk0JqWNlO3xG4fMYG1qEHaSlR8-2eSIoJu9aHei3yS2lKUmPMgOechW9xwAmw85T0hgCEkJE6e1NRQtiiIQY_-ulIiAJxCwV9T&google_hm=0yomNdsbSTCzA5_9OIJYXos

159 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

H1niYNIw Show response
get.megafly.in/
Redirect Chain

http://get.megafly.in/H1niYNIw
https://get.megafly.in/H1niYNIw

2 KB
2 KB

1840ms
1779ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.megafly.in/H1niYNIw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e19c38420301ea62122458a60d7e15f6ff0daec36501d0f00588a9798180b73b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7d53bd238fe9b91a-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 10 Jun 2023 18:39:46 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lxRUzwxQ3%2B3e9LB5xS0%2BSVoT0Z3syYHn1PWPAH4mvbW8rpafzQkVdLrceKTSsZXWfPZn0f3g9yFnQ1u33PpOjjr%2Fl%2B5zs%2Fz1emDq6yDaxDSmHPhYH6YvqKWmmdeexhmGUT%2BEemsfH2lmcSfUKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15768000;
vary: Accept-Encoding

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7d53bd206b320a6f-AMS
Connection: keep-alive
Content-Type: text/html
Date: Sat, 10 Jun 2023 18:39:45 GMT
Location: https://get.megafly.in/H1niYNIw
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qv%2B10mSPyAk2z5Qrx5FDQ2vfAhrMBWAH85tM6wEzSlS31VQkxCk1dXiT5KXreIJt2Vv3svfzvUm5w0Y107gHdWNCStzkmopU%2BN0nk6%2BwWOQzivwQYE00cvQ%2F3VKiSiPjurh%2Bb1aCQMeWxdKeHA%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 91ms
34ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://get.megafly.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 883
age: 19058835
cdn-cachedat: 07/01/2022 20:10:39
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:03:59 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
server: cloudflare
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 194a0a773c664e4cf2625133bcb6fcc4
timing-allow-origin: *
cdn-requestcountrycode: NL
cdn-status: 200
cf-ray: 7d53bd2f1c520e70-AMS
cdn-requestpullsuccess: True

GET
H2 200 912207f3b7e2120c417d73ebc411f949.png
i.pinimg.com/originals/91/22/07/ 78 KB
78 KB 106ms
35ms Image
image/png 2a04:4e42:8d::84
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.pinimg.com/originals/91/22/07/912207f3b7e2120c417d73ebc411f949.png
Requested by: Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:8d::84 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://get.megafly.in/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:47 GMT
x-cdn: fastly
etag: "a23b80d3b2fe7e23890f04d8ea414b90"
vary: Origin
content-type: image/png
cache-control: max-age=31536000, immutable
accept-ranges: bytes
alt-svc: h3=":443";ma=600
content-length: 80124

GET
H2

200

/ Show response
downfile.site/verify/
Redirect Chain

https://go.megafly.in/H1niYNIw
http://downfile.site/verify/?/H1niYNIw
https://downfile.site/verify/?/H1niYNIw

2 KB
2 KB

758ms
697ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/verify/?/H1niYNIw

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

feb7837d1424e6bf9cd7e591a1576f31a09c340087fe23d99928173e1ce0328a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://get.megafly.in/H1niYNIw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7d53bd350fd7b76c-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 10 Jun 2023 18:39:48 GMT
expires: -1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
referrer-policy: no-referrer no-referrer-when-downgrade no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RITGVQLL3jREy8DQxr%2F%2FE5qMZGb9CIodaMq7H0mAj0b5Eu5%2BjjD2Dk6c7zNhGsa4vqjm1SuDMxic95cKosFaVDO8s3kb1VpXrDaIB7DMOwWYnaZXywKTp11L772objMdLRSZlEgG%2F2I%2BVSqn"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-cache-age: 4910
x-cache-lifetime: 604800
x-cache-tags: 56d7
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: master-only
x-xss-protection: 1; mode=block

Redirect headers

CF-RAY: 7d53bd347ee50a67-AMS
Cache-Control: max-age=3600
Connection: keep-alive
Date: Sat, 10 Jun 2023 18:39:47 GMT
Expires: Sat, 10 Jun 2023 19:39:47 GMT
Location: https://downfile.site/verify/?/H1niYNIw
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kdLDYMJbb34pvQF63bzr4n1f8mylqqqgd0NBTyko5usKGtdUUzOs6fWfClMiaY7F0G4xG3sTDLkQQOjBoSgrsXFQsk%2BJa2fK59p8SnLPNDcUZclIa0VTr2GLr4X%2BFZUTqoJcsyaLDIFY7PRZ"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H2 200 rocket-loader.min.js
downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 29ms
28ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: downfile.site
URL: https://downfile.site/verify/?/H1niYNIw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 30 May 2023 15:21:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6476145d-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IDjjjFAOf4YyC8JEHpiG9h3kJSwhl0VgrdImWA0fLH2I1y7LYLTncoTFmu7fQusxkq7rs%2Be24oo1yABQQC7RTX%2BrUqS0uK2fPwRIVD96Kx628ZvJTBvIlhoEZjvpP0KIhwHgJpMfHX%2FB26h0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7d53bd397cc2b76c-AMS
expires: Mon, 12 Jun 2023 18:39:48 GMT

GET
H3

200

invisible.js
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/ Frame DA4F
Redirect Chain

https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js
https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

30 KB
13 KB

40ms
39ms

Script
application/javascript

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

Protocol

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:48 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OwwEWRA48RT5ET5utCCVPhcsjMO48N52YmxPdH5fH88Y3g5QyOoSKQpG3th5Hzgp8%2B7dweikUHD54XtM6ohBo1ya4AxjAn3B70Z7usa9USOhwK780bPA9Baj8hev21BTWWED4YryeO5wytuc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd39eb780b73-AMS
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 10 Jun 2023 18:39:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oUmFZc3V%2BU%2FQq2YVLBAOuCf9mq%2BGn4C8MJBVZ2PvdyoZuUBgT2%2Fuz8%2FuHthgvO4chssRTl5P%2FtYwXRa1C5iJT7mJoaFoiNK81xI%2BZlyClvrLwZOBPx5O%2FqFZNxsyZAfvbOXlPcKQWQ32pLEv"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js
cache-control: max-age=300, public
cf-ray: 7d53bd39bd04b76c-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 url
www.google.com/ 1 KB
2 KB 144ms
68ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjWpsDh3NT-AhVcV2wGHeDEDHcQFnoECAoQAQ&url=https://downfile.site/&usg=AOvVaw1SZTvmPMlq65ypV9VmJNnu

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-ocvq1DMToEMMw8uPzx122g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Bitness Sec-CH-UA-Full-Version-List Sec-CH-UA-WoW64
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 553
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-ocvq1DMToEMMw8uPzx122g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
content-type: text/html; charset=UTF-8
date: Sat, 10 Jun 2023 18:39:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
origin-trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy: unload=()
pragma: no-cache
server: gws
strict-transport-security: max-age=31536000
x-xss-protection: 0

GET
H3 200 pica.js
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/ Frame DA4F 6 KB
4 KB 35ms
34ms Other
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/pica.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:48 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oas5cenne2ISgQfoKU9pApQBgCY7hd6w7C7mZuEAGQv1nAvxoIZAO%2Fc0GPvFn9OxVBEPxzAmCqEuEQGuOeE8ZNxHp0mtKX9kWb2JsWGDX6HfDK5B8fivK%2BxdgQZ9knnqJclng9tNZIyzGjel"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd3a5c010b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 pica.js
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/ Frame DA4F 6 KB
3 KB 30ms
30ms Other
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/pica.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:48 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6mrCcOxTgX8N4OgIMmfS7InIecwZMIdrNu%2BQoec0%2BAavco0ygb%2B1yIy3PQfN5%2F4d2dw8ZpADLtzIdN7g7%2FPo5IrkRgeC4LBDbcFzCenYXuihzHsaHJHxLz3LVHpkCdTDUS5zZP1jlWVWIoPm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd3a5c050b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 Primary Request / Show response
downfile.site/ 278 KB
48 KB 1277ms
1277ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/

Requested by

Host: www.google.com
URL: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjWpsDh3NT-AhVcV2wGHeDEDHcQFnoECAoQAQ&url=https://downfile.site/&usg=AOvVaw1SZTvmPMlq65ypV9VmJNnu

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02f40d2a81d91a58f36aa00e54c7e04c1680e2d7ab8e0c120eb292a8b24af64d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 7d53bd3abc720b73-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 10 Jun 2023 18:39:50 GMT
expires: -1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
referrer-policy: no-referrer-when-downgrade no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G6V%2BMnnhME%2FMlDJlFTXw184xrr453Sbb7KxZqYlVdzzyNyxZ5uyPKWYTGqjRHSRo8BFqvHkEhU0ywYkhEK4BGorUKZue3umUylJ3FsbsalZ9lwSc4Q7afG8lPMXcT%2FyQKd0F3%2Biq%2FSO%2Bj6Eq"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-cache-age: 0
x-cache-lifetime: 604800
x-cache-tags: 56d7,56d7-post-3075,56d7-post-3072,56d7-post-3069,56d7-post-3066,56d7-post-3063,56d7-post-3060,56d7-post-3057,56d7-post-3054,56d7-post-3051,56d7-post-3048
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: master-only
x-ua-compatible: IE=edge
x-xss-protection: 1; mode=block

GET
H3 200 style.min.css
downfile.site/wp-includes/css/dist/block-library/ 95 KB
13 KB 40ms
39ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1227459
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:56:46 GMT
server: cloudflare
etag: W/"646e5dee-17ced"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oaXwJFZBaKXhLVCK8%2BhHqGM6dYsl1JH9WUPHxbRCzZjlSVV2F8K7bnbzpg%2FN8g%2FyO8KNl%2BOho19pSnR8JjD62OvQAi2XVRyDEvsd4IfDoty4I8G%2F0elREWl7Ple6U2QOTIBqVKkhSyPCgthU"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42bfb60b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 classic-themes.min.css
downfile.site/wp-includes/css/ 291 B
672 B 35ms
34ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-includes/css/classic-themes.min.css?ver=6.2.2
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1227023
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:56:46 GMT
server: cloudflare
etag: W/"646e5dee-123"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=llu%2Fr7VT5E%2FFldtR6yvRIijH%2FKll3loRakf7iVmZ59aJ2NHEeRt4AhqqZc%2Bu0vvHkMSYzbZXaY6dddHeFUHkmCUw5hrMwcz%2BjctgVk4MmZzD9rd5yQEDC3Q1keuHOW9Izz6MBcVzdH4m%2FXlV"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfb80b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 cookie-law-info-public.css
downfile.site/wp-content/plugins/cookie-law-info/legacy/public/css/ 3 KB
1 KB 43ms
41ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-public.css?ver=3.0.9
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1348670
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:02 GMT
server: cloudflare
etag: W/"646e5dfe-c22"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FYeRcmQptaiYT2Ef8IVxaP0c7CIB05aRZMGFdG%2BhCKDA5jtuLJnHFwhz3vZ4jbggq5ohiTbf%2FUNksZzcSLC7kworeAPOHrkg79Vh%2FJJQnDSC2sDHG34gjRROtcYnbB9UVJtB2FUuUk%2FzEs55"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfbc0b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 cookie-law-info-gdpr.css
downfile.site/wp-content/plugins/cookie-law-info/legacy/public/css/ 27 KB
5 KB 41ms
39ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-gdpr.css?ver=3.0.9
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3142617
alt-svc: h3=":443"; ma=86400
last-modified: Fri, 05 May 2023 09:34:27 GMT
server: cloudflare
etag: W/"6454cda3-6a71"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JcQSGJdwvRTWJcMZPll9qDRx%2B8hfK8Rm%2FiSaBDAHoWJ4wwJWJ8NvYf4fJnCSfB%2Fl4ueWgUi1m7ehg6H%2Fli04q3yy7MuGZk55SnH3uWKr%2Bj8ShpTAUvD9rFbYlBzednlbIPol%2F3yPK1QlHpZe"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfbd0b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 widget-areas.min.css
downfile.site/wp-content/themes/generatepress/assets/css/components/ 3 KB
1 KB 41ms
39ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.3.0
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 345153
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:00 GMT
server: cloudflare
etag: W/"646e5dfc-d1e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mrEJzMA3T6uHeen7%2FYu2cQR0haJfvInSWLc7HjrYOPhsg2D00tkb2tzzmBhjdkZ7MTSdokEWK%2BuhhGiN0LjYtvJK4rGySjo0FaauZr0S2q09RySYi6xXDOLUao31dZpWQDUL%2FdFDCVmHjZm0"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfbf0b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 main.min.css
downfile.site/wp-content/themes/generatepress/assets/css/ 19 KB
5 KB 38ms
37ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.3.0
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2844146
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 08 May 2023 20:36:36 GMT
server: cloudflare
etag: W/"64595d54-4c6e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zbpp2Js3S71pEafIwR43y1cvT1p72CiouwxFSFiD58QiyORCjMW%2BLu0irUXxhXWQc8myebYJYc29kwqhVvtYdmKmZaCijXPCq6lGxJaYEBHClZXbrc4ddJ34jjDMDLPZKSndJEhchEKMqMzc"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfc00b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 14 KB
1 KB 118ms
42ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300%2Cregular%2Citalic%2C600%2C700&display=auto&ver=3.3.0

