www.bg3.co Open in urlscan Pro
84.17.37.44 Public Scan

Software

sffe /

Resource Hash

1d06186935333e9e0054906d58a51794a743376d1b71dc55df78e65debcc9820

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Tue, 22 Nov 2022 08:19:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72561
x-xss-protection: 0
server: sffe
etag: "8982a451fc00c1b3"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3000, stale-while-revalidate=1206600
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Nov 2022 08:19:48 GMT

GET
H2 200 amp-sidebar-0.1.js Show response
cdn.ampproject.org/v0/ 31 KB
10 KB 1484ms
942ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-sidebar-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0535100df27c6d49a6d1c06b7f98455bf0cdef6ae63c4c168b5cf1f170c14c51

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Tue, 22 Nov 2022 08:19:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9664
x-xss-protection: 0
server: sffe
etag: "6079829c87823654"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Nov 2022 08:19:48 GMT

GET
H2 200 amp-auto-ads-0.1.js Show response
cdn.ampproject.org/v0/ 24 KB
7 KB 1439ms
916ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c71445ec9538a4d031b32ba0f044ae793aac625896846f838f9c8abace99c08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Tue, 22 Nov 2022 08:19:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7578
x-xss-protection: 0
server: sffe
etag: "1ef491f2ce412f6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Nov 2022 08:19:48 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ 109 KB
31 KB 1181ms
659ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

878674d3e2986e2a0da06a414498ebe39c165c2e22624600ee179ec9df149105

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Tue, 22 Nov 2022 08:19:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31953
x-xss-protection: 0
server: sffe
etag: "eddf6e9f984d26cc"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 22 Nov 2022 08:19:48 GMT

GET
H2

200

sdk Show response
cdn.aralego.net/ucfad/sdk/apac-sg/
Redirect Chain

https://ads.aralego.com/sdk
https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk

44 KB
44 KB

448ms
153ms

Script
application/octet-stream

104.26.4.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Server: 104.26.4.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e6703fbe9ea598731ec6ef75a281564d956ef79f08bc2b61849ae9a21fa35cb9

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:48 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3974
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44566
last-modified: Wed, 16 Nov 2022 08:39:32 GMT
server: cloudflare
etag: "6374a1c4-ae16"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qtwzvAKfEwanxc7rMCidciHXMz23NDox0UiTQxE7yAELFuAn5loenOBkWC9PLj936CZ6SeeSWbdnivoHVeWt07QVHQ6VPZRCmWupuA51PGyI587ITqiT3yqAMYqW%2FIJpgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
cache-control: max-age=14400
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 76e03e056b29a7fc-SYD

Redirect headers

Location: https://cdn.aralego.net/ucfad/sdk/apac-sg/sdk
Connection: close
Content-length: 0

GET
H2 200 adRecover.js Show response
delivery.adrecover.com/43519/ 34 KB
9 KB 2307ms
1241ms Script
application/javascript 42.99.140.201
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://delivery.adrecover.com/43519/adRecover.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.201 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-201.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 91e8bd3a37b3a0951444714dc07c68417ac878ebf22d8c7b0d10b1ce3fec1122

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:49 GMT
content-encoding: br
last-modified: Tue, 22 Nov 2022 08:00:27 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=REVALIDATE, edge; dur=63, origin; dur=816
x-cf-geodata: NZ
content-length: 9035
expires: Tue, 22 Nov 2022 09:19:49 GMT

GET
H2 200 adpushup.js Show response
cdn.adpushup.com/42753/ 518 KB
112 KB 1445ms
388ms Script
application/javascript 42.99.140.161
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/adpushup.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.161 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-161.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6bfd228178a7920f79853de46df09c0a6ee732b6d92100be5bb99174d05a9c07

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:48 GMT
content-encoding: br
last-modified: Thu, 17 Nov 2022 09:46:28 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=8
x-cf-geodata: NZ
content-length: 114452
expires: Tue, 22 Nov 2022 09:19:48 GMT

GET
H2 200 ucfad-formats.css
cdn.aralego.net/css/dev/ 975 B
637 B 152ms
151ms Stylesheet
text/css 104.26.4.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/css/dev/ucfad-formats.css
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.4.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1be00e223b2840fe8ac2d3a1aec0cf757088dd68f53a92275d0e1db6cb9afced

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:49 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3245
cf-polished: origSize=1191
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Fri, 16 Mar 2018 07:19:46 GMT
server: cloudflare
etag: W/"5aab7012-4a7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UFBOBt5rg32MYRUovP7tW7jRQ8E5eD8vb7Y19PAQ5%2B8BmAPI9cDIvYrS9Q7VjNpeW4UoSzzybK90W4q9E1IA7hklBebVM0i1dZXiRu%2BxDS4s5n4gTWa496THVKoRRXrsPg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
access-control-allow-credentials: true
cf-ray: 76e03e074eb5a7fc-SYD

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 1071ms
267ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 531ced95d00fc8c26a6140869fb583238b0ccf457b7bb9e98d42d6b8a29323d6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:49 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK idRequest Show response
sync.aralego.com/ 46 B
488 B 1066ms
269ms XHR
text/html 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.aralego.com/idRequest?lang=en-US,en&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 531ced95d00fc8c26a6140869fb583238b0ccf457b7bb9e98d42d6b8a29323d6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:49 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 46

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 767ms
298ms XHR
text/html 209.58.171.197
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=0&cb=0.6969074843844896&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.58.171.197 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:49 GMT
X-Width: 336
X-Height: 280
X-AdStyle: banner
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Expose-Headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
X-AdSource: PSA
X-Adtype: html
Connection: close
Content-Length: 508

GET
H/1.1 200
OK ad_request Show response
ads.aralego.com/ 508 B
1 KB 760ms
292ms XHR
text/html 209.58.171.197
LEASEWEB-APAC-SIN...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.aralego.com/ad_request?sw=1600&sh=1200&ifr=0&bl=en-US&je=1&dnt=0&host=www.bg3.co&u=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&adid=ad-627443DBE4283AB9F7A46EA83243447&w=336&h=280&ver=UCX_WEB-20200113&pos=1&seq=1&cb=0.36539015262780494&gdpr=1&euconsent-v2=%24%7BGDPR_CONSENT_607%7D&format=336%2C280%3B&lang=en-US%2Cen&deviceInfo=8416001200&pixRatio=1&font=16px%20sans-serif&uaMobile=%3F0
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 209.58.171.197 Singapore, Singapore, ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG),
Reverse DNS
Software: /
Resource Hash: e813a8d8d41c0dbdc33020ad6ef27d16afd2b590ceeb998e267409c8f666b829

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:49 GMT
X-Width: 336
X-Height: 280
X-AdStyle: banner
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://www.bg3.co
Access-Control-Expose-Headers: X-Width,X-Height,X-AdStyle,X-AdCap,X-AdWatchUrl,X-AdSource,X-SspId,X-Deal
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
X-AdSource: PSA
X-Adtype: html
Connection: close
Content-Length: 508

GET
H2 403 28d81634c313753a21bc665585c23848.jpg
static.bg3.co/imgs/202105/ 0
0 453ms
154ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/28d81634c313753a21bc665585c23848.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 cec4c10be00ea08bdcd510f469c41ea2.jpg
static.bg3.co/imgs/202105/ 0
0 458ms
158ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/cec4c10be00ea08bdcd510f469c41ea2.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 b32953d7ba121b3f1b71636e1d30e8b5.jpg
static.bg3.co/imgs/202202/ 0
0 461ms
162ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202202/b32953d7ba121b3f1b71636e1d30e8b5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 e1436cc37f7ed1feac114d5899a38745.jpg
static.bg3.co/imgs/202105/ 0
0 595ms
296ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/e1436cc37f7ed1feac114d5899a38745.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 216f977e7f4583346fb8e96dc9fd023c.jpg
static.bg3.co/imgs/202105/ 0
0 579ms
280ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/216f977e7f4583346fb8e96dc9fd023c.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 96fc3fb41f6cb6c43a88b5c022dce61e.jpg
static.bg3.co/imgs/202105/ 0
0 468ms
168ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/96fc3fb41f6cb6c43a88b5c022dce61e.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 48a9b66b1cf29dee9a80738460eb8640.jpg
static.bg3.co/imgs/202106/ 0
0 481ms
181ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/48a9b66b1cf29dee9a80738460eb8640.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 6d7d95c7ca8aae470d024bd4c4e3f75a.jpg
static.bg3.co/imgs/202105/ 0
0 474ms
175ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/6d7d95c7ca8aae470d024bd4c4e3f75a.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 ba13a6a35f842137039c30bf646a6ed5.jpg
static.bg3.co/imgs/202106/ 0
0 487ms
188ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/ba13a6a35f842137039c30bf646a6ed5.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 56951135a1ce4b482d9dc0642f31e3e4.jpg
static.bg3.co/imgs/202105/ 0
0 165ms
164ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/56951135a1ce4b482d9dc0642f31e3e4.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 360d16e2e0e2d5c02bc22a67a7bca3a2.jpg
static.bg3.co/imgs/202009/ 0
0 158ms
157ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202009/360d16e2e0e2d5c02bc22a67a7bca3a2.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 4b80759c7182d17b2fb30aae1a08f5de.jpg
static.bg3.co/imgs/202105/ 0
0 149ms
148ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/4b80759c7182d17b2fb30aae1a08f5de.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 93fca3b3045adc99d4300c515054b774.jpg
static.bg3.co/imgs/202105/ 0
0 154ms
153ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/93fca3b3045adc99d4300c515054b774.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 285c787e33716ba1ada877e9771af749.jpg
static.bg3.co/imgs/202106/ 0
0 150ms
150ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/285c787e33716ba1ada877e9771af749.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 532a544812ea85acd9f33bf1f1919582.jpg
static.bg3.co/imgs/202105/ 0
0 155ms
154ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/532a544812ea85acd9f33bf1f1919582.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 9bf434ae2a9488e43763edf3c73d600e.jpg
static.bg3.co/imgs/202105/ 0
0 160ms
159ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/9bf434ae2a9488e43763edf3c73d600e.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 6d87b80b4b55d0de58212e4ead1d40e6.jpg
static.bg3.co/imgs/202107/ 0
0 151ms
151ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202107/6d87b80b4b55d0de58212e4ead1d40e6.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 57709a56727797d2e232247b877c2549.jpg
static.bg3.co/imgs/202105/ 0
0 151ms
150ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/57709a56727797d2e232247b877c2549.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 edb62dd17e0b1d806a0e202315ba68f3.jpg
static.bg3.co/imgs/202105/ 0
0 152ms
152ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/edb62dd17e0b1d806a0e202315ba68f3.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 0ee11825c03401b9afbf20363422426d.jpg
static.bg3.co/imgs/202105/ 0
0 162ms
162ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202105/0ee11825c03401b9afbf20363422426d.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 6aca811dfb99c1132a667b16cd4885ca.jpg
static.bg3.co/imgs/202106/ 0
0 160ms
160ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/6aca811dfb99c1132a667b16cd4885ca.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 403 17b2008f5720c0167e77878aa7fe0a4c.jpg
static.bg3.co/imgs/202106/ 0
0 151ms
151ms Image
text/html 104.26.2.91
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.bg3.co/imgs/202106/17b2008f5720c0167e77878aa7fe0a4c.jpg?w=150&h=100&q=100
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.2.91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 amp-auto-lightbox-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 8 KB
3 KB 270ms
270ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-auto-lightbox-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9367980d1a2a729754c9a6777d7236e9d49c662a197f00e210ba276d7e0aa6ac

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 15 Nov 2022 20:06:17 GMT
age: 562414
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2991
x-xss-protection: 0
server: sffe
etag: "413d5b5eb26df1c9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 15 Nov 2023 20:06:17 GMT

GET
H3 200 amp-loader-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 12 KB
4 KB 270ms
270ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-loader-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e76fa5f8f7b53855ef3a64bb458a6ff4a09da9a814e81d844c973008139f527

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 15 Nov 2022 20:06:01 GMT
age: 562430
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3936
x-xss-protection: 0
server: sffe
etag: "2e876f41249f1a45"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 15 Nov 2023 20:06:01 GMT

GET
H3 200 amp-ad-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 81 KB
23 KB 270ms
270ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-ad-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e005bd498c71a1e59de4a20aec621c9a51451e498778fb049957e17fca316f8c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 17 Nov 2022 00:15:08 GMT
age: 461083
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23066
x-xss-protection: 0
server: sffe
etag: "1b79e24071ca714c"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 17 Nov 2023 00:15:08 GMT

GET
H2 200 ama Show response
pagead2.googlesyndication.com/getconfig/ 2 KB
894 B 836ms
281ms Fetch
application/json 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/ama?client=ca-pub-3216231935713038&plah=www.bg3.co&ama_t=amp&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

292c23cd0cb7646eed1e5951fa827a4698507c5f45bab13797559eaeaafe8007

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 453
x-xss-protection: 0

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
31 KB 851ms
285ms Script
application/javascript 69.16.175.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:51 GMT
content-encoding: gzip
x-sp-metadata: HS256.CLeo8psGEogBCiQzMTg5YWE0ZS0wZDUzLTQ5MWYtOGU3MC0xYjNkNzliMjAwYzkQ6JCNkN3O+gIaBginjPKbBiINMTE2LjkwLjc0LjIwMiiciQIwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDY3OGJhZDI3LTM2OWYtNDVjZi1hMmIxLWQzYzEzZWVkMjEyZRib8QE=.bMUnH7mC7TBJrjBP/7fdQ2qn6TYr2oAiEEaAPBRUbDs=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-15d9d"
vary: Accept-Encoding
x-hw: 1669105191.dop032.la3.t,1669105191.cds224.la3.hn,1669105191.cds267.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30875

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame A021 99 KB
34 KB 847ms
290ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46144bf396b7270cefe1db95d23c7c467c08164fb6a13e4b2fd0a0d7351730b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34242
x-xss-protection: 0
server: cafe
etag: 9039974191432204062
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 08:19:50 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame B786 99 KB
34 KB 1168ms
615ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: ads.aralego.com
URL: https://ads.aralego.com/sdk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e38faebb5a6d42d74b0d294dd2b03c18f010247843533812c25b47e9d2850dc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34251
x-xss-protection: 0
server: cafe
etag: 13444292989094522988
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 08:19:50 GMT