Requested by

Host: downfile.site
URL: https://downfile.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bdbc7aa942ed3cc380c72be1c45147f4d7ec5e6b5b084f6527a46022314958

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 18:05:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 18:39:50 GMT

GET
H3 200 featured-images.min.css
downfile.site/wp-content/plugins/gp-premium/blog/functions/css/ 3 KB
983 B 70ms
69ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/gp-premium/blog/functions/css/featured-images.min.css?ver=2.3.1
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cdc8768b77b752d62d488cda4d7917a5df5d334da0f7fa7c9f86aeae573923b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1358750
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:03 GMT
server: cloudflare
etag: W/"646e5dff-cdd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oBdWOwQbY5gdn6x%2FxxfApnLW4ysyVraz%2B4gl15lu9Rd972adUHKMBHUahXsslCoDGfKsywApUdfdidkAe7bCZJL8Dvq4DJaRDEO%2Ba0PykuDRpI7IXFjGdoL4Vcaxw5IUhA6jVIHY4uef0c%2BW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfc20b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 navigation-branding-flex.min.css
downfile.site/wp-content/plugins/gp-premium/menu-plus/functions/css/ 3 KB
1 KB 39ms
38ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/gp-premium/menu-plus/functions/css/navigation-branding-flex.min.css?ver=2.3.1
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c8eb7fd8354e29e58e77290872b6e05a65404a4d16fe26996b72b6f2f606281

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2842351
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 08 May 2023 20:37:31 GMT
server: cloudflare
etag: W/"64595d8b-a06"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Omqlv%2B32TzTCP5mD%2FQRaYibOqhFkR%2BFprm%2B063VLmfRAZpSTSM%2BwQ5MGZ2feC5iBR3PkDvy%2BzesmmIM4dTnNREi0JB13SyCnnJAcl8JVnwt9OMBg5vRdtK2AT5pLOAP5x1ZBNlJb1zxNu8Ce"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42cfc50b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK 24488 Show response
printsmull.com/fAb6o262XGw1HlFtU/ 0
2 KB 248ms
28ms Script
application/javascript 23.109.82.119
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL

https://printsmull.com/fAb6o262XGw1HlFtU/24488

Requested by

Host: downfile.site
URL: https://downfile.site/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

23.109.82.119 , Netherlands, ASN7979 (SERVERS-COM, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 18:39:50 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=1
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: https://downfile.site
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Credentials: true
Vary: Accept-Encoding
Keep-Alive: timeout=20
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires

GET
H3 200 word-image-96709-1.png
downfile.site/wp-content/uploads/2023/06/ 28 KB
29 KB 43ms
37ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-96709-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d41be9e204c927af5e301dcac58480d8fff0113d78f22358481854ae50f7e0e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Sat, 10 Jun 2023 14:48:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4594
etag: W/"64848d2f-70ab"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S0wmv7mero6zlgry3m1AsLl8Pnc%2Bz9XP%2FoqZdcxvp6cSG%2B0dgAx4yXX8F6Hm7QsEu2MjCInJMwEdHNtTxXZ%2Ft%2FOFJmv5QcCx1or%2F2Ig4doBTL6QYuqMESXgdlgywdPRzM%2FM7Jo1NZR0ExEp2"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42dfee0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-118221-1.png
downfile.site/wp-content/uploads/2023/06/ 6 KB
7 KB 58ms
52ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-118221-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9b9cd9fe6908b3b0c3b715a3d16cb22c26c7da7b439b745cb0cb61a1d3730942

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Sat, 10 Jun 2023 08:47:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 33336
etag: W/"64843891-1819"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0rMUxsCJWCtODEEAzIJPm%2Bp8LMnU5Y3p1iIrcJjk3y%2BhGgGRJYh8LNCP1FagJCJBZxfYDuBF3%2Bqj0aBk6yua8Yh7Rak%2BlzcaJJxPGYdmJjie9PChuvntX2OWpcwpC74gVduam9jbjk5XEuVw"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42dff20b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-98789-1.png
downfile.site/wp-content/uploads/2023/06/ 12 KB
13 KB 62ms
55ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-98789-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11cc1dac4486f2d0fed9ad7a64a616125fa2d8b5fb13c0a45cc8d80fdc0beb11

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Sat, 10 Jun 2023 02:46:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 54652
etag: W/"6483e3f6-3150"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=51XeVVOdY7ovTzdTgSOLntzMMMCy%2Ba4k6jkuP82w%2B%2BAAS%2Fq9%2B3jwY4SmSHkfNRMasaECQyYQL3GmzoVwQcKQT7zx5tfkGK%2BfkAHXL4kOvKLDRNLLjZfbwFohni0%2Br4crFJPIx2M%2Bgdkjpzwk"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42dff50b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image1-57.png
downfile.site/wp-content/uploads/2023/06/ 6 KB
6 KB 63ms
56ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/image1-57.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe1c72533d1d0d06f4b5b7b8f8a664d57df5bc169afe25414cfb20667e4d1076

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 20:45:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 77737
etag: W/"64838f5b-16cb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=335CV3c5avDFQuAijRy7nUp88LDWoNEU%2BijlPl9kexgukSFtI9br%2BcyrU82VTMA3vSUzY5BrqogZUGqat5%2F%2Beh2m%2FEpiI%2BytgvziZ5szXCb7JuWTxQLhKoySZqLr4IdHPnIDdXXQvvn7Eojc"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42dff80b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-325190-1.png
downfile.site/wp-content/uploads/2023/06/ 40 KB
41 KB 62ms
55ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-325190-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0af317edf2dabf1eb6504804139cfc7c35a1f826d1f12863560c16547fcc9591

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 14:44:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 88916
etag: W/"64833ac1-a17e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6JMajDdGUyfHb12Yx%2FsKIRd2%2FJu3b0nNITZOz1uk2s9PQTErRcMUl4xVsPeYZV1r9vqbwxBsRw%2F%2F8fyrBpFmcxSnBrG0GPJysFP9wcjYRCocqeJ5WlxP7FtKlvkfe8UqjuV4a98lPqeykATu"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42dffa0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-325246-1.png
downfile.site/wp-content/uploads/2023/06/ 3 KB
4 KB 81ms
75ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-325246-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de10fbd9fb1cd26d524d0face1615d58623b08581cf044efb6221e6fab4841b4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 08:43:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 102551
etag: W/"6482e622-d33"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n99q%2Bj%2FTKUbvJb1U7EvHdHEqGRrcIR7xNsPM8yHQqGCEcEfZSkpoS4cTbpxWD4y%2F%2FhzKCju6dIH%2BNhoCTkeFWdODSWc8zvCTmfkar45aDJ4nIYgN16Y%2FHMDGu8mSvQH1IEi2giRWLdajHGg4"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42dffd0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-325015-1.png
downfile.site/wp-content/uploads/2023/06/ 10 KB
11 KB 82ms
75ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-325015-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ec410157473bd79702005c79167a785edf2d04ac538b6e31dcd4bd798de1c04

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 02:42:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 135080
etag: W/"64829186-29a0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yiyaWGEXC5K1p48MZ2w%2BM1cqAydG2tAO1R2a0Fgf0D0e0ylXsqWaOxLK4Nh0e6wAjojwxMIvo6TQrtM0BEmJYlShtitomu168sZ2mKGpdfH9us0MSej5MOE1C8bYe7px%2FlIbCeYr7kvI3fq%2F"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8000b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 text-description-automatically-generated-2.png
downfile.site/wp-content/uploads/2023/06/ 7 KB
7 KB 82ms
76ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/text-description-automatically-generated-2.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70a07f56582f4cdd50a0aaafbc5820343026d1beaec8e207a4c42ca07e724a96

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Jun 2023 20:41:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 161756
etag: W/"64823ce9-1ab5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0N%2B6hw41Mk6Rs0IOBmPKIJjkR03bP9gcQKZ0S33SSaN55skbeV82B7hBq6lZ%2BQTup6OcLqOrJXYsLFNQdDKBItKoSieSulZFJ6vXgU8iCDksJEvLVEwGsCFh4Rn26m6qy%2BaCEcX9oRjU%2Bvk6"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8020b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image1-37.png
downfile.site/wp-content/uploads/2023/06/ 2 KB
2 KB 82ms
76ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/image1-37.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 98ef203bd7d0a0982bf50133f2ef546c8de7a44cfd3c8f19ceb6db9db11c5fcf

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Jun 2023 14:40:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 183283
etag: W/"6481e84e-633"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uRGZ6Nn3U02inXR8o7EU9SoYHRmbC6n3aUPPmEYIP1SHWujm%2Bgs8IM%2Fav%2BKXg%2B67Q0liCw88fj700vYXTUdBRXJi%2BdS25i6dqW2GDfkg8voZ8qatLle6BRFSFzOKLtIKq0Ir8n8z72WwI1Zh"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8040b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 What-Is-DevNull-1.png
downfile.site/wp-content/uploads/2023/06/ 4 KB
5 KB 82ms
76ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/What-Is-DevNull-1.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aad199c0ba6d03cc38d34fa83a7eb0687eb1728d37891517a253b834b0da4fbf

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Jun 2023 08:39:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 80847
etag: W/"648193b2-11cc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jVGzLE0pYSUs8Swm9ZkEq0aZrpT2AiLMRcrfUl5%2F7GgjSPT86hDT6FlfF8ZdzUy3VWiLDhbw%2BsoiAAJbNCm2qvfYGuq%2BIFCiYpiEZer9oKlv3hd9%2BNoEmb8Pv1hi%2BS9htD64Eky20UkBnQUe"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8050b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-96709-1-150x150.png
downfile.site/wp-content/uploads/2023/06/ 18 KB
19 KB 82ms
76ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-96709-1-150x150.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77c5462466c6b10ff39c4b605f1aa7cb1add781cc86d17e5d17f7fde40b91099

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Sat, 10 Jun 2023 14:48:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5410
etag: W/"64848d31-4846"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GivkZ%2Bl8lGcVuDIpIkY9oYChT3GUen%2FzWo%2BTY3JHVCmTc2SVs2jAN0OJ6OBztjo00GRMN3EwHlwPFRN2gENzUy4g%2F8N%2BBilo2qQyMSYSQ77SE6SF3K8tAT2vu1I7mgsf3nRdeqD8sPeNRVM2"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8060b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-118221-1-150x150.png
downfile.site/wp-content/uploads/2023/06/ 1 KB
2 KB 54ms
48ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-118221-1-150x150.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 972e5d4fbbe753a6465cf0c10446388f81cd32d7ba3401dfe5d9639136cd63c9

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Sat, 10 Jun 2023 08:47:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 27614
etag: W/"64843893-5c9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4OBxtCJFROOi1xU6ssFjsFIr%2Fe02okjg5f6DTD0I5v6r0gNvIzBmMdSRZG2zdq9vLZe8GqlHJ3q%2Bg22hw2ZuXqJPr8wIOczYVwAnjrMlXZK%2FyE4n52rsPOTn2kBE%2FGbS90nmzJVReOcitd0d"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8070b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-98789-1-150x150.png
downfile.site/wp-content/uploads/2023/06/ 183 B
680 B 83ms
77ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-98789-1-150x150.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fed60534b69e35bffbabc824a687db7ae4e2a8693b94dd3e14b9d398af412d71

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Sat, 10 Jun 2023 02:46:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 54652
etag: W/"6483e3fa-b7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jL7K7Nmtwvh%2FOPelZpZQGP6LCqoZpQKWYgjg7W28IuNu61kYrC%2FMwYycimA%2FwFxNOeECLkz8TYjLsWb%2BCcyYQoiwHMYCcY0Ulw%2B3%2B9ARzC9t98BHDlUhj4yhowU3HpFbm7ZhQeL%2BsZ%2FxlaqX"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d80a0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image1-57-150x124.png
downfile.site/wp-content/uploads/2023/06/ 165 B
659 B 83ms
78ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/image1-57-150x124.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c26ce64b83332761bbc5b6db70e8ba5dd4a9992db036918ae6eae448d48d2ea

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 20:45:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 77737
etag: W/"64838f5e-a5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TGN8fH%2BWDN%2FMfvp7IH%2B%2BkxPKLQu02QGXM7RB4mw%2B16y6sLfihvjnFF%2FLtlq6VVsQ5kagU99WI4saH7PbXH0oYkpTxSEpxoKOVuxgwSs3eYfkklaynBfSFC7UWN4f8HjeACX83zUDkLsJm0uX"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d80b0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-325190-1-150x150.png
downfile.site/wp-content/uploads/2023/06/ 17 KB
17 KB 83ms
78ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-325190-1-150x150.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 000e57d85fb02acc1f718b112cf090c0b8eb50577785d3f3b4ef9a1206886d01

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 14:44:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 97949
etag: W/"64833ac9-43bd"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9jCuwgHVnJf5HWfrr2olG6j3q0OuALM%2FWDp2DAaAHTSzVTSXYg7tWCK8W4UQV5mfA%2BgXcMQM%2FImy8906mWqFxJ2yTjBfxtpkS5KvWey9srbOpuAT%2FojY%2B%2FH7BjK6Y4xk59PQh6rYLfvvMR2P"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d80c0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-325246-1-150x104.png
downfile.site/wp-content/uploads/2023/06/ 682 B
1 KB 90ms
85ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-325246-1-150x104.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f44571e7a0796f312888fe3e8f70a98725e6b1a1717d5f2992134a18539d1dd6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 08:43:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 102551
etag: W/"6482e62a-2aa"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CNg46Jkn9cI9sWisIzxcydMCKTjzhYudLsjGHy08QPXTyULjO1FPnbSZkL2omNXfqmXR6vHpWUp1l9Bb0Dxgr48TweMNZrwmCThUIc4WDKeN%2FiTaGUgTiObY%2F8rNNnzhfowdADFscTid9zQM"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d80d0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 word-image-325015-1-150x83.png
downfile.site/wp-content/uploads/2023/06/ 3 KB
4 KB 90ms
85ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/word-image-325015-1-150x83.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1dcd3307cddca8b8b419e19a8a6b715ae7c3ee8328ce07e54343fa0a4b574eae

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Fri, 09 Jun 2023 02:42:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 135070
etag: W/"64829190-d0f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q8%2BHCXc6QPlbt5cqdjD5dOn7oSW5SnPeliZxwWf%2Bua6ijAPbiwNQGteTke1yif2mI9MoGubBi0EoZdHSNie%2BBuibXcbfizO7MPzg8V%2FSRfC2WKVCtLOmjBlhYApsA34hbJJQkG1HxVjjzDQZ"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d80f0b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 text-description-automatically-generated-2-150x74.png
downfile.site/wp-content/uploads/2023/06/ 3 KB
4 KB 90ms
85ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/text-description-automatically-generated-2-150x74.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aa0d36297128d02e99250bcb2ba512fa801ff7f3ad8f7986771d672652521d6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Jun 2023 20:41:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 161756
etag: W/"64823cf7-c9a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IoLynm0XzOpCWFlNLHh8olbIVKFBJ%2FMYuuVsCcc06%2BGPm6Rc6s5rQX1NZHQwIQjxPiVYMqD6D%2B7xyiRFDgjmYfZn1YU4%2FCBvRnC7k%2BtOaMDkN6rV9FLF5jHP1GVYb%2BOm8u0CetmA3lTvReYq"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8120b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 image1-37-150x58.png
downfile.site/wp-content/uploads/2023/06/ 487 B
980 B 90ms
85ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/image1-37-150x58.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2a67d498a96b3441f7687fc3513df6e17b41241a843d06528ab70f8bce00d64

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Jun 2023 14:40:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 86497
etag: W/"6481e850-1e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H02uswG3Y%2BTuTz6IjwKxX7uHc7Yvh5Q6rEIwFmJqsGLuJylfelVHJTQPhoYGJXO3TceSP97ioKNYTaW%2BxrFkTvN%2BChbeoBNjf%2FtBseRVY21zNjQXhk0BrpM3BKAenfd%2FjPzrpo1GD%2FyPz801"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8140b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 What-Is-DevNull-1-150x86.png
downfile.site/wp-content/uploads/2023/06/ 1004 B
1 KB 53ms
48ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/uploads/2023/06/What-Is-DevNull-1-150x86.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faab7595947aeac0a80b2d513b3a176c71542b3e3ba3ab5af5e9a85354dc246f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Thu, 08 Jun 2023 08:39:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 206018
etag: W/"648193b5-3ec"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IXWqtH0IZ0miuxYhjZGCKfYnS6Q2zBSy6RSrxSliJwH8F7PBkPCwMDA9L%2Fpc44GdQQnSedMi13LJ6wXQRHpWxcHGFqFMPHgJdOJLy5JysDhtqC2Zg94x%2BnGqybbXEzVW8Yd%2Fvi79xSB6Yy5x"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd42d8150b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 warning.png
downfile.site/wp-content/plugins/chp-ads-block-detector-pro//assets/img/ 483 B
981 B 34ms
33ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://downfile.site/wp-content/plugins/chp-ads-block-detector-pro//assets/img/warning.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0a8bd74d2a1ff5ccd5a18c2d054a74b9b260258861a358b5faddc4f8a62f703

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
cf-cache-status: HIT
last-modified: Wed, 24 May 2023 18:57:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1348670
etag: W/"646e5dfe-1e3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2NHQVk7aqf02NLPxm0Hbb%2FVtz1%2FSA2aeJyULX%2BbIS8edKiOZBOcKnvjfMYo%2FFQnvUXX0A2sutImiHTRiG88WRJ7K3J6qS2%2FEi5c9WCw9GR6%2B2VBNbSS62a61VYwMKY4Xx%2BJ%2Bij%2F3rTWZ3H4R"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd4389010b73-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 47 KB
48 KB 117ms
33ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2Cregular%2Citalic%2C600%2C700&display=auto&ver=3.3.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://downfile.site
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:21:44 GMT
x-content-type-options: nosniff
age: 65886
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48412
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Jun 2024 00:21:44 GMT

GET
H3 200 cookie-law-info-table.css
downfile.site/wp-content/plugins/cookie-law-info/legacy/public/css/ 6 KB
2 KB 34ms
34ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/cookie-law-info/legacy/public/css/cookie-law-info-table.css?ver=3.0.9
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1348670
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:02 GMT
server: cloudflare
etag: W/"646e5dfe-17e1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sGyNpk2h2zjgwqBhEzkGOKuRT4G8Vub1octjQoaMpNJe0%2FG%2FpWHqxQtFx5P%2Be5Nof4u9e6a6yOMScuhAIL9dpO61sq1Gy66j4dvRFKyoMM5iuxUVves9eDdeCkwlqEqkB6ytxMyvIiBCO0yo"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd43f9970b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 rocket-loader.min.js Show response
downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 34ms
27ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: downfile.site
URL: https://downfile.site/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 06 Jun 2023 11:54:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"647f1e6b-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8k31KXegw9qmHh0YbR3EVeTORVlNMkwrvM7jkEBDznaxvNg3qeabe4ocZ642OVmTKnug%2BPdzzoGsQz3YoAfnjxipy6CXLK32ImvB3Kib9Q4%2Fpt7V%2Bxb3jlvobCfCKAhNh3K1sFcAQuHCTJ0a"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7d53bd4409a60b73-AMS
expires: Mon, 12 Jun 2023 18:39:50 GMT

GET
H3 200 modal.js Show response
downfile.site/wp-content/themes/generatepress/assets/dist/ 5 KB
2 KB 37ms
36ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/themes/generatepress/assets/dist/modal.js?ver=3.3.0
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f6afb4882995bfc4d4023b9567cfbec2866639de4da43a19d46838ae2b5fc5e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 87543
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:00 GMT
server: cloudflare
etag: W/"646e5dfc-12e3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S67bW8N6A52hGmRbrsR3QzXlQMkd%2BJejGwNAz%2BIQN2S62oZ0o9YKGLqRJzFm1g43TvmZQp5PiPNvn1fACjT8iT6sCXofDrT0t2gcsxc0jCu6TQb70%2ByqcPB2%2FlzsWYQPhKVFpvBWXx%2BjG4R2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd4449ef0b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 menu.min.js Show response
downfile.site/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 39ms
36ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.3.0
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 174066535cb768d1715ae34808cd4e83f16f23715524bfff79db8860e8c03296

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1358744
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:00 GMT
server: cloudflare
etag: W/"646e5dfc-1b3f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eogr6HzuP4b4J5d5wUpxYir2%2B7z9qFjdOuW5p5ZTSYD%2Bhv1CHVKfE7eQIS1CPQPYy0kq1XgVW%2FmUA0EgPWKVnNeCDf2q0TV%2FVu%2F1ZIQMJ0QEYgWpwZDefUGxcDa6BJUVRqZ25M9Ac%2FZZUEAq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd444a020b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 sticky.min.js Show response
downfile.site/wp-content/plugins/gp-premium/menu-plus/functions/js/ 8 KB
3 KB 41ms
38ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/gp-premium/menu-plus/functions/js/sticky.min.js?ver=2.3.1
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 57d35f39158ef6990a75261c466b5c93e3f441b5b05426a35975fc3f31c19c45

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2842348
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 08 May 2023 20:37:31 GMT
server: cloudflare
etag: W/"64595d8b-214c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aiF0vSIuBSZI5ywaxLw4Bk37WFWtfkJSTbNlxuRcsf3RVdS31USF3cQTv7ERN7fJkRsrSQJD81%2BeSg5P4PG913z4zfRa%2B1Qbs4%2BeoNw1Fh5WpUmtOoXLzmpA%2BeVdGPolc0R2cKOmC4XnD1kA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd444a050b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 137 KB
47 KB 172ms
92ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1995021269147151

Requested by

Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5adbe4f547eb03b7586fc6575e7e4f55a204e943058cb5d3091145814014af81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Origin: https://downfile.site
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47638
x-xss-protection: 0
server: cafe
etag: 12893738636326721398
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:50 GMT

GET
H3 200 cookie-law-info-public.js Show response
downfile.site/wp-content/plugins/cookie-law-info/legacy/public/js/ 33 KB
8 KB 38ms
37ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-content/plugins/cookie-law-info/legacy/public/js/cookie-law-info-public.js?ver=3.0.9
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 87543
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:57:02 GMT
server: cloudflare
etag: W/"646e5dfe-8583"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KATA6iDWYcgKLuASxCzvlifhqLHUz7lA1eDkToHVDIVoVWDkZdR9dLKpbYpgkbV7brD9T13KxxHCN8tl%2B%2F7hKhzKq8rN5E2gRCgEV3Vj7IX2IYanTpIQTfBJ3PLTe0eAgbZXTiQfAJgIXkFC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd444a070b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 jquery-migrate.min.js Show response
downfile.site/wp-includes/js/jquery/ 13 KB
5 KB 40ms
39ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.0
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 01 May 2023 16:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 3150507
etag: W/"644fe201-3470"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ONU1LoNEABb%2FdIe9taXLE%2BgRUUFOvRENH2EPC9A%2Fy%2BArFPMhug25fmDOiGGTJdQ7ZFtuzxrazjmEEUNGZtok4K%2FI6QK23dM8YSQ9XEoBxgH9Rh0Jv2Fjhu5qDhNovxjO8UrejKGUHTTmFFD%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 7d53bd444a090b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
downfile.site/wp-includes/js/jquery/ 88 KB
32 KB 45ms
44ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-includes/js/jquery/jquery.min.js?ver=3.6.4
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2135953
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 01 May 2023 16:00:01 GMT
server: cloudflare
etag: W/"644fe201-15ed7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ctk9AI2htbDUfjmI5il1atzGovwMScB1Jb1G77QXr45YNAjIDi3GXJO92vO2%2BM8sxly0zHVSDH%2FaYJdpn6uplCRxhKcwihdom%2Fz%2Fynt1iPCpE6dOO%2FobPEiCxyjuk9YKsgOffmcQSwIGCVTC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd444a0a0b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3

200

invisible.js Show response
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/ Frame C4E6
Redirect Chain

https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js
https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

28 KB
13 KB

32ms
32ms

Script
application/javascript

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

Protocol

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10319e9e75c5bc85d6f6b23efe1ba006b2bc3e848a9070a6e32c1aa77dba0cfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d5r9xLgvjs3Vg2sx32%2BkSqQ2JSP7K9oQEjO85xgUJaxawz9TCYRaF7pn7OoBcX7mSzLM03TTCYPXyxwSE8RK9Jke7fFFt0lZyJFoWpP3oyEHpQRFnapUbhIg%2Fi4dXqGdVrapbaA714p6PICd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd44baa00b73-AMS
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 10 Jun 2023 18:39:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tba9GA66wmcE9tAG28Dl4mJBeQ6zRfPegjupbHt9Vx6xgoNuwLRD%2BkbwVTZaCxLRCxRL%2FzkNanTJ6y1Ov0Dmo7GT3FhIAqcXQdeLu%2FlJpefuYVrHCIGqZRGGTkJazM6iZdAxGsyEzs9%2FgEYE"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js
cache-control: max-age=300, public
cf-ray: 7d53bd445a0f0b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 wp-emoji-release.min.js Show response
downfile.site/wp-includes/js/ 18 KB
5 KB 33ms
33ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2
Requested by: Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 80843
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 24 May 2023 18:56:46 GMT
server: cloudflare
etag: W/"646e5dee-4904"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ELHBTeCgJRyb61bLUTgkQoQ6I4jqLag5cs%2BThrmFzvkv0rTlhSNmyqjIebQ%2FdZqrPpdy1QYbj%2BNVpxaVBBfn5JbKfY9FdZnNGIJiQtVcyODJLQfwD59x6XpbBmhMNV%2FI7CVCsnWnmDExGqwz"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000
cf-ray: 7d53bd44aa860b73-AMS
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK v3.js Show response
api.trackpush.com/sdk/ 70 KB
23 KB 1283ms
516ms Script
text/javascript 167.172.77.229
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://api.trackpush.com/sdk/v3.js?pid=eU--NOUImKP7N0TXEmxdEg&sw_uri=%2Fservice-worker.js