GET
H2 200 jquery-2.2.2.min.js Show response
code.jquery.com/ 84 KB
30 KB 1003ms
572ms Script
application/javascript 69.16.175.42
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.2.min.js
Requested by: Host: delivery.adrecover.com
URL: https://delivery.adrecover.com/43519/adRecover.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: nginx /
Resource Hash: dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:51 GMT
content-encoding: gzip
x-sp-metadata: HS256.CLeo8psGEogBCiQwY2M3ZDZkNC0xY2Y3LTQyMGYtOWU5OS1kZTMyODYzM2NjMzYQ6JCNkN3O+gIaBginjPKbBiINMTE2LjkwLjc0LjIwMiiciQIwAzgEQhZUTFNfQUVTXzEyOF9HQ01fU0hBMjU2WiAzZTliMjA2MTAwOThiNmM5YmZmOTUzODU2ZTU4MDE2YRosCAESJDgzNDMxODhlLTk1NmItNGQ5MS04ZDI2LWVlMGRjMDgwZGE3YRi46QE=.4mnB/dqAxZGuvt1b7gyGWGk0RfNEvh1YxMnfeheSx/U=
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-14e98"
vary: Accept-Encoding
x-hw: 1669105191.dop032.la3.t,1669105191.cds224.la3.hn,1669105191.cds210.la3.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29880

GET
H3 200 amp-sticky-ad-1.0.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 40 KB
10 KB 271ms
271ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-sticky-ad-1.0.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef61de62bdd4d685961d0da741d164c50e531c9d98376158e47bb777363970f6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 21 Nov 2022 16:13:29 GMT
age: 57982
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10255
x-xss-protection: 0
server: sffe
etag: "4d52d329cbd34968"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 21 Nov 2023 16:13:29 GMT

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame 29C5 714 B
763 B 164ms
164ms Document
text/html 104.26.4.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.4.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 6323
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 76e03e0e18d2a892-SYD
content-encoding: br
content-type: text/html
date: Tue, 22 Nov 2022 08:19:50 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HyKnVAv8LZlDq2xu035DqS6%2FdCNj4wdgBRwqIB6TB6YwYYwcSx7aHpoD4F2o5XQVMWcIzrp6QSIR%2Bo5Ck4YbMVJXcZ4y57YBfzjPVltzwhowq%2FTbDMdBXAIpa5Uu%2BuS3LA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK idsync
sync.aralego.com/ 35 B
384 B 270ms
270ms Image
image/gif 209.58.188.181
LEASEWEB-APAC-HKG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.aralego.com/idsync?gdpr=1&euconsent-v2=${GDPR_CONSENT_607}&
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 209.58.188.181 Central, Hong Kong, ASN133752 (LEASEWEB-APAC-HKG-10 Leaseweb Asia Pacific pte. ltd., HK),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:51 GMT
Connection: close
Content-Length: 35
Content-Type: image/gif

GET
H3 200 cookieSyncIframe.html Show response
cdn.aralego.net/ucfad/cookie/ Frame 48CB 714 B
792 B 151ms
150ms Document
text/html 104.26.4.103
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html
Requested by: Host: ads.aralego.com
URL: https://ads.aralego.com/sdk
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.26.4.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36a7d95f2760a813f3e782dfc125ea786174d581d6f6f896021d6994e9514bd6

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
age: 6323
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 76e03e0e18d8a892-SYD
content-encoding: br
content-type: text/html
date: Tue, 22 Nov 2022 08:19:50 GMT
last-modified: Wed, 09 Feb 2022 05:59:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yj8FCD6hh1qpYswTyfv0ZimeJnSYpwpIeBdIsmG8uxbatMOKSHOOVvkh7Q70Ay1jB6tZhEeC4nRP9BvT291wBb5RtTcBHivk%2FnblZxx3hkGAon1TUAYsPghsqtAdHEEf9A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 gtag.json Show response
cdn.ampproject.org/rtv/012211042305000/v0/analytics-vendors/ 2 KB
931 B 813ms
271ms Fetch
application/json 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/analytics-vendors/gtag.json

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8993772c9eb591474f38d257bebc8c4286703e1af72d04c8c294be5fff7b649

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 15 Nov 2022 20:10:32 GMT
age: 562158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
server: sffe
etag: "f8777e0f4a2af1a5"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 15 Nov 2023 20:10:32 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 48CB 78 KB
27 KB 822ms
273ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789661e67642847c0582652469996d40ea33e2750544195743cf7e2532e4836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27210
x-xss-protection: 0
server: sffe
etag: "1399 / 229 of 1000 / last-modified: 1669071986"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 22 Nov 2022 08:19:50 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 29C5 78 KB
27 KB 1102ms
559ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.aralego.net
URL: https://cdn.aralego.net/ucfad/cookie/cookieSyncIframe.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789661e67642847c0582652469996d40ea33e2750544195743cf7e2532e4836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27210
x-xss-protection: 0
server: sffe
etag: "1399 / 293 of 1000 / last-modified: 1669071986"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 22 Nov 2022 08:19:50 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/ Frame A021 355 KB
117 KB 638ms
337ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27b6a1a1b9fce1c609e64c20eae9ad7839a2209b110663d4d42368186fc309ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119603
x-xss-protection: 0
server: cafe
etag: 6341151266107442423
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 08:19:52 GMT

POST
H2 200 amp Show response
www.googletagmanager.com/gtag/ 610 B
808 B 835ms
278ms Fetch
application/json 142.250.4.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/amp?__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

8492f3fc13f89700f09e8a96308911979a6289be084af2c497ea54dbd7dd7f5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=utf-8

Response headers

date: Tue, 22 Nov 2022 08:19:51 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="amp.json"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 258
x-xss-protection: 0
pragma: no-cache
amp-access-control-allow-source-origin: https://www.bg3.co
server: Google Tag Manager
vary: *
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/ Frame B786 355 KB
117 KB 882ms
582ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

895a6359c2ff01f9388095f5ae85d2f208fbb64e6f6fd56670396b8e56914154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119610
x-xss-protection: 0
server: cafe
etag: 3933332376306213314
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 08:19:52 GMT

GET
H2 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 48CB 381 KB
129 KB 571ms
270ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 12:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 590976
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 15 Nov 2023 12:10:15 GMT

GET
H2 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 29C5 381 KB
129 KB 886ms
585ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 12:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 590976
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 15 Nov 2023 12:10:15 GMT

GET
H3 200 amp-ad-network-adsense-impl-0.1.js Show response
cdn.ampproject.org/rtv/012211042305000/v0/ 214 KB
57 KB 270ms
270ms Script
text/javascript 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012211042305000/v0/amp-ad-network-adsense-impl-0.1.js