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

167.172.77.229 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

2f414dc5bd61502c09b991b0ce6f3c6554bc84734fd83834d55e719d048efd1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 10 Jun 2023 18:39:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
X-Frame-Options: DENY
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
X-XSS-Protection: 1; mode=block
Expires: 0

GET
H3

200

invisible.js Show response
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/ Frame C4E6
Redirect Chain

https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js
https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

28 KB
13 KB

38ms
37ms

Script
application/javascript

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js

Protocol

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10319e9e75c5bc85d6f6b23efe1ba006b2bc3e848a9070a6e32c1aa77dba0cfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AWtOLnYNRSY30pcX7bcLhb4O3ALj5KTQBhZ%2FfAg9xXnCTu%2FDoI6jldmfcFyD%2B4mYNy1jYMY%2FDW%2Fg12%2FROR4W%2BAQGdrla9ovOQpZW8gxrHlWO4QoDiHDiKU2KcdmLSXseH%2Fsnf5SqaDvr8A9d"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd459bca0b73-AMS
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 10 Jun 2023 18:39:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LGl2k1IG%2BF3fuLPlRZO4OxG8P5jeUrNk84J4UXrEiiJRlWF9it6yzeANkft4S8DetsCxHSmQe9NQkxOtS3AXz3PhxWW72fBfqAnMaW23zuVEJ3pQlbZyCz80XOy6k%2FrHkPINJ08wXMSP%2FDW%2B"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/5da7637f/invisible.js
cache-control: max-age=300, public
cf-ray: 7d53bd456b840b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 137 KB
46 KB 85ms
84ms XHR
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52cb98a1af1fc5baffd9b52cf9b1c54d56c72513d95d9a309d6f9d509e62133f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47486
x-xss-protection: 0
server: cafe
etag: 15098002170611832088
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:50 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 137 KB
46 KB 245ms
117ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1094273e95ea266c7f305dde338e612fe826f985b679274b7dae063d98522d6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47484
x-xss-protection: 0
server: cafe
etag: 14623510611175730257
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:50 GMT

GET
H3 200 pica.js
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/ Frame C4E6 6 KB
3 KB 37ms
36ms Other
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/pica.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a922e9358507066ac8efb549e3009267afd9e0bd4c8d501bf10cdb9d823bf0e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=izl71Hr8W7kapC3QXXA8avtPOWSEZRqhzjddWabxdjKLR9YE5DQfxatqJgWY5WHPxgxRr4vsPIJjMbZ%2FlDuHBKICLQ%2F0efBifpKnJxRa%2BBNfcdAxlQ00EDI7dXAM0kCymGbKne8GMB%2BGJ6GS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd459bc90b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306060101/ 352 KB
118 KB 193ms
116ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306060101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1995021269147151&plah=downfile.site

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1995021269147151

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

94304dca9a49e7472c3636b4158f6ca020faabecd58f4c6a1c97471226458808

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 121042
x-xss-protection: 0
server: cafe
etag: 18235202053445817590
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:50 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230607/r20190131/ Frame A13F 10 KB
5 KB 111ms
36ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230607/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1995021269147151

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 44074
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 06:25:16 GMT
etag: 15057649708203361565
expires: Sat, 24 Jun 2023 06:25:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 admin-ajax.php Show response
downfile.site/wp-admin/ 7 B
830 B 804ms
803ms XHR
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/wp-admin/admin-ajax.php

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff, nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Referer: https://downfile.site/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type: application/x-www-form-urlencoded;

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload, max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff, nosniff, nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies: master-only, master-only
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block, 1; mode=block
referrer-policy: strict-origin-when-cross-origin, no-referrer-when-downgrade, no-referrer-when-downgrade
server: cloudflare
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://downfile.site
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v9ZZ88E5xsTQix5C84g3zE0HKVRIpFhNz2sksSrxyuHY9lp%2FwxYRW%2BopXNhmlO7R0xCIoKHHVYpuxkeuHBkYezK8YQAVvU104rcUITwJyHJfq6%2FMXEAqhYNvXUMv8jDnrhR9ZQYPCCufpDPi"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
cf-ray: 7d53bd460c630b73-AMS
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H3 200 pica.js
downfile.site/cdn-cgi/challenge-platform/h/b/scripts/ Frame C4E6 6 KB
3 KB 31ms
31ms Other
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://downfile.site/cdn-cgi/challenge-platform/h/b/scripts/pica.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

248e651cd45e76b923ecade68e0712ff6f9cdbaa8faf2546a83ff0369456aff2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bHPLCUqlsrLUxi79saFTm%2F3grtX9QCBMRqeAVyIcTjrXDNo4JSuY%2BD4wRpCZHZOFsTHsoGgtTtuv0KHwGzdHtuNBpyQjoIPzqAZ%2Bwh4mu5lb4Ke%2B%2Fhsga8swmaRMj2TM6PdRX9MsGr9uKv1y"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7d53bd460c660b73-AMS
alt-svc: h3=":443"; ma=86400

POST
H3 200 7d53bd3abc720b73 Show response
downfile.site/cdn-cgi/challenge-platform/h/b/cv/result/ Frame C4E6 2 B
575 B 50ms
49ms XHR
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/cdn-cgi/challenge-platform/h/b/cv/result/7d53bd3abc720b73
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 10 Jun 2023 18:39:50 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XqDrtSgtMrZzRZtzMuVED4xMVKPpeL3K1es7LaSFIuX1vV67eop8i2e1cxI6foyHof0oxTpVMUPWVOLwUaZ6inaOdTSEGQvvhdmntP2RSQKyo4AIG6RQirIbuUOLi4U1uNLYZrPdsyZq52NX"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7d53bd473de10b73-AMS
alt-svc: h3=":443"; ma=86400

POST
H3 200 7d53bd3abc720b73 Show response
downfile.site/cdn-cgi/challenge-platform/h/b/cv/result/ Frame C4E6 2 B
583 B 39ms
39ms XHR
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://downfile.site/cdn-cgi/challenge-platform/h/b/cv/result/7d53bd3abc720b73
Requested by: Host: downfile.site
URL: https://downfile.site/cdn-cgi/challenge-platform/scripts/invisible.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NCJGQ%2FjlaWHG3pxlbAQs1%2BxTfDjTBWaRFvrmBiuYO9DQleB517ldVOqQiIDVRghCzGtpMd%2BEQuqJob3DFCc6%2FCBHaDKJ0JidmTqAvUmdv5z2SffHLREdWXk8sRksijPRtf%2FIvoMANx52nfGQ"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7d53bd488fb60b73-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 393 B
601 B 189ms
60ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=downfile.site&callback=_gfp_s_&client=ca-pub-1995021269147151

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306060101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1995021269147151&plah=downfile.site

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

90a61f9c67108ba2f341489d0e12eedf9b6aad417577aef38ab876ebc36c7750

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 249
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 117ms
42ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=downfile.site

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 67ms
66ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&id=cookie-law-info-bar&ign=false&pw=1600&ph=1200&x=0&y=1130.4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1409 236 KB
50 KB 681ms
678ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&adk=1812271804&adf=3025194257&lmt=1686422391&plat=1%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fdownfile.site%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390657&bpp=8&bdt=480&idt=463&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5878854364812&frm=20&pv=2&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&fsapi=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=484

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a26d15e93261deb33aa10af9733c3d74eeac94fc86b20ce4646b8ce8bd316b07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 51486
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:51 GMT
expires: Sat, 10 Jun 2023 18:39:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 82ms
82ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230607&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

98b57554fb9a42fe0bac070bd70ebd23a2e32787293bf25732cc665d5450125d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11134
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EABE 105 KB
36 KB 592ms
592ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=3468950800&adk=1423715733&adf=2653041513&pi=t.ma~as.3468950800&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390665&bpp=1&bdt=488&idt=484&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=65&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ml7Vqmz7B1&p=https%3A//downfile.site&dtd=492

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de6f406cbdf047ad2d474ba129f0d3a8839c9e6c1201c0b6d8e6938cbdf6d2cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 36264
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:51 GMT
expires: Sat, 10 Jun 2023 18:39:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DEC9 91 KB
33 KB 617ms
617ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=200&slotname=7515226464&adk=2849340346&adf=785635387&pi=t.ma~as.7515226464&w=1200&fwrn=4&lmt=1686422391&rafmt=11&format=1200x200&url=https%3A%2F%2Fdownfile.site%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390666&bpp=1&bdt=489&idt=497&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=367&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TNRQ24C9W3&p=https%3A//downfile.site&dtd=501

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf83e2af5872b1344ab1526f8cdee831898adf5cce07a643ff99225cfe95875e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 33473
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:51 GMT
expires: Sat, 10 Jun 2023 18:39:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FE93 106 KB
36 KB 634ms
633ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=9791897833&adk=1958193327&adf=2602375796&pi=t.ma~as.9791897833&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390667&bpp=1&bdt=491&idt=502&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x200&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=613&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&fsb=1&xpc=tSsK3x24yS&p=https%3A//downfile.site&dtd=505

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7eb097682f8169d286031887e3b3e6d623c7e908c27bcba031b18e3c55b70a12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 36434
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:51 GMT
expires: Sat, 10 Jun 2023 18:39:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 873ms
742ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 10 Jun 2023 18:39:52 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame EABE 14 KB
1 KB 44ms
43ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=3468950800&adk=1423715733&adf=2653041513&pi=t.ma~as.3468950800&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390665&bpp=1&bdt=488&idt=484&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=65&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ml7Vqmz7B1&p=https%3A//downfile.site&dtd=492

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 16:40:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame EABE 2 KB
1 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64883
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:28 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame EABE 0
0 80ms
79ms Fetch
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CpDMNd8OEZNvhENKingWhso-QBJqZu-Nwr_yshJER5pnHvNQOEAEgk-abN2CRhKCFjBigAf-44cQDyAEJqAMByAPLBKoEygFP0GsC56kZ7CvHIBFkLyqfc8G5XX39jNEyEpf2LDgx12WzJOtZ7bSaO3ZwTb5fjy2WZ3l2O7MwaeKfKvvbqwGH30lyIcJqwGTRcmrkGbo6CsLoJLyTg63OmDjJgnGVrzovvUy7jvT-TffO_wyuI5P1Gzi55oEzbsa545GbA4InnoolbHEHd8TL4RWcgGZ6YyQN0SftvbeJbgDK0M6Z_rGlKmQDrYRbHLx5YuJj-WqJGqQU12s3_kAwTYPWhZOrHd4deI5xQMQldpTSwATF8v_C_gOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH6caeO6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcDEOQ00ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xOTk1MDIxMjY5MTQ3MTUxGAA&sigh=uxbFhxr2PCQ&uach_m=[UACH]&cid=CAQSGwBygQiDQC-5wD8RFFhWsC9nLxybWVoNvUH7DBgB&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=3468950800&adk=1423715733&adf=2653041513&pi=t.ma~as.3468950800&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390665&bpp=1&bdt=488&idt=484&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=65&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=ml7Vqmz7B1&p=https%3A//downfile.site&dtd=492
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Jun 2023 18:39:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/6378861929114393168/ Frame EABE 21 KB
21 KB 34ms
33ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6378861929114393168/14763004658117789537?w=600&h=314

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a68796fe1b2a505499b0a8692cb34fc45bfefb8692c9cac72e447da5498d6b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 18:49:18 GMT
x-content-type-options: nosniff
age: 604233
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21592
x-xss-protection: 0
last-modified: Thu, 21 Jul 2022 16:30:25 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 02 Jun 2024 18:49:18 GMT

GET
DATA 200
OK truncated
/ Frame EABE 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame EABE 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/ Frame EABE 23 KB
9 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6f5aedf67284aeeaaaa0c532e71c40757fa449038d89d63c5e90a1ded226643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64934
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9004
x-xss-protection: 0
server: cafe
etag: 17960421598201694375
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:37:37 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame EABE 3 KB
1 KB 70ms
69ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37430
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 08:16:01 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame EABE 20 KB
8 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9971c0a9e4d487abeaf7f2396426a237081c2271bc17cdcd6883495ff43b3fc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64884
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8202
x-xss-protection: 0
server: cafe
etag: 12977410716570951617
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EABE 175 KB
55 KB 189ms
103ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d262b04633fbcfb934184c79a2d1786fa24576ad6f7ccc40c5ba0aa540de9d54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55943
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686137816735621"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 d955217a3c39fa1d48035534c1a62142.js Show response
www.gstatic.com/mysidia/ Frame EABE 32 KB
14 KB 187ms
58ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d955217a3c39fa1d48035534c1a62142.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3c8d1021bd2ee3bb73e29d8fdf79a184be2c6b5ef6ba41b0a6bd09519d0dfd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 23:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 415857
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13662
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 22:56:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Sep 2023 23:08:54 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame DEC9 4 KB
728 B 46ms
42ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=200&slotname=7515226464&adk=2849340346&adf=785635387&pi=t.ma~as.7515226464&w=1200&fwrn=4&lmt=1686422391&rafmt=11&format=1200x200&url=https%3A%2F%2Fdownfile.site%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390666&bpp=1&bdt=489&idt=497&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=367&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TNRQ24C9W3&p=https%3A//downfile.site&dtd=501

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 18:38:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame DEC9 2 KB
926 B 43ms
39ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64883
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:28 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/ Frame DEC9 23 KB
9 KB 34ms
32ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6f5aedf67284aeeaaaa0c532e71c40757fa449038d89d63c5e90a1ded226643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64934
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9004
x-xss-protection: 0
server: cafe
etag: 17960421598201694375
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:37:37 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame DEC9 3 KB
1 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37430
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 08:16:01 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame DEC9 20 KB
8 KB 36ms
32ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9971c0a9e4d487abeaf7f2396426a237081c2271bc17cdcd6883495ff43b3fc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64884
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8202
x-xss-protection: 0
server: cafe
etag: 12977410716570951617
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DEC9 175 KB
55 KB 94ms
56ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d262b04633fbcfb934184c79a2d1786fa24576ad6f7ccc40c5ba0aa540de9d54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55943
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686137816735621"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 d955217a3c39fa1d48035534c1a62142.js Show response
www.gstatic.com/mysidia/ Frame DEC9 32 KB
13 KB 134ms
72ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d955217a3c39fa1d48035534c1a62142.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3c8d1021bd2ee3bb73e29d8fdf79a184be2c6b5ef6ba41b0a6bd09519d0dfd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 23:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 415857
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13662
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 22:56:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Sep 2023 23:08:54 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame FE93 14 KB
1 KB 46ms
43ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=9791897833&adk=1958193327&adf=2602375796&pi=t.ma~as.9791897833&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390667&bpp=1&bdt=491&idt=502&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x200&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=613&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&fsb=1&xpc=tSsK3x24yS&p=https%3A//downfile.site&dtd=505

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 16:40:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame FE93 2 KB
926 B 42ms
40ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64883
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:28 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/ Frame FE93 23 KB
9 KB 34ms
32ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6f5aedf67284aeeaaaa0c532e71c40757fa449038d89d63c5e90a1ded226643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64934
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9004
x-xss-protection: 0
server: cafe
etag: 17960421598201694375
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:37:37 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame FE93 3 KB
1 KB 40ms
37ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37430
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 08:16:01 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame FE93 20 KB
8 KB 38ms
35ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9971c0a9e4d487abeaf7f2396426a237081c2271bc17cdcd6883495ff43b3fc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64884
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8202
x-xss-protection: 0
server: cafe
etag: 12977410716570951617
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FE93 175 KB
55 KB 146ms
110ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d262b04633fbcfb934184c79a2d1786fa24576ad6f7ccc40c5ba0aa540de9d54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55943
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686137816735621"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 d955217a3c39fa1d48035534c1a62142.js Show response
www.gstatic.com/mysidia/ Frame FE93 32 KB
13 KB 107ms
59ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d955217a3c39fa1d48035534c1a62142.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3c8d1021bd2ee3bb73e29d8fdf79a184be2c6b5ef6ba41b0a6bd09519d0dfd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 23:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 415857
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13662
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 22:56:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Sep 2023 23:08:54 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DEC9 0
0 84ms
84ms Fetch
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZf6-d8OEZLShEYegngXXq6awA_apo4Nx_J3T9KsOp7y34-MoEAEgk-abN2CRhKCFjBigAZ_8t5gByAEJqQJft8dv_SapPqgDAcgDywSqBNkBT9D5VW82AW4DmjW0O33QAmoO9rwL6-1qwACWnGdfS5SwiqHBVQf0Ol0tEVQvOsM5yECq0TN33Ii1FwlfnvvzVYC-AHyY0wSlcnAKvPuzjvmIxeQulr7CmH9zCGbzZ72TYEX6pfex0xxY3zRq7lwWWyZ67eD72HJz3Q3jMZAXYjUNUxb1TcV4emmIQiFDYS2nadFfp2EJkuDrPLjs365FHSGrJC1VCHhwDX--pVb1cotSM-iqr9CF9GgCtc8vdPUMNURmQsC6ZrYbXk--fy4bzC16WaS3SN1efsAEsciUv9UDkgUECAQYAZIFBAgFGASgBi6AB8mDyOcCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwMQkUzSCBYIgOGAEBABGB8yAqoCOgKAQEi9_cE6gAoByAsBuBPkA9gTCogUCNAVAYAXAbIXHAoaCAASFHB1Yi0xOTk1MDIxMjY5MTQ3MTUxGAA&sigh=q2sCdK0dHH0&uach_m=[UACH]&cid=CAQSGwBygQiDTMcaWWIj5Brsf8cRZQyW38eBZVyR-xgB&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=200&slotname=7515226464&adk=2849340346&adf=785635387&pi=t.ma~as.7515226464&w=1200&fwrn=4&lmt=1686422391&rafmt=11&format=1200x200&url=https%3A%2F%2Fdownfile.site%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390666&bpp=1&bdt=489&idt=497&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=367&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TNRQ24C9W3&p=https%3A//downfile.site&dtd=501
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Jun 2023 18:39:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 6592766407814317453
tpc.googlesyndication.com/simgad/12444297387524930594/ Frame DEC9 51 KB
52 KB 38ms
36ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12444297387524930594/6592766407814317453

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

925cdfda26b6689ba7e46012787c43c5d3f5ae08de18fb0754105594d2f7cca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Thu, 08 Jun 2023 04:04:42 GMT
x-content-type-options: nosniff
age: 225309
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52605
x-xss-protection: 0
last-modified: Thu, 26 Aug 2021 02:05:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 07 Jun 2024 04:04:42 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/6378861929114393168/ Frame FE93 21 KB
21 KB 55ms
55ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6378861929114393168/14763004658117789537?w=600&h=314

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a68796fe1b2a505499b0a8692cb34fc45bfefb8692c9cac72e447da5498d6b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 18:49:18 GMT
x-content-type-options: nosniff
age: 604233
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21592
x-xss-protection: 0
last-modified: Thu, 21 Jul 2022 16:30:25 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 02 Jun 2024 18:49:18 GMT

GET
DATA 200
OK truncated
/ Frame FE93 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame FE93 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame FE93 0
0 86ms
85ms Fetch
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=ChtRXd8OEZJzmEZKLngWBvq24BJqZu-Nwr_yshJER5pnHvNQOEAEgk-abN2CRhKCFjBigAf-44cQDyAEJqAMByAPLBKoEygFP0NUeuaQ0ZgLHwr1Q5KIm8ITVHPGSRQcTOyamGQdRfqla4j3cMJcwxN3lWOuNY6plB0er_snJXh-uyfA5Na77brpD9Zq4zwELvBkC6Xvtz-Ulz4s2Nly3uElPXj87ybROVlNf6UbMGtnilNnwj7k1HkC4YBgSmNOpBbjVyOx_qTQoa20v94e3yutt7HNlRldR9KsUbag9-QQJMtbidRk9wykF5Npt5s2Ozky2u_pCkHl0Lzgde0e01vM_71OxcCNI3UysTiVr5YwQwATF8v_C_gOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH6caeO6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcDEOMu0ggWCIDhgBAQARgfMgKqAjoCgEBIvf3BOoAKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xOTk1MDIxMjY5MTQ3MTUxGAA&sigh=BaG6UmZHGqU&uach_m=[UACH]&cid=CAQSGwBygQiDwBQQQF1614ha7K0M1ppDC1TvmFq9vxgB&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=280&slotname=9791897833&adk=1958193327&adf=2602375796&pi=t.ma~as.9791897833&w=1200&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&format=1200x280&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422390667&bpp=1&bdt=491&idt=502&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C1200x200&nras=1&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=613&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&fsb=1&xpc=tSsK3x24yS&p=https%3A//downfile.site&dtd=505
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Jun 2023 18:39:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306060101/ 152 KB
52 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306060101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61415dedc00f8ae867238c2b415e7ebc4b38c627da596472f7a9c14a451539cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:51 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52936
x-xss-protection: 0
server: cafe
etag: 7319008488948748746
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 53ms
52ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=downfile.site

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0C5F 91 KB
35 KB 561ms
561ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=600&adk=930274632&adf=806768345&pi=t.aa~a.3529635075~rp.3&w=258&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&to=qs&pwprc=5667035941&format=258x600&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422391960&bpp=1&bdt=1783&idt=0&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc001ee1e439609c2-221fe09950e100ae%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw&gpic=UID%3D00000c46928c2e21%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw&prev_fmts=0x0%2C1200x280%2C1200x200%2C1200x280&nras=2&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1090&ady=1242&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=1&fsb=1&xpc=utgo0UyTt8&p=https%3A//downfile.site&dtd=5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fbb222c9c1b8804a8fc12ba2dd3a0e11cfea670544c2e717944d53bae31a512d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 35720
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EABE 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bee703e84301b68e9e16dd7b56f73dd67abb1bb9e0348c2ad14589ec8099c848

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame DEC9 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49069d700b469ef6821edbdaa3169547a71f90813c3921417a6c0ed72348d389

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame FE93 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09a0cf602f51c5b2638706d117b1c10bf4e99a20199e51987c40923c52c134a2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 42ms
41ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=downfile.site

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/ Frame F8AF 10 KB
4 KB 33ms
33ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 43794
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 06:29:58 GMT
etag: 15057649708203361565
expires: Sat, 24 Jun 2023 06:29:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame DEC9 15 KB
16 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 17:04:15 GMT
x-content-type-options: nosniff
age: 5737
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Jun 2024 17:04:15 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame DEC9 15 KB
15 KB 34ms
33ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 03:30:27 GMT
x-content-type-options: nosniff
age: 54565
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Jun 2024 03:30:27 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame EABE 33 KB
33 KB 34ms
34ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Tue, 06 Jun 2023 19:09:17 GMT
x-content-type-options: nosniff
age: 343835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Jun 2024 19:09:17 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame FE93 33 KB
33 KB 45ms
44ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Tue, 06 Jun 2023 19:09:17 GMT
x-content-type-options: nosniff
age: 343835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Jun 2024 19:09:17 GMT

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame 4DBB 37 KB
14 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 09 Jun 2024 08:16:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1BDC 13 KB
5 KB 34ms
33ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 37358
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 08:17:14 GMT
expires: Sun, 09 Jun 2024 08:17:14 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 34AB 783 B
1009 B 44ms
42ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4688e58af12153b8d216794a3f8deb0c185b7786549b43c8fa1dbd842a741fe7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-pUVZRbvP4v0Rg1NzNYivfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://downfile.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-pUVZRbvP4v0Rg1NzNYivfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:52 GMT
expires: Sat, 10 Jun 2023 18:39:52 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 css2
fonts.googleapis.com/ Frame F8AF 4 KB
671 B 42ms
42ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 18:37:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 18:39:52 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F8AF 205 B
519 B 34ms
33ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 15:13:17 GMT
x-content-type-options: nosniff
age: 12395
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 09 Jun 2024 15:13:17 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F8AF 604 B
695 B 34ms
34ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Fri, 09 Jun 2023 19:46:09 GMT
x-content-type-options: nosniff
age: 82423
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 08 Jun 2024 19:46:09 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/elements/html/ Frame F8AF 13 KB
6 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ebdb9e520559d8729e2d5497e1e3161033513af76c836fdb095dbb146acdad70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 04:53:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5918
x-xss-protection: 0
server: cafe
etag: 3124426376131173928
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 04:53:38 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/elements/html/ Frame F8AF 20 KB
8 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f39d54e71a3c475b8a65cdcdd903b249e8b8a4538f6c8f0b1f8b3c34a093302

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 02:10:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59379
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8493
x-xss-protection: 0
server: cafe
etag: 12780958209750988066
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 02:10:13 GMT

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame 7977 37 KB
14 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 09 Jun 2024 08:16:00 GMT

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame B5B1 37 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 09 Jun 2024 08:16:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1D53 14 KB
1 KB 48ms
48ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 16:44:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 18:39:52 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame 1D53 2 KB
892 B 33ms
32ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64884
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:28 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/ Frame 1D53 23 KB
9 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6f5aedf67284aeeaaaa0c532e71c40757fa449038d89d63c5e90a1ded226643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64935
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9004
x-xss-protection: 0
server: cafe
etag: 17960421598201694375
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:37:37 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E720 143 B
166 B 39ms
37ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 2879
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 17:51:53 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame 1D53 3 KB
1 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37431
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 08:16:01 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame 1D53 20 KB
8 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9971c0a9e4d487abeaf7f2396426a237081c2271bc17cdcd6883495ff43b3fc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64885
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8202
x-xss-protection: 0
server: cafe
etag: 12977410716570951617
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:27 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1D53 175 KB
55 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d262b04633fbcfb934184c79a2d1786fa24576ad6f7ccc40c5ba0aa540de9d54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55943
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686137816735621"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:52 GMT