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a89c99a73b3c1f0c7a3977dd68ceba2286f13385d81aa1bf2c6811bce17f84fd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Origin: https://www.bg3.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 15 Nov 2022 20:10:45 GMT
age: 562146
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57837
x-xss-protection: 0
server: sffe
etag: "23f3142da2c5be06"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 15 Nov 2023 20:10:45 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
396 B 831ms
276ms Image
image/gif 172.217.194.113
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=a1&ds=AMP&aip&_s=1&dt=%E9%9F%93%E6%98%9F%E6%9F%B3%E6%99%82%E5%85%83%E6%AF%86%E5%A6%BB%E5%A0%85%E6%8C%81%E3%80%8C%E7%84%A1%E7%BD%AA%E3%80%8D%E6%8A%97%E8%A8%B4%E5%88%B0%E5%BA%95%E3%80%80%E7%B6%B2%E5%8F%8B%E8%B6%85%E4%B8%8D%E6%BB%BF%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&sr=1600x1200&cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&tid=UA-172083736-2&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&dr=&sd=24&ul=en-us&de=UTF-8&t=pageview&jid=0.9125616920051332&gjid=0.9075614659589863&_r=1&a=4198&z=0.3994821792223333&gtm=2pu000

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.json Show response
adservice.google.com/adsid/ 86 B
572 B 822ms
274ms Fetch
application/json 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.json?domain=www.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14cfb5058acaf3af2f07088f1582f29941d7a4cc74fd1cea5050cecad862d154

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: application/json
Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0

GET
H2 200 nameframe.html
d-10281732413932275640.ampproject.net/2211042305000/ 0
0 819ms
272ms Other
text/html 142.251.10.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://d-10281732413932275640.ampproject.net/2211042305000/nameframe.html
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.10.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f94.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 48CB 107 B
792 B 822ms
273ms Script
application/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 48CB 107 B
165 B 714ms
282ms Script
application/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 48CB 492 B
264 B 309ms
309ms XHR
text/plain 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4000916992004846&correlator=1624576248076804&eid=31070950&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-40&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1669105192357&lmt=1644386353&dlt=1669105190177&idt=2160&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=z6omnl9yohsl&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=1331764033.1669105192&ga_sid=1669105192&ga_hid=1361851045&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4b63bb078abb98e3ef61542b0756fd25fc3242b0c2614042b68f19401884597

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
62fb10c0a820f39006ddca32a5e15abd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2A15 6 KB
3 KB 820ms
272ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://62fb10c0a820f39006ddca32a5e15abd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:53 GMT
expires: Wed, 22 Nov 2023 08:19:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pb.42753.1663912421366.js Show response
cdn.adpushup.com/prebid/ 342 KB
92 KB 1396ms
389ms Script
application/javascript 42.99.140.161
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.161 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-161.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 1c479d0abecadc8d5fde30eeb515508b6148fa3d92dd617b427788d6c792b0a8

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: br
last-modified: Fri, 23 Sep 2022 05:54:31 GMT
server: nginx/1.18.0
etag: W/"632d4a17-5578b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=5
content-length: 94168
expires: Wed, 22 Nov 2023 08:19:53 GMT

GET
H2 200 quantcast.js Show response
cdn.adpushup.com/pbuseridscripts/ 450 B
505 B 864ms
390ms Script
application/javascript 42.99.140.161
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.161 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-161.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 26914004d3a8d5ddde2202b642d7936eb61c9f195b5cd3c87e44ef8ad4d57c16

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: br
last-modified: Mon, 28 Jun 2021 04:15:23 GMT
server: nginx/1.18.0
etag: W/"60d94cdb-1c2"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=31536000
server-timing: cdn-cache; desc=HIT, edge; dur=4
content-length: 211
expires: Wed, 22 Nov 2023 08:19:53 GMT

GET
H2 200 linkPreview.js Show response
cdn.adpushup.com/42753/ 72 KB
17 KB 810ms
354ms Script
application/javascript 42.99.140.161
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/linkPreview.js
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.161 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-161.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 968012b3a49390a10d31c6d36b2aab796ec167a83378b5f9787756ee7cb035c5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: br
last-modified: Thu, 14 Jul 2022 19:44:27 GMT
server: nginx/1.18.0
etag: W/"62d0721b-11ed1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=5
content-length: 17440
expires: Tue, 22 Nov 2022 09:19:53 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 78 KB
27 KB 1176ms
1175ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/adpushup.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789661e67642847c0582652469996d40ea33e2750544195743cf7e2532e4836

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27210
x-xss-protection: 0
server: sffe
etag: "1399 / 604 of 1000 / last-modified: 1669071986"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 22 Nov 2022 08:19:54 GMT

GET
H2 200 sync
e3.adpushup.com/AdPushupFeedbackWebService/user/ 70 B
538 B 711ms
236ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/user/sync
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:53 GMT
server: nginx/1.10.3 (Ubuntu)
ap-cookie-status: cookies ap_uid and ap_usid are set
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 708ms
236ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjkxMDUxOTI1NjEsInBhY2tldElkIjoiMDAwMEE3MDEtNmQ2YmQ1M2QtYzQ3ZC00NWFiLWI1ZmEtZTc1OWQxZWZlNzViIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2hhbi14aW5nLWxpdS1zaGkteXVhbi1vdS1xaS1qaWFuLWNoaS13dS16dWkta2FuZy1zdS1kYW8tZGktd2FuZy15b3UtY2hhby1idS1tYW4uaHRtbCIsIm1vZGUiOjQsImVycm9yQ29kZSI6MCwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpudWxsfQ%3D%3D&c_b=6450.699999809265
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:53 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 testmode
e3.adpushup.com/AdPushupFeedbackWebService/feedback/ 70 B
317 B 707ms
235ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/testmode?data=eyJjcmVhdGVkVFMiOjE2NjkxMDUxOTI1NjIsInBhY2tldElkIjoiMDAwMEE3MDEtNmQ2YmQ1M2QtYzQ3ZC00NWFiLWI1ZmEtZTc1OWQxZWZlNzViIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2hhbi14aW5nLWxpdS1zaGkteXVhbi1vdS1xaS1qaWFuLWNoaS13dS16dWkta2FuZy1zdS1kYW8tZGktd2FuZy15b3UtY2hhby1idS1tYW4uaHRtbCIsIm1vZGUiOjUsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpudWxsfQ%3D%3D&c_b=6451.300000190735
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:53 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 706ms
234ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjkxMDUxOTI1NjIsInBhY2tldElkIjoiMDAwMEE3MDEtNmQ2YmQ1M2QtYzQ3ZC00NWFiLWI1ZmEtZTc1OWQxZWZlNzViIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2hhbi14aW5nLWxpdS1zaGkteXVhbi1vdS1xaS1qaWFuLWNoaS13dS16dWkta2FuZy1zdS1kYW8tZGktd2FuZy15b3UtY2hhby1idS1tYW4uaHRtbCIsIm1vZGUiOjEsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiI3N2E5YzIyZi1hYzAyLTQ1ZGQtOTZiYy1iMDg5NmE4YTdkNWEiLCJzZWN0aW9uTmFtZSI6IkFQX0xfRF9BUlRJQ0xFXzcyOFgyNTBfNzdhOWMiLCJzdGF0dXMiOjEsIm5ldHdvcmsiOiJhZHBUYWdzIiwibmV0d29ya0FkVW5pdElkIjoiQURQXzQyNzUzXzcyOFgyNTBfNzdhOWMyMmYtYWMwMi00NWRkLTk2YmMtYjA4OTZhOGE3ZDVhIiwic2VydmljZXMiOlsxLDNdLCJhZFVuaXRUeXBlIjoxfV19&c_b=6451.699999809265
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:53 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 adpushup-label.svg
campaign.adpushup.com/ads/ 8 KB
9 KB 590ms
141ms Image
image/svg+xml 152.199.39.108
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://campaign.adpushup.com/ads/adpushup-label.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.39.108 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nwa/E7CA) /
Resource Hash: eb3577f46647f2e2db7307936038a47cc31c0ce75239496f6b7117282a47864c

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
last-modified: Thu, 12 Nov 2020 09:18:18 GMT
server: ECAcc (nwa/E7CA)
age: 1831
etag: "5facfdda-21e0"
x-cache: HIT
content-type: image/svg+xml
cache-control: max-age=14400
accept-ranges: bytes
content-length: 8672
expires: Tue, 22 Nov 2022 12:19:54 GMT

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 241ms
239ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjkxMDUxOTI1NjgsInBhY2tldElkIjoiMDAwMEE3MDEtNmQ2YmQ1M2QtYzQ3ZC00NWFiLWI1ZmEtZTc1OWQxZWZlNzViIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2hhbi14aW5nLWxpdS1zaGkteXVhbi1vdS1xaS1qaWFuLWNoaS13dS16dWkta2FuZy1zdS1kYW8tZGktd2FuZy15b3UtY2hhby1idS1tYW4uaHRtbCIsIm1vZGUiOjEsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiJkMWMxMGE3Mi0yN2I0LTQ5MzEtOGNlNy05OWExOGViYmRiYWUiLCJzZWN0aW9uTmFtZSI6IkFQX0lfRF9BUlRJQ0xFXzcyOFg5MF9kMWMxMCIsInN0YXR1cyI6MSwibmV0d29yayI6ImFkcFRhZ3MiLCJuZXR3b3JrQWRVbml0SWQiOiJTVElDS1lfQURQXzQyNzUzXzcyOFg5MF9kMWMxMGE3Mi0yN2I0LTQ5MzEtOGNlNy05OWExOGViYmRiYWUiLCJzZXJ2aWNlcyI6WzUsM10sImFkVW5pdFR5cGUiOjN9XX0%3D&c_b=6457.10000038147
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 feedback
e3.adpushup.com/AdPushupFeedbackWebService/ 70 B
317 B 240ms
239ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback?data=eyJjcmVhdGVkVFMiOjE2NjkxMDUxOTI1NzAsInBhY2tldElkIjoiMDAwMEE3MDEtNmQ2YmQ1M2QtYzQ3ZC00NWFiLWI1ZmEtZTc1OWQxZWZlNzViIiwic2l0ZUlkIjo0Mjc1Mywic2l0ZURvbWFpbiI6Imh0dHBzOi8vYmczLmNvLyIsInVybCI6Imh0dHBzOi8vd3d3LmJnMy5jby9hL2hhbi14aW5nLWxpdS1zaGkteXVhbi1vdS1xaS1qaWFuLWNoaS13dS16dWkta2FuZy1zdS1kYW8tZGktd2FuZy15b3UtY2hhby1idS1tYW4uaHRtbCIsIm1vZGUiOjEsImVycm9yQ29kZSI6MSwicmVmZXJyZXIiOiIiLCJwYWdlR3JvdXAiOiJBUlRJQ0xFIiwicGFnZVZhcmlhdGlvbklkIjoiOTY3NTAxMjUtYjkwYy00OTdhLTg2OTktNzMxNzFmN2I0OTM1IiwicGFnZVZhcmlhdGlvbk5hbWUiOiJBZFB1c2h1cCIsInBhZ2VWYXJpYXRpb25UeXBlIjoxLCJwbGF0Zm9ybSI6IkRFU0tUT1AiLCJpc0dlbmllZSI6ZmFsc2UsInNlY3Rpb25zIjpbeyJzZWN0aW9uSWQiOiIxMDRiMjgyYS1iZDExLTRkOGQtYWQ2NC0wNDkyMDYzYjZjYmEiLCJzZWN0aW9uTmFtZSI6IkFQX0lfRF9BUlRJQ0xFXzEyMFg2MDBfMTA0YjIiLCJzdGF0dXMiOjEsIm5ldHdvcmsiOiJhZHBUYWdzIiwibmV0d29ya0FkVW5pdElkIjoiU1RJQ0tZX0FEUF80Mjc1M18xMjBYNjAwXzEwNGIyODJhLWJkMTEtNGQ4ZC1hZDY0LTA0OTIwNjNiNmNiYSIsInNlcnZpY2VzIjpbNSwzXSwiYWRVbml0VHlwZSI6M31dfQ%3D%3D&c_b=6459.60000038147
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame 29C5 107 B
165 B 598ms
276ms Script
application/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 29C5 107 B
165 B 489ms
286ms Script
application/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cdn.aralego.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 29C5 491 B
263 B 312ms
312ms XHR
text/plain 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4105699401993174&correlator=1290832768032534&eid=31070949&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=18087395%2Ccookie&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&adks=64515409&sfv=1-0-40&sc=1&cdm=cdn.aralego.net&abxe=1&dt=1669105192581&lmt=1644386353&dlt=1669105190186&idt=2388&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&scr_x=-12245933&scr_y=-12245933&ucis=flo3o9100cm&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fcdn.aralego.net%2Fucfad%2Fcookie%2FcookieSyncIframe.html&ref=https%3A%2F%2Fwww.bg3.co%2F&top=https%3A%2F%2Fwww.bg3.co%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=256&ohw=0&ea=0&ga_vid=906976331.1669105193&ga_sid=1669105193&ga_hid=1908339983&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c7630cece2ee12a3dafd48efca0db7b39d7445de1b8a2ea12e4a2825e825a76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 233
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://cdn.aralego.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
9406cc0333fdbcf783f744978ac1671c.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B682 6 KB
3 KB 844ms
282ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9406cc0333fdbcf783f744978ac1671c.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:53 GMT
expires: Wed, 22 Nov 2023 08:19:53 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 block.jpg
delivery.adrecover.com/ 631 B
915 B 360ms
359ms Image
image/jpeg 42.99.140.201
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://delivery.adrecover.com/block.jpg?ts=1669105192603
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.201 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-201.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 9284d948e86d2e99f31483b5f4b3a4c3e65e0a6fbca9a8d2db8c6095f82ac3f5

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:54 GMT
last-modified: Wed, 23 Jun 2021 06:37:54 GMT
server: nginx/1.18.0
etag: "60d2d6c2-277"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=HIT, edge; dur=4
accept-ranges: bytes
content-length: 631
expires: Tue, 22 Nov 2022 09:19:54 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame A021 379 B
693 B 818ms
273ms Script
text/javascript 172.217.194.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f156.1e100.net

Software

cafe /

Resource Hash

5c61ac4a6a9900f447f61aabfc71076c04692bfbac0ce685c5f103cc4f321837

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame A021 107 B
165 B 504ms
274ms Script
application/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame A021 107 B
196 B 390ms
277ms Script
application/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8DDF 26 KB
12 KB 1055ms
496ms Document
text/html 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105190899&bpp=13&bdt=1948&idt=1761&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=2&ga_vid=669386786.1669105193&ga_sid=1669105193&ga_hid=511683142&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=2984&biw=1600&bih=1200&isw=336&ish=280&ifk=3031037758&scr_x=0&scr_y=0&eid=44778843%2C42531705%2C31070762%2C44777948&oid=2&pvsid=2781778878858997&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.rmzg6fw9hgju&btvi=1&fsb=1&dtd=1778