GET
H3 200 d955217a3c39fa1d48035534c1a62142.js Show response
www.gstatic.com/mysidia/ Frame 1D53 32 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d955217a3c39fa1d48035534c1a62142.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3c8d1021bd2ee3bb73e29d8fdf79a184be2c6b5ef6ba41b0a6bd09519d0dfd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 23:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 415858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13662
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 22:56:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Sep 2023 23:08:54 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 34AB 0
0 67ms
66ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230607&jk=2600928889236331&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame 1BDC 37 KB
14 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 09 Jun 2024 08:16:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E720
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

63ms
62ms

Document
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230607/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:52 GMT
expires: Sat, 10 Jun 2023 18:39:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:52 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame F205 37 KB
14 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Host: get.megafly.in
URL: https://get.megafly.in/H1niYNIw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 09 Jun 2024 08:16:00 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame 0C5F 2 KB
892 B 36ms
33ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=600&adk=930274632&adf=806768345&pi=t.aa~a.3529635075~rp.3&w=258&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&to=qs&pwprc=5667035941&format=258x600&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422391960&bpp=1&bdt=1783&idt=0&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc001ee1e439609c2-221fe09950e100ae%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw&gpic=UID%3D00000c46928c2e21%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw&prev_fmts=0x0%2C1200x280%2C1200x200%2C1200x280&nras=2&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1090&ady=1242&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=1&fsb=1&xpc=utgo0UyTt8&p=https%3A//downfile.site&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64884
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:28 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/ Frame 0C5F 23 KB
9 KB 37ms
34ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6f5aedf67284aeeaaaa0c532e71c40757fa449038d89d63c5e90a1ded226643

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:37:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64935
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9004
x-xss-protection: 0
server: cafe
etag: 17960421598201694375
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:37:37 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame 0C5F 3 KB
1 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37431
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 08:16:01 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/ Frame 0C5F 20 KB
8 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230607/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9971c0a9e4d487abeaf7f2396426a237081c2271bc17cdcd6883495ff43b3fc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 00:38:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 64885
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8202
x-xss-protection: 0
server: cafe
etag: 12977410716570951617
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 24 Jun 2023 00:38:27 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0C5F 0
0 44ms
43ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRk8dH7MYwUWkRu7kcETtMV5O_JuJD-wF3gL5B15y6aVZpoc9U7aeGn05G06fqbHjHK7ryKL0iTsVnXMXMNJre2CGIgYQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=600&adk=930274632&adf=806768345&pi=t.aa~a.3529635075~rp.3&w=258&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&to=qs&pwprc=5667035941&format=258x600&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422391960&bpp=1&bdt=1783&idt=0&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc001ee1e439609c2-221fe09950e100ae%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw&gpic=UID%3D00000c46928c2e21%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw&prev_fmts=0x0%2C1200x280%2C1200x200%2C1200x280&nras=2&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1090&ady=1242&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=1&fsb=1&xpc=utgo0UyTt8&p=https%3A//downfile.site&dtd=5
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0C5F 175 KB
55 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d262b04633fbcfb934184c79a2d1786fa24576ad6f7ccc40c5ba0aa540de9d54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55943
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1686137816735621"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Jun 2023 18:39:52 GMT

GET
H3 200 d955217a3c39fa1d48035534c1a62142.js Show response
www.gstatic.com/mysidia/ Frame 0C5F 32 KB
13 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d955217a3c39fa1d48035534c1a62142.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3c8d1021bd2ee3bb73e29d8fdf79a184be2c6b5ef6ba41b0a6bd09519d0dfd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 23:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 415858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13662
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 22:56:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Sep 2023 23:08:54 GMT

GET
H2

200

B30016034.368171683;dc_pre=CP-8oP2suf8CFa7juwgdbvYFHA;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_t... Show response
ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/ Frame 0C5F
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B30016034.368171683;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rdid=;tag_for_child_directed_treatme...
https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B30016034.368171683;dc_pre=CP-8oP2suf8CFa7juwgdbvYFHA;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rd...

42 B
118 B

55ms
54ms

Fetch
image/gif

172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B30016034.368171683;dc_pre=CP-8oP2suf8CFa7juwgdbvYFHA;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?

Requested by

Protocol

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f198.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N5295.134426.GOOGLEDISPLAYNETWOR/B30016034.368171683;dc_pre=CP-8oP2suf8CFa7juwgdbvYFHA;dc_trk_aid=559032773;dc_trk_cid=193145451;ord=3596587255;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0C5F 0
0 79ms
79ms Fetch
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEAgqeMOEZK3rBZGxiAOUp6iQBYKppYJxnK6u2poR2dkeEAEgk-abN2C7BqAB8MbVtSjIAQGoAwHIA8sEqgTHAU_QQwDeKXivO-qOC_3r762xy8w5uelYS2dQtBHzugmRIl7lgUmpCfXQCs0RsRi0544zzFDlajPMnMbOvx5dbJxuReANsxw9de6MS6AsgD5V54tbj8tFxqloIfWU_IkvB5DbKTC4NLHcx9m0r4rZGZUhudhHl22wc8Aqu5qxwgXXR9MAPcxbNEQN_srt2KNDVln6IiYLEk8HmS7pN-ORvvGOTo2f7JvFjHBNgC9sIydihGqtl_64R8tZvB5I_S2L3dHLot9AOALABIaNoKC9BJIFBAgEGAGSBQQIBRgEoAYCgAf1nZGzBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEIHjBdIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgHICwHYEwrQFQGAFwGyFxwKGggAEhRwdWItMTk5NTAyMTI2OTE0NzE1MRgA&sigh=x3t-NZyx4RI&uach_m=[UACH]&cid=CAQSPABygQiDEn7EY28Lgtac67ZwnBUphoRY_eneeRVUQ2AowiIPvbDTuSMrdPA3XJORbcBxBwbEDal8bTC_phgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=600&adk=930274632&adf=806768345&pi=t.aa~a.3529635075~rp.3&w=258&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&to=qs&pwprc=5667035941&format=258x600&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422391960&bpp=1&bdt=1783&idt=0&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc001ee1e439609c2-221fe09950e100ae%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw&gpic=UID%3D00000c46928c2e21%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw&prev_fmts=0x0%2C1200x280%2C1200x200%2C1200x280&nras=2&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1090&ady=1242&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=1&fsb=1&xpc=utgo0UyTt8&p=https%3A//downfile.site&dtd=5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 10 Jun 2023 18:39:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame CFFE 1 KB
643 B 34ms
33ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 19140
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 13:20:52 GMT
etag: 48472445140208031
expires: Sun, 11 Jun 2023 13:20:52 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 9366381578140870791
tpc.googlesyndication.com/daca_images/simgad/ Frame 0C5F 29 KB
29 KB 33ms
33ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/9366381578140870791?w=360&h=720

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f8d6e6ed530dd7805dc1c6e20c27e2c9c066d838f0da01421bf42bbc8fa9393

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 14:06:42 GMT
x-content-type-options: nosniff
age: 16390
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29229
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 05:20:49 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 17 Jun 2023 14:06:42 GMT

GET
DATA 200
OK truncated
/ Frame 0C5F 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f15915524a54e004f2f8c1cc89a64f0a491c0fb6914a5a75293644322bc719f4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame CFFE
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDUadj5B-MBpx-LRzIPcihc&google_cver=1&google_push=ATf1kGPryRhcAfnUPwooSizw-boNyE7W8RYE-wxa_YOXmkFMy86y7vkHqpD4fuxb6FZWLeFiuG2vpExAH-4eL8QwooKxxi_r_KFfaOs
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mzk0OTM2Mzk2NDg2MjUwMTI2Mw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDUadj5B-MBpx-LRzIPcihc&google_cver=1

43 B
398 B

49ms
26ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDUadj5B-MBpx-LRzIPcihc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1995021269147151&output=html&h=600&adk=930274632&adf=806768345&pi=t.aa~a.3529635075~rp.3&w=258&fwrn=4&fwrnh=100&lmt=1686422391&rafmt=1&to=qs&pwprc=5667035941&format=258x600&url=https%3A%2F%2Fdownfile.site%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1686422391960&bpp=1&bdt=1783&idt=0&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dc001ee1e439609c2-221fe09950e100ae%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw&gpic=UID%3D00000c46928c2e21%3AT%3D1686422391%3ART%3D1686422391%3AS%3DALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw&prev_fmts=0x0%2C1200x280%2C1200x200%2C1200x280&nras=2&correlator=5878854364812&frm=20&pv=1&ga_vid=760644947.1686422391&ga_sid=1686422391&ga_hid=189914362&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1090&ady=1242&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759842%2C44792108%2C44759926%2C44759875%2C44788442%2C44793498&oid=2&pvsid=2600928889236331&tmod=671800560&uas=0&nvt=1&ref=https%3A%2F%2Fwww.google.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=1&fsb=1&xpc=utgo0UyTt8&p=https%3A//downfile.site&dtd=5
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEDUadj5B-MBpx-LRzIPcihc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame CFFE 35 B
465 B 107ms
33ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJcsUuQnUA59swe2fuIKsUs&google_cver=1&google_push=ATf1kGODMvAQrDp5SYAIgnVaQeCbGoTDJ6otrZEkmZ3YSZqkgFjFz94Dx2OdErhg8zLRuQMKK4AaV3TvYLBmvcsCCeEoVli7WgBUg30

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CFFE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGiRfOtMLz3z4z1ctrN8948&google_cver=1&google_push=ATf1kGOOaytCs_RTET492dAxSwzirKQ4HGRioehx-AUf69BXHGVDll25X6jDLIGCiyph4osmCBnUMeeZ8F9M3AQL...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOOaytCs_RTET492dAxSwzirKQ4HGRioehx-AUf69BXHGVDll25X6jDLIGCiyph4osmCBnUMeeZ8F9M3AQLjFk0vsGJLgVk4FI

170 B
232 B

44ms
43ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOOaytCs_RTET492dAxSwzirKQ4HGRioehx-AUf69BXHGVDll25X6jDLIGCiyph4osmCBnUMeeZ8F9M3AQLjFk0vsGJLgVk4FI

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sat, 10 Jun 2023 18:39:52 GMT
Server: MT3 986 b247903 master zrh zrh-pixel-x14 config_version:"359"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOOaytCs_RTET492dAxSwzirKQ4HGRioehx-AUf69BXHGVDll25X6jDLIGCiyph4osmCBnUMeeZ8F9M3AQLjFk0vsGJLgVk4FI
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sat, 10 Jun 2023 18:39:51 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame CFFE
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEBjGCbS8VNZdkcIJoWoT43Q&google_cver=1&google_push=ATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEBjGCbS8VNZdkcIJoWoT43Q&google_cver=1&google_push=ATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9...

43 B
443 B

195ms
185ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEBjGCbS8VNZdkcIJoWoT43Q&google_cver=1&google_push=ATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:53 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d53bd542aa6b96e-AMS
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 92
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEBjGCbS8VNZdkcIJoWoT43Q&google_cver=1&google_push=ATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGNvhjYRkb_h26bCuVSIUPQgEv6KUddYUa7gthCt9zU2ci_xelfPeY7JZJvk-D37NdA_eTTPVY4Zah0nXswvocX92yMDvV9QJ-8%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d53bd530900b96e-AMS
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CFFE
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKaPSuy6HsYq9ZFREyhE45Y&google_push=ATf1kGNJmtIlPiD3QG-N7ZKAX7MseherwwbJDxArwzOJg7VOZbg5VusHR7...

170 B
188 B

44ms
43ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKaPSuy6HsYq9ZFREyhE45Y&google_push=ATf1kGNJmtIlPiD3QG-N7ZKAX7MseherwwbJDxArwzOJg7VOZbg5VusHR7yqOLai2llF41mOSMj9G85IM6DrFbJ_tW6xCNl1jbDGFcY

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-ams21025-AMS
pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1686422393.823401,VS0,VE85
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKaPSuy6HsYq9ZFREyhE45Y&google_push=ATf1kGNJmtIlPiD3QG-N7ZKAX7MseherwwbJDxArwzOJg7VOZbg5VusHR7yqOLai2llF41mOSMj9G85IM6DrFbJ_tW6xCNl1jbDGFcY
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CFFE
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEKBK89KBg9ZnkDO_m63JW-g&google_cver=1&google_push=ATf1kGNC6fQScTfiv24wHZu9D6sPLwv2IB6Yw01FkQnQr3KakblRPlPO3X4FuZwzI5YyPRnOlqVq62IxDXmuOo5755sZD3VsW8N7fcA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6A3488F9C75C48C58C7F56E4E7400DAB&google_push=ATf1kGNC6fQScTfiv24wHZu9D6sPLwv2IB6Yw01FkQnQr3KakblRPlPO3X4FuZwzI5YyPRnOlqVq62IxDXmuOo5...

170 B
232 B

43ms
43ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6A3488F9C75C48C58C7F56E4E7400DAB&google_push=ATf1kGNC6fQScTfiv24wHZu9D6sPLwv2IB6Yw01FkQnQr3KakblRPlPO3X4FuZwzI5YyPRnOlqVq62IxDXmuOo5755sZD3VsW8N7fcA

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 10 Jun 2023 18:39:52 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=6A3488F9C75C48C58C7F56E4E7400DAB&google_push=ATf1kGNC6fQScTfiv24wHZu9D6sPLwv2IB6Yw01FkQnQr3KakblRPlPO3X4FuZwzI5YyPRnOlqVq62IxDXmuOo5755sZD3VsW8N7fcA
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 09 Jun 2023 18:39:52 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CFFE
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESECx1eE2xLkCJcYMq3J5zcys&google_cver=1&google_push=ATf1kGMk0JqWNlO3xG4fMYG1qEHaSlR8-2eSIoJu9aHei3yS2lKUmPMgOechW9xwAm...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGMk0JqWNlO3xG4fMYG1qEHaSlR8-2eSIoJu9aHei3yS2lKUmPMgOechW9xwAmw85T0hgCEkJE6e1NRQtiiIQY_-ulIiAJxCwV9T&google_hm...

170 B
329 B

44ms
43ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGMk0JqWNlO3xG4fMYG1qEHaSlR8-2eSIoJu9aHei3yS2lKUmPMgOechW9xwAmw85T0hgCEkJE6e1NRQtiiIQY_-ulIiAJxCwV9T&google_hm=0yomNdsbSTCzA5_9OIJYXos

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:52 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=ATf1kGMk0JqWNlO3xG4fMYG1qEHaSlR8-2eSIoJu9aHei3yS2lKUmPMgOechW9xwAmw85T0hgCEkJE6e1NRQtiiIQY_-ulIiAJxCwV9T&google_hm=0yomNdsbSTCzA5_9OIJYXos
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame CFFE 0
130 B 128ms
43ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Le7XHln3l3QymgNhRlFT5iQlFlEuxT8BnZUh2s_0_dJzgqy7DYQpDRpukSEllzOfqPwscLGQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 redir.html Show response
p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 8B23 247 B
868 B 129ms
40ms Document
text/html 172.217.16.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f3.1e100.net

Software

sffe /

Resource Hash

ee906d8aa47f1b32f44a3e19659ccd25be18aa8b707ac5e4c704d3c9fc610312

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 203
content-security-policy-report-only: script-src 'nonce-NiUMPu9VaehIrC8jYlYWOw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:52 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Mon, 02 Dec 2019 20:15:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1BDC 0
10 B 33ms
33ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?kZRQpw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 18:39:52 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 iframe.html Show response
p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 8B23 5 KB
2 KB 41ms
40ms Document
text/html 172.217.16.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f3.1e100.net

Software

sffe /

Resource Hash

011e268910d2c8ed66ce50b2968d84e5eccdf8d4b1faedd029b77740ee09c2c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 1987
content-security-policy-report-only: script-src 'nonce-vhoL6V_JRDP2AJD9C1hyzg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Sat, 10 Jun 2023 18:39:52 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Fri, 03 Feb 2023 22:38:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js Show response
pagead2.googlesyndication.com/bg/ Frame A597 37 KB
14 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/TH3Zs8Ev3pHjJfWkL7wPbYNWbVKLYksLSDPKh6nMP2Q.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Sat, 10 Jun 2023 08:16:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37432
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14492
x-xss-protection: 0
last-modified: Mon, 05 Jun 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 09 Jun 2024 08:16:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DEC9 42 B
64 B 74ms
74ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuvqkF52F3Hq6YjAjpXvICfLPd-OT4ws85iSd1_pe_7di5zQF4QoNoJ92MwDXyqVJsQ7EHWg2u57vCWOdGphI8iohykdq0Jz2Q3P4UErSDYUWt6_9g5mfCnKHTpOyqYH0Nk1S6mxi2Cb-2K&sai=AMfl-YTNwvhq70jIPH3jSv6Yy2iSTYZkbBP6tElwlZUcskjwFUMM_bEFYB3BX7A7251Ym_oPhjWx-dqNWhh0&sig=Cg0ArKJSzNC2UvLeEqoHEAE&cid=CAQSGwBygQiDTMcaWWIj5Brsf8cRZQyW38eBZVyR-xgB&id=lidar2&mcvt=1001&p=0,0,200,1200&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20230607&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2849340346&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686422391168&rpt=961&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EABE 42 B
64 B 78ms
78ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstPYEOxR1Y8lMCeu06zVpk1HsnhXe6GwMHR-Pa28JZKis-gvylYgF3B2b8m6Az4Jfzykt-codllN3wcIW_ey5i6HoliWjZDDCWh7fCV96x_2QZI3LC13_DhZ3I36LWAOKVVo9uqT0lP_rUC&sai=AMfl-YRUFzD2deHL3SPVgVK41hqH3UNEJkjkOxYWNkcw54PFpQUdEw-4KSV1IB2bBrM2Z3lpZvWA1K0patiu&sig=Cg0ArKJSzL41ZxgjtDs6EAE&cid=CAQSGwBygQiDQC-5wD8RFFhWsC9nLxybWVoNvUH7DBgB&id=lidar2&mcvt=1000&p=0,0,280,1200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230607&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1423715733&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686422391159&rpt=1041&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FE93 42 B
64 B 76ms
75ms Fetch
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvCzUfq5AHJHD9z1z2lEphSaETCQZqvRI4wberv0hyv_g5JTZfv6LatMmBPZbAiYS7hzH0L9GeI9cyg4_KaPa8nbstAcuunx8WmypxLky5hf8odpdgguUSCTruD-pCexgjEt5ChEMVcqK71&sai=AMfl-YSvdsSjQExqmibEVZK6xYAjDF0gzVvMrRAA6Vjsbn5Y6fSNRwlnN0U4SLkS-WjruNXLwNhFVq4LljPu&sig=Cg0ArKJSzDyqc4W229pXEAE&cid=CAQSGwBygQiDwBQQQF1614ha7K0M1ppDC1TvmFq9vxgB&id=lidar2&mcvt=1000&p=0,0,280,1200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230607&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1958193327&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1686422391173&rpt=1043&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 10 Jun 2023 18:39:53 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 77ms
76ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230607&jk=2600928889236331&bg=!mJulm8_NAAaGYqkwpmI7ADkAdvg8WhNfY07AsGHPNEYe3SDYX_wuHpAnaLGxXEGp5Hy8U5uun3VwHRtk5lC6-YxTJurO1edYE5wCAAAA91IAAAAEaAEHCgCLX5LbyG-6S3WBXGTsZkWU8dZHDXNEg7KsGKLOdpSOOQzZBvN9N_w9rfGiox7Ndyb6fqPwdw8Htt3S93qrv34vz9P3f8-iEXjasSSnGIj08n1-Y28h8cRbbcXgYkt1km_IuxTNPu9vQm81sqVhztL-nJzOU-J2vMs2VDq7DMwOuCuhHbYt2ar0nJD7NpkC-dXzGYGHSRNzJlUrRYens2KWN5ifBqt5ETP9TeaRzCEwGSl1XqkdnjT7vfYJ-NBNJDMKoVwehGBmlCQcx-SQszsDFKFh3nJ3yopbwri98_DdWJXI8QgKLDlJ8RLhUHcVCNELeUVMZFq4NHRANF4U3UTx1-RyV6RixJGUL9n-2YV7DnNVQOds6fv5l2PchWAcczgY7ADfXXi5rrd9Z5JGKuBE-Eo7pgD2lF_aL2-A5CpLdBTr5r0YH4T1DiIedEpNw57b7iPJ2wurPL1smL1I7oW_iOAbcomJZVDANzzUYBR14yOvqdL3P6Pl9JOuI3w-nMINGPOls2I_KDwxwKQgkCF1UP0v16M9VH-A7jUF3EvYZLpTlq8aPn3XZEvscwgPS2mzl8cI-tqqYmsnR5yrBcoBIIf3ANkLLqau70ww9bmU1twT6E5kSFLJ9i0I6zMlRSvehpkRCDFB5-u-L3M2ubbTB4ACbDzXwOurAD4QpI53z7150M3qvcoNe5OnkTEJILMIQgyoL6ayEDtZu2XBOE5NqyW0kp8tKOP7lYbiCTftmSBRRnjAAWm0hKqAkm43TVT31-BcgX5Z46DJNC-r7J3YXNJU0YmK5zupEx_Se7lCM0hRuIW2-46VphApSJ0Mj1ercGKhpticxvMkTG8yMQDCOs4ybKX0JkJ4n6JcNAcM5-HCkjU-_Hv8T3IEH8H_PNSymIXMYn1SZuB_dhh_6wmVgaUiLSssBRvsuOBOUCIKrZuITyZ0JuT3s1XkrKAe5_o_0m2htGCDIBn5T3r2XaB4FpOBUMv6fi0ejSuoi1Zrgk3poHBLuMm2UB9xLAE0aITVjVERj7sOsuJl-3xJ-rByFvaqZZsWF0oi03HhwC5AsoxCOQWsd5Nihpv9-c8TCcPCz-6eSk3RFzKALIx_j9xvQL1l800hwyV0fQ7fisqeKZNr_lW4bP2v_6cyyBGHeL6i6qUW_7Xd1AGvV9vEFCEvYtdixptpdpjEt_foGRnT4L_t4_42Y31Z
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

GET
H/1.1 200
OK intro-img.png
pushtimize.com/images/ Frame 56F8 58 KB
59 KB 1294ms
505ms Image
image/png 167.172.77.196
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pushtimize.com/images/intro-img.png
Requested by: Host: downfile.site
URL: https://downfile.site/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 167.172.77.196 , Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: d30ab40463a8b009140d0bf61bcde20e99c7f1ef2cf37b4ec15feda8ba5bd5f2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://downfile.site/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Pragma: public
Date: Sat, 10 Jun 2023 18:39:54 GMT
Last-Modified: Fri, 03 Mar 2023 07:58:51 GMT
Server: nginx
ETag: "6401a8bb-e99c"
Content-Type: image/png
Cache-Control: max-age=2592000, public, must-revalidate, proxy-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 59804
Expires: Mon, 10 Jul 2023 18:39:54 GMT