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00727b0bbe28a8e979150d89e8e7bad02985202860ede81309ae823b25dd04aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 11894
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:53 GMT
expires: Tue, 22 Nov 2022 08:19:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame B786 379 B
315 B 696ms
275ms Script
text/javascript 172.217.194.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.bg3.co&callback=_gfp_s_&client=ca-pub-4485239425924787&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

si-in-f156.1e100.net

Software

cafe /

Resource Hash

88db5838e97fd4dbaf218417cd34475cd0f2160b6efed330b64cbee85fc9cf33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ Frame B786 107 B
165 B 273ms
272ms Script
application/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame B786 107 B
165 B 274ms
274ms Script
application/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DECC 23 KB
11 KB 987ms
674ms Document
text/html 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da63db2a0548e608c788e7110be24a3757617d076c03bdf6974d3947f3d627b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 11459
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:53 GMT
expires: Tue, 22 Nov 2022 08:19:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F477 603 B
753 B 662ms
494ms Document
text/html 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3216231935713038&format=1600x250&w=1600&h=250&ptt=12&adk=2733026255&output=html&bc=7&to=ampa&pv=1&wgl=1&asnt=0-41702282552415300342&dff=sans-serif&prev_fmts=1600x96&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&ifi=2&pfx=0&pwprc=1037897477&adf=470780615&nhd=0&adx=0&ady=3298&oid=2&is_amp=5&amp_v=2211042305000&d_imp=1&c=72004198&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&ga_hid=4198&dt=1669105192380&biw=1600&bih=1200&u_aw=1600&u_ah=1200&u_cd=24&u_w=1600&u_h=1200&u_tz=0&u_his=2&vis=1&scr_x=0&scr_y=0&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&bdt=4780&dtd=687&__amp_source_origin=https%3A%2F%2Fwww.bg3.co

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012211042305000/v0/amp-ad-0.1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:53 GMT
expires: Tue, 22 Nov 2022 08:19:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 48CB 16 KB
12 KB 587ms
285ms XHR
application/json 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022111501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a05330f0206284937cde2078ad34b676981e7d855eebdb604bc67506f36691c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12576
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 29C5 16 KB
12 KB 588ms
287ms XHR
application/json 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022111501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a372917595c18a5d791ebfb72c0b03c9a6bab2fcc05e0dda854840b5160a0ad9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12395
x-xss-protection: 0

GET
H2 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8DDF 0
0 590ms
288ms Fetch
text/html 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEtFYKYZ8Y6XDFoiNogPAwZj4CJj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAk-FpKWvNaY-qAMBqgS8Ak_Q1EBf5y_FYrslLzTY5b9qVzFLkQqP8ndzBaDjPcPGJEqK9pX5hlXy9JiLed8AnpZUFzEM28q6cJEwtsius_T2PbGVZMNxGOuTkrKicFmNaQRtTadcfkh007YXGOfpLIbDgL8GjXkupqXAFjS9coGYUUOGW1uHskNKsGcwJn-Nv_fAZ9a8kC9Dn-ZsiZKVqrm6EMPsMtnqMYUnDRDj9frqsKd_8yhlwb7PCg7Wjig4luLTjYDg-yINtzs9oyb-js5rFAw7Fo-K7F7lTFn1hAoj5lmgM7BS72YaVFXOQcOi_IiWXXu98u15chgO9wEDytCxNzGDi1YY5SjkhVeIEnOD1wIU2awGkmn8_18lyrpWQKF-ypLOvqf1xN9kzqZPrae_WxnCczOn8aELu0jIpMT9O9cbGUdFZS_3pkOABoa-5eC5laDtXKAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTQ0ODUyMzk0MjU5MjQ3ODcY4swZ&sigh=Q1FiiHuzjIU&uach_m=[UACH]&cid=CAQSKQDq26N9cadsOaHVuA8S8Gr49sScz08DaiPCkrT8-tL1KTwewWMq2Bp9GAEgEw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105190899&bpp=13&bdt=1948&idt=1761&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=2&ga_vid=669386786.1669105193&ga_sid=1669105193&ga_hid=511683142&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=2984&biw=1600&bih=1200&isw=336&ish=280&ifk=3031037758&scr_x=0&scr_y=0&eid=44778843%2C42531705%2C31070762%2C44777948&oid=2&pvsid=2781778878858997&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.rmzg6fw9hgju&btvi=1&fsb=1&dtd=1778

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105190899&bpp=13&bdt=1948&idt=1761&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=2&ga_vid=669386786.1669105193&ga_sid=1669105193&ga_hid=511683142&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=2984&biw=1600&bih=1200&isw=336&ish=280&ifk=3031037758&scr_x=0&scr_y=0&eid=44778843%2C42531705%2C31070762%2C44777948&oid=2&pvsid=2781778878858997&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.rmzg6fw9hgju&btvi=1&fsb=1&dtd=1778
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 22 Nov 2022 08:19:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 8DDF 0
0 927ms
311ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=k8jmDZ_IC9ACmAJi-C0SAgAAACE5AQwCW-6I5uT8IWU3JEEQKYZ8Y0B4iEHYxYeLxCk7ABIAAA&wp=Y3yGKQAFoaUKaIaIAAYgwMQuxNfWMRpOE5N2EA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:53 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 209523
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 86DB 125 KB
43 KB 767ms
293ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y3yGKQAFoaUKaIaIAAYgwMQuxNfWMRpOE5N2EA&u=%7Cevw5r3VRIwk532R%2Fv1WWsBpJJspVuNjZ7HZLB62tBhc%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4N9zppcsUR56obfg04jLRDchwksXCK1v-Vbm_d4PtWdUW43-WPa8R4lX9iJzgHGmk3iG-01gIzUQQ_SggXE58TLtEVdevqmA8tjsTfiKPP_1y8XA_bBVrj8pyuKvPkbi9EWGVBC_qDfIfaO9moPltv_CZ9TP77Oq62Zw9xxxm3JoUoMLEzamO_YEJniBtOyIiO2JikzTsborXKV5Bi8jlTsapWUlM5UuM776V--xjKfy3Ru9iez5jE0mUKUUQeWE264Q-aC0itKvWzpXwozqU20lRXqLlUhCLpEKQ4lE_VgHki5JsqzzArFwkcr2XJkUDjFLiLOfdW-XnHzDEvOKn-VJ5VvcU-UamBuI4p5ADbzJy3KZmsMELNXGf9bFbhEPxjHmdFnGhH8ByU_rHXFB0AoY29yom1W2nP0Pxiyh7hvmOMdhxJ3qq-6802G3JbLf8oU0hzKJUw3CgYp576rbhcBk8lZgT5bLS1lGdZTl3i_dbQuSTkEBB1wNyp0Mg8JMdeqvWheL1D5cXCYJ9OP9_atulBeYNUFBUQRmrXct7nRw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC3JhbKYZ8Y6XDFoiNogPAwZj4CJj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAk-FpKWvNaY-qAMBqgS_Ak_Q1EBf5y_FYrslLzTY5b9qVzFLkQqP8ndzBaDjPcPGJEqK9pX5hlXy9JiLed8AnpZUFzEM28q6cJEwtsius_T2PbGVZMNxGOuTkrKicFmNaQRtTadcfkh007YXGOfpLIbDgL8GjXkupqXAFjS9coGYUUOGW1uHskNKsGcwJn-Nv_fAZ9a8kC9Dn-ZsiZKVqrm6EMPsMtnqMYUnDRDj9frqsKd_8yhlwb7PCg7Wjig4luLTjYDg-yINtzs9oyb-js5rFAw7Fo-K7F7lTFn1hAoj5lmgM7BS72YaVFXOQcOi_IiWXXu98u15chgO9wEDytCxNzGDi1YY5SjkhVeIEnOD1wIU2awGkmn8_18lyrpWQKF-ypLO_KXUVjqqR9iwJNYhsE9YsBqz-zYBlVAgLDeroR6lB2tdgsRm2Ly0BnCABoa-5eC5laDtXKAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3dHZr9d17iGjIKChwhFcj1nmx72A%26client%3Dca-pub-4485239425924787%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