Verdicts & Comments Add Verdict or Comment

118 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
get.megafly.in/	1969-12-31 23:59:59	Name: AppSession Value: nv0kounrgh01aisf5g7s86rj3k
get.megafly.in/	1970-01-20 12:27:02	Name: refH1niYNIw Value: MDc0NTRkY2RmYWJmZDFiYmNhOWU5MTIxMDA5YjQxODI3Zjc4YThlZjFjZmQwODVjMWY3ODk3NGRlYTNhMzU2MqFpHJBMgvmkEcIC%2FTZy50bQ%2B4r3KD6VCMj2aMZ%2Fotnw
downfile.site/	1969-12-31 23:59:59	Name: cap_y Value: 11
downfile.site/	1970-01-20 12:27:02	Name: JSON_fetch Value: /H1niYNIw
.google.com/	1970-01-20 21:56:49	Name: __Secure-ENID Value: 12.SE=GAWOt-6YXVuS75vRpvtgcAV7skI16CV2jnwU8FNIqXuzmO_2A6AZVuYnE34Dr0zkEOnW_lDpoaqA8qUIfsVS1nKwVHrNOToNPcVhdV4RZv0qmIeTsr1rZWI1mBZaB54nsQvHNRXZxSFAsZuZTxWlmjdRdrZIpnCQiZo7odQ9b4Y
.google.com/	1970-01-20 22:03:02	Name: CONSENT Value: PENDING+785
downfile.site/	1969-12-31 23:59:59	Name: mwai_session_id Value: 6484c3756f671
printsmull.com/	1970-01-20 12:28:28	Name: GL_UI4 Value: eJw9jd1OhDAYRGH5W3VBJ%2BEBfIRWMexeGh9iL0lpP9i60G5Khfj2NiZ6NSeTM5koinb1I%2BI1T5F8iTc8n46sHSSR5JI1x%2BG1bXh%2FemHEBGvaZmhxp5fOi34in2K%2FzML5zq8pDiMZclp20ioq8RSsv%2BZq7GZSZL0TRpXI5mBMJYre2W0hVydIjZgJ%2BcfF2ZDZLD6tQ8J5E1ibwDHDzi51Ut2jOGujwrA6YMdZVeURHm6T8IN1c6dVHiMbnVCE%2BB17KTyN1n2jULRcvb0BdlLdv%2F%2F7m2ycIVe0ahnOrb%2BQ%2BwENTE4o
printsmull.com/	1970-01-20 12:28:28	Name: GL_GI10 Value: eJxNjM1Kw0AURtOJDobUyAc%2BQF%2FAoTG6cKsuuihZKLhwE0Jy2w40c4eZWzE%2Bvf0B6%2B5wPs6XJIm6LaCsR1GV5n7%2BYMrHuSmrJ6RrYqh6iWnHOydhbFw7EPKaZENh27o%2BQgdaW3ZQnwvkJ2467gmX9fLunzuW1%2B%2B8k81swdtDjIvOyojsjUUo9O2A7CBO%2BXSfn4fURo%2FcVq%2FGkcyezQeyPTTRE%2FXIXjh4Dq0Qij97fNEprmxsfODvUU9wI3agH3bU8GoVSbTC5Eunv1zTTZI%3D
downfile.site/	1970-01-20 21:12:38	Name: cookielawinfo-checkbox-necessary Value: yes
downfile.site/	1970-01-20 21:12:38	Name: cookielawinfo-checkbox-functional Value: no
downfile.site/	1970-01-20 21:12:38	Name: cookielawinfo-checkbox-performance Value: no
downfile.site/	1970-01-20 21:12:38	Name: cookielawinfo-checkbox-analytics Value: no
downfile.site/	1970-01-20 21:12:38	Name: cookielawinfo-checkbox-advertisement Value: no
downfile.site/	1970-01-20 21:12:38	Name: cookielawinfo-checkbox-others Value: no
.downfile.site/	1970-01-20 12:27:04	Name: __cf_bm Value: O04ClZnB0BAK2UO6i1YKhoR._H2N4AlDiK5c2MTOJhQ-1686422391-0-AREr07eUlX53/dFnx1edvHs6Y4LH7bxNYg4ykAkmPnk/XxWi457H+Cmg/UV6tv1s2g==
.downfile.site/	1970-01-20 21:48:38	Name: __gads Value: ID=c001ee1e439609c2-221fe09950e100ae:T=1686422391:RT=1686422391:S=ALNI_MazfDpOkS7TSVf7oe_rqQ4_w0glmw
.downfile.site/	1970-01-20 21:48:38	Name: __gpi Value: UID=00000c46928c2e21:T=1686422391:RT=1686422391:S=ALNI_MZ33CU1LE4cozIxt9kUorwQCN4NSw
.doubleclick.net/	1970-01-20 21:48:38	Name: IDE Value: AHWqTUlF-PfpO6kpTJjeX8jsoJRqElDU2F27BEUtbMXUCUqaSOetgqrgm1b4emLCIeQ
.doubleclick.net/	1970-01-20 12:27:05	Name: DSID Value: NO_DATA
.ctnsnet.com/	1970-01-20 21:12:38	Name: cid_d32a2635db1b4930b3039ffd3882585e Value: 1
.ctnsnet.com/	1970-01-20 21:12:38	Name: gid_CAESECx1eE2xLkCJcYMq3J5zcys Value: 1
.quantserve.com/	1970-01-20 14:36:38	Name: d Value: ECgBCQGZKYEA
.quantserve.com/	1970-01-20 21:57:16	Name: mc Value: 6484c378-c6b15-922b0-9d8b4
.simpli.fi/	1970-01-20 21:14:04	Name: suid Value: 6A3488F9C75C48C58C7F56E4E7400DAB
.turn.com/	1970-01-20 16:46:14	Name: uid Value: 3949363964862501263
.mathtag.com/	1970-01-20 13:10:14	Name: mt_mop Value: 4:1686422393
.everesttech.net/	1970-01-20 21:12:38	Name: everest_g_v2 Value: g_surferid~ZITDeAAGiF0i4AAD
.tribalfusion.com/	1970-01-20 14:36:38	Name: ANON_ID Value: aentmIu4YUdmqcn63g82ZcltaYZaN6gGaHdeUVYlRrnJD0aanALVF6btkOZcWaPoSeFFEYHZaSVayFSs2ZaOpfO6pEmQ0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'unload'.
security	warning	URL: https://api.trackpush.com/sdk/v3.js?pid=eU--NOUImKP7N0TXEmxdEg&sw_uri=%2Fservice-worker.js Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
ad.doubleclick.net
ad.turn.com
adservice.google.com
api.trackpush.com
cm.g.doubleclick.net
cms.quantserve.com
downfile.site
fonts.googleapis.com
fonts.gstatic.com
get.megafly.in
go.megafly.in
googleads.g.doubleclick.net
i.pinimg.com
ius.ctnsnet.com
maxcdn.bootstrapcdn.com
p4-csai2pnvn7sju-ecmtgwknkw2eo5jg-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
printsmull.com
pushtimize.com
r.turn.com
s.tribalfusion.com
sync-tm.everesttech.net
sync.mathtag.com
tpc.googlesyndication.com
um.simpli.fi
www.google.com
www.googletagservices.com
www.gstatic.com
142.250.185.130
151.101.66.49
167.172.77.196
167.172.77.229
172.217.16.195
172.217.16.198
185.29.132.245
2001:678:cb4:bbbb::11
23.109.82.119
2606:4700::6812:19ad
2606:4700::6812:bcf
2620:116:800d:21:93ca:31d8:d86e:38f6
2a00:1450:4001:809::2002
2a00:1450:4001:809::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:812::2001
2a00:1450:4001:813::2004
2a00:1450:4001:827::2002
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a04:4e42:8d::84
2a06:98c1:3120::3
2a06:98c1:3121::3
35.186.193.173
35.204.74.118
000e57d85fb02acc1f718b112cf090c0b8eb50577785d3f3b4ef9a1206886d01
011e268910d2c8ed66ce50b2968d84e5eccdf8d4b1faedd029b77740ee09c2c0
02f40d2a81d91a58f36aa00e54c7e04c1680e2d7ab8e0c120eb292a8b24af64d
0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2
09a0cf602f51c5b2638706d117b1c10bf4e99a20199e51987c40923c52c134a2
0af317edf2dabf1eb6504804139cfc7c35a1f826d1f12863560c16547fcc9591
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0f8d6e6ed530dd7805dc1c6e20c27e2c9c066d838f0da01421bf42bbc8fa9393
10319e9e75c5bc85d6f6b23efe1ba006b2bc3e848a9070a6e32c1aa77dba0cfe
1094273e95ea266c7f305dde338e612fe826f985b679274b7dae063d98522d6a
11cc1dac4486f2d0fed9ad7a64a616125fa2d8b5fb13c0a45cc8d80fdc0beb11
174066535cb768d1715ae34808cd4e83f16f23715524bfff79db8860e8c03296
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1dcd3307cddca8b8b419e19a8a6b715ae7c3ee8328ce07e54343fa0a4b574eae
248e651cd45e76b923ecade68e0712ff6f9cdbaa8faf2546a83ff0369456aff2
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
2f39d54e71a3c475b8a65cdcdd903b249e8b8a4538f6c8f0b1f8b3c34a093302
2f414dc5bd61502c09b991b0ce6f3c6554bc84734fd83834d55e719d048efd1d
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32bdbc7aa942ed3cc380c72be1c45147f4d7ec5e6b5b084f6527a46022314958
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3c26ce64b83332761bbc5b6db70e8ba5dd4a9992db036918ae6eae448d48d2ea
3cdc8768b77b752d62d488cda4d7917a5df5d334da0f7fa7c9f86aeae573923b
3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e
44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e
4688e58af12153b8d216794a3f8deb0c185b7786549b43c8fa1dbd842a741fe7
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
49069d700b469ef6821edbdaa3169547a71f90813c3921417a6c0ed72348d389
4c7dd9b3c12fde91e325f5a42fbc0f6d83566d528b624b0b4833ca87a9cc3f64
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
52cb98a1af1fc5baffd9b52cf9b1c54d56c72513d95d9a309d6f9d509e62133f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57d35f39158ef6990a75261c466b5c93e3f441b5b05426a35975fc3f31c19c45
5aa0d36297128d02e99250bcb2ba512fa801ff7f3ad8f7986771d672652521d6
5adbe4f547eb03b7586fc6575e7e4f55a204e943058cb5d3091145814014af81
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61415dedc00f8ae867238c2b415e7ebc4b38c627da596472f7a9c14a451539cf
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
6c52384c7b0641dd1ead85d079c22d39bcc6dc5f2537afb1e6396bb619771a3f
6d41be9e204c927af5e301dcac58480d8fff0113d78f22358481854ae50f7e0e
6ec410157473bd79702005c79167a785edf2d04ac538b6e31dcd4bd798de1c04
6f6afb4882995bfc4d4023b9567cfbec2866639de4da43a19d46838ae2b5fc5e
70a07f56582f4cdd50a0aaafbc5820343026d1beaec8e207a4c42ca07e724a96
77c5462466c6b10ff39c4b605f1aa7cb1add781cc86d17e5d17f7fde40b91099
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7c8eb7fd8354e29e58e77290872b6e05a65404a4d16fe26996b72b6f2f606281
7eb097682f8169d286031887e3b3e6d623c7e908c27bcba031b18e3c55b70a12
90a61f9c67108ba2f341489d0e12eedf9b6aad417577aef38ab876ebc36c7750
925cdfda26b6689ba7e46012787c43c5d3f5ae08de18fb0754105594d2f7cca6
94304dca9a49e7472c3636b4158f6ca020faabecd58f4c6a1c97471226458808
972e5d4fbbe753a6465cf0c10446388f81cd32d7ba3401dfe5d9639136cd63c9
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
98b57554fb9a42fe0bac070bd70ebd23a2e32787293bf25732cc665d5450125d
98ef203bd7d0a0982bf50133f2ef546c8de7a44cfd3c8f19ceb6db9db11c5fcf
9971c0a9e4d487abeaf7f2396426a237081c2271bc17cdcd6883495ff43b3fc1
9a68796fe1b2a505499b0a8692cb34fc45bfefb8692c9cac72e447da5498d6b9
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b9cd9fe6908b3b0c3b715a3d16cb22c26c7da7b439b745cb0cb61a1d3730942
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a26d15e93261deb33aa10af9733c3d74eeac94fc86b20ce4646b8ce8bd316b07
a2a67d498a96b3441f7687fc3513df6e17b41241a843d06528ab70f8bce00d64
a3c8d1021bd2ee3bb73e29d8fdf79a184be2c6b5ef6ba41b0a6bd09519d0dfd3
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a922e9358507066ac8efb549e3009267afd9e0bd4c8d501bf10cdb9d823bf0e1
aad199c0ba6d03cc38d34fa83a7eb0687eb1728d37891517a253b834b0da4fbf
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
b0a8bd74d2a1ff5ccd5a18c2d054a74b9b260258861a358b5faddc4f8a62f703
bee703e84301b68e9e16dd7b56f73dd67abb1bb9e0348c2ad14589ec8099c848
bf83e2af5872b1344ab1526f8cdee831898adf5cce07a643ff99225cfe95875e
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d262b04633fbcfb934184c79a2d1786fa24576ad6f7ccc40c5ba0aa540de9d54
d30ab40463a8b009140d0bf61bcde20e99c7f1ef2cf37b4ec15feda8ba5bd5f2
d6f5aedf67284aeeaaaa0c532e71c40757fa449038d89d63c5e90a1ded226643
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
de10fbd9fb1cd26d524d0face1615d58623b08581cf044efb6221e6fab4841b4
de6f406cbdf047ad2d474ba129f0d3a8839c9e6c1201c0b6d8e6938cbdf6d2cc
e19c38420301ea62122458a60d7e15f6ff0daec36501d0f00588a9798180b73b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
ebdb9e520559d8729e2d5497e1e3161033513af76c836fdb095dbb146acdad70
ee906d8aa47f1b32f44a3e19659ccd25be18aa8b707ac5e4c704d3c9fc610312
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f15915524a54e004f2f8c1cc89a64f0a491c0fb6914a5a75293644322bc719f4
f44571e7a0796f312888fe3e8f70a98725e6b1a1717d5f2992134a18539d1dd6
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
faab7595947aeac0a80b2d513b3a176c71542b3e3ba3ab5af5e9a85354dc246f
fbb222c9c1b8804a8fc12ba2dd3a0e11cfea670544c2e717944d53bae31a512d
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
fe1c72533d1d0d06f4b5b7b8f8a664d57df5bc169afe25414cfb20667e4d1076
feb7837d1424e6bf9cd7e591a1576f31a09c340087fe23d99928173e1ce0328a
fed60534b69e35bffbabc824a687db7ae4e2a8693b94dd3e14b9d398af412d71

downfile.site Open in urlscan Pro 2a06:98c1:3121::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

159 Requests

94 %HTTPS

62 %IPv6

21 Domains

30 Subdomains

22 IPs

5 Countries

1915 kBTransfer

4711 kBSize

29 Cookies

2 Outgoing links

Page URL History

Redirected requests

159 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

downfile.site Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Screenshot
Live screenshot

Full Image

159
Requests

94 %
HTTPS

62 %
IPv6

21
Domains

30
Subdomains

22
IPs

5
Countries

1915 kB
Transfer

4711 kB
Size

29
Cookies

159 HTTP transactions
8 data transactions