702797e9a9a0eea48c89219949bd79a60399e154c19dc57d8d3e81ba5f5c2157

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:53 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=NZxGKX-GkGlDXTZazk_3rquxWfD_5bQoFp4UVl5FBYVxUHzmnTLjv3W3Beed2JLilgHNDGFmqCveM1X-pZSsBe82XQxnn-eJx1UHXnieKUoGvWuny9Hnl7bWQk4Sv89VpANYIhFZJ_8z3I95YsfpamE7AdnBbrvIOvoM9T_KZ7erKYPsLKQLiDdBt9gsMiUFZ3MoXal-OAyqjqOH3jAlTk-1Ju56W2Oxhlh-bmR69hmHKklfN9C6N37j7D-rPGbDyrXzDFdnW2YQ7Sxt"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 55526493
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 8DDF 3 KB
1 KB 892ms
345ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 11:03:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76589
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 11:03:25 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F179 1 KB
643 B 277ms
275ms Document
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 43976
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 21 Nov 2022 20:06:57 GMT
etag: 48472445140208031
expires: Tue, 22 Nov 2022 20:06:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 8DDF 18 KB
7 KB 833ms
297ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57522
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 16:21:12 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8DDF 0
0 315ms
315ms Image
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQA5wnSa7OcC3P5puS7yDMuiDwRMTQzpP47zc2EVigDU9RqbCovgV12PhbH7AfJOGHHN2o5I8Oc35crwegl6p5JgYNNFg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105190899&bpp=13&bdt=1948&idt=1761&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=2&ga_vid=669386786.1669105193&ga_sid=1669105193&ga_hid=511683142&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=2984&biw=1600&bih=1200&isw=336&ish=280&ifk=3031037758&scr_x=0&scr_y=0&eid=44778843%2C42531705%2C31070762%2C44777948&oid=2&pvsid=2781778878858997&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.rmzg6fw9hgju&btvi=1&fsb=1&dtd=1778
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.24.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8DDF 154 KB
48 KB 3500ms
2938ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:19:57 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 48CB 17 KB
6 KB 1004ms
545ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:19:54 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9E24 624 B
288 B 588ms
286ms Document
text/html 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNUleEqE_NLS2dMxJBrEcsRZPWBwxpwD-AHf34HrArboAtrrNYSrqowdv7WAeal6xgf6L6fqBfW6r9HsD_uChMZeNMSUPA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B899 15 KB
11 KB 609ms
308ms Script
text/javascript 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BBEpAVWSF3u9m1vGK0cPt8p1FxhDb4XJEYfjdOCiiqLQF4wIF0EWdYtPeE3da50YG60Jm5YBaptmgtor8PvIpID1_SNN7RG-gUYGsQbgjMTxkz_W17QbIXE6eUMx_Sq4JazvI-e-SGLzzouDUnP8OKthHEHaOkrWrp4tJunVuPx9wN6UA&cry=1&dbm_d=AKAmf-BDCnRRLXFMIev_IiaSgAtr1xdLrKHU4atBZqw68nrXKXYOSoypo2HFBrQ9PhpYzXewTFZqHRyST1JZMAG3X6W48YgPAj4Z9wARu9LR_b6w_vZyMVtMbAdsrYv4D9R0h6aVYxxGRcZ8fnliKz0B5Cl77uYyw9c0IFs6zPvXsKVOpx5po2Y9iAgK9BN84ZH1tX6eGjNuOsyKwKYesL2p7UGrfelL232Gj8EtnJ3Zq5qijbdprylyX-tWmK1txu3bicKg1HPDrkjlCESfDBQfR9me5fYNDkud59B6f5SOqocb8sJpVTuzGX8UuIhzuuRGBqLNof1lFINzF8UlCWlJq-uvfweKI2Tu5LsMrl1EOa7mfhlEsJIn95UD1NjmzNfYlovMvj85G1cTT_43eIP1_xHfEfy7IABAEguKFfOutZmoVVIkytamVB9Sz2pe_AJFxdSSk7cXllBvlQUeqZaA3KpCLTrnwvImacvD4_lYDF8PeaEDs2fmh_xpsen0JzhaFqI_ta63na6OpUp9tgGQQdDgRaaTyRhOBFcm-_TNFg_cg2eLnWfxl94Z4tHmMX-HMgpnAxOZnB9zeoMfEWztHPYKWR1HXkDf5UVxGzQsyLAaB6rUY5aSpolXsoRxnIEU34_OQVs3F-6ic8Q1cB9f8Yhq_gUfLS3kvWIv3x6ZCQw-d6HBFLvpJWHgNDiViGEWGzSJ_zFVoSx-JRDII5pHBK6KsBsZJqZ36U4B4j3oWDuPzs6ALZBTawWBB__vTUZ_VoVJ1AQxS-fREe-UrIoYiunjpewRr1S0BnTlzdGtkXg3-iABNCebdC3UJraMzXMPNUZztMQ9hAnmK2bV_LcOwXp_XtSwSYmj56v08BMrQX802fraGBrmAXWPaMLZhv9ya-xFO3HpqgTiGQMc6QyT5GfTDhcN7pxURRIBBKfvdcwNfEVXTmx6GL2Ly0p2w4U6k4QY3CT6TpxU9eWe7c8KCSLVRO4_Zyzzrl_U8nn7lXhAO-s7RxEBgFHdhS9VXa3EDJ-XSvM8g6Mlaw8hDV7WqTXpPdKUvv2QoywhjuwYdzN77rkKpTTNowOA_dxZzBuC5_wfR5Fmut39UsuLLR0slAr5bl4YxdjlXkYN69FyLYB2vPHN6xzAV3lBhsqgLeVlIoAhXVdDO2MbtqxOofq4Okb-ZAZ6ajzNAs0GI6Xc9HyaSorSA5n_zjqBgUHpaV_KcAZhbY2vTI7XnQaGfaOFaBotb63JtSx2vF2y86tWuNbMSUx2ugi2k8gEcc893YRh7CuijOuvoTJ0yYwS7Z58xg9JGJrJE8x7HSPL02Eu-hBpsdfF6SDWQmoqEwvHed4-ywL8GEWU_vydoKMLjUeS4HlNkfCCAVOrut3TWeD5TjJK9g3X5E7IdNIfanvbHC-iGWudawasfckQB-_AWPCOccVuVyVj1d8-A12fRL4xwLSJWhgRnL2E5Lc90FkfADKVGuPEAdRX1rirQzpc4ZrYIKxcVVHHpud7RcFN3ro2BWegCqC2Wh954_6Nv4YJDaw15_cNGEy7PgmQDehrr7Zrxqc9RyVzC77OMk_-QXsXAv9YsIEW13xzuMHdweDovPVvx162iSbeZKsUWn52qsc611sll8DcF49hmEWFJ1oH3WueRLJ4PHgXQR4-oDW_qnrnCHFY2jB74_2HdMn2LYjexq8Jk7DCCruUl61Bm5gIDD2rWRk0vEkJJOMAKAsHKv9ZooTI8XneAQ1UXhNofBSL3nNwMB21LXanapCTjz6swdl6VYtiVJSNS_elgwGojzkm9_uygduM-X4iqXUBxlLVQRKodQRSJYMKI7GtFUN5Wa_tXbCkqM6tbN4pyla4c1IbhP-_NHOF6jgEEVXIvAA63y43nhmUrVJMFkFgg40GQn9A5beOSJLEGZYqBjVNZZLuZ0E2AI2ClJqmp96bmu6VP1gWVDNNQm5DtkO1k31Uks6s3kK9ZKOpVD_8U1DvpFT7djsz3fkViKkP5-3KV3HBBhqhpZDnB-2iScX60UW3mAwvsrtzpp2DYnHTLf0uKhPOMUC7IYs2G5t0HfGJD9vOCIu5AuLc5b0SZuy-btLyMwZdiy92UGpbd8hiMy2_gvs2_7-iACo33u709kAKKtvu9r_7SzSeYhAPOve1k8swkV3FzFabVz7d6_2AurzGZW4YUE9FkgdwT793_xlAGHa7o9QNclEMWaSyNY_keRpX__YuQ9MKiUmyG7HgOUECLxmKKWNtZLbPM5fLF3H272TExm8h3tBX9AVmGzSon1wJ99TI0ZtVJVc30pYeg7R9dYqJwOWQ7CLhF0g2SZSEwkJl90VAWABMUVzUIrY-dIlw5dT_agVrMH6vJ1AITh5E9n-AaY0PMvADCD-xZtlvek_Ki5G22k0Z0r7eLUmY3dsEOlJ258ZKdSmeJFw75qjhV6aN8SI75Mvf7KF9VycB8BFj9kNvVJrEzoc2QAkcEM9RiYdmqqw-88Y9nUt6r214s7SWqfOBgi7jDPm3VmnZ5o2dZocw--qtEYajhtX_r7ZT2q5ZWAj5V-rI-CDrFHClpQaTc13SBKBkt2q84m3iRZR-3YjCEul0CR-OwyOAPoLLwlwJ9vvUlj1e7z-4A3ez2_0fL_7qFqBVkMtCYZRw5sUgsng4TcHtG0srhmBLw-xuADioFac7JAzc8DwV1zOGh4QreTBmWtN0WggONDqRf1eqFgkf9EqaDi9ugcjrCKdIuCCxdStXpGe4Ezs4-JNzwb9gncYUsVWKCpCc3aha4nDSHi0DL7DMcLCG1b2bdmYDyIFmLKG9saxOaF59xRKADjsS4uC4w_bQpI444V3ZA1c0wBz2qO-RRu02-XCedjeaaXwkDifzVpOhwLl8OE77hmSTlPNSHWbYcF7CMhYJ02FzJeuf-v_neVew5NBncg2eiTxurIbF-92ZawTjINIqGCc11EKXxhnrtT14bQFOisdwQrwbSbfkynhUQ2tGDmhs-NgurC0nvFJXUPKvXt75EjgGNLKkZAcBICiD17PTEV1DQwLjxnI9jeMmj5TqiStNHULe42zQ7_fWdBf7Ztm826_qOCRRw5PThWdwlP2JIkEURNfF0SIp-QGbtV5VGYUmX3jQA0tILtv-DtJCNLmFgtfsxK0r3sBr0G0ACjQQDYrt9bG0fyCFokF5co3SXDayyvLDg3iTJWoX6xQGSK28jvU5EtmAMVvQ7234_vscCFGbdSSY-OIAY0-2PCbDECKt4lzWq8sC6BALfL9wn8TJRcEJOj1fq3LScP9FF1_lKg5WjSTHSjaFJy3jAyxouB138bBQFjpaSnu0yrY8ccDubxJDbP7tVATIz6baO-aPuKUmQXZbg04wXCP4l0r5kwjhLQuVKRdkES1TuKHX6S_s96d2ZbjnS37rb-mH0Yt7TW6xMDcanKiP44NeLuPxzYvM-R3Nutr7iJ3MaC3Trao6gPU7V60jbnp8&cid=CAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw&rfl=3%2Chttps%253A%252F%252Fwww.bg3.co%242%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58a5af28eb177e785a295983c2c43fb9c38aa5b41ad7f3b45754af88549bda11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11254
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame B899 3 KB
1 KB 636ms
331ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 11:03:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76589
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 11:03:25 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame B899 18 KB
8 KB 575ms
271ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57522
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 16:21:12 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B899 0
0 853ms
311ms Image
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaShy1v4Mg2CAqphdI0O41d1SMaOPcOorrFY0IS9IB07c0zKm3SHfiZ0Xx0AD0m5Bx4E9A6MrB8b5aywdFJU6KEzLRk0Hw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.24.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B899 154 KB
47 KB 3633ms
3327ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:19:57 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B899 42 B
63 B 279ms
279ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AaGOkEfIZMXmXU87ylcirEzC2hh-Y3n4ku8nNXDM-kzZPQ7UzXb_K-MbHKZWWz0t3rJzyXZZZIIf4XbV9inFUoLz5sRBwL_qbOSzpQmLcJ10X5q2M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame F179
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEFYloxSJx75NApz1xLhe_BI&google_cver=1&google_push=ASkJ3FbhWLoU3Gbb8tyy0SQjxOGOdDIomDelLVotE1Ax6DeOoGh-y1GxDNe9kBn6o4eb3fRISWnP6VY3Cvf-knzM1SE4LwSIFiOAj...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDQ1MzEzODQyMjQyODA2MzQ5Ng==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBhGI6hQP21d3OpHeXI8fPg&google_cver=1

43 B
398 B

871ms
264ms

Image
image/gif

50.116.239.135
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBhGI6hQP21d3OpHeXI8fPg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134176&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105190899&bpp=13&bdt=1948&idt=1761&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=2&ga_vid=669386786.1669105193&ga_sid=1669105193&ga_hid=511683142&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=2984&biw=1600&bih=1200&isw=336&ish=280&ifk=3031037758&scr_x=0&scr_y=0&eid=44778843%2C42531705%2C31070762%2C44777948&oid=2&pvsid=2781778878858997&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoEbr%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.rmzg6fw9hgju&btvi=1&fsb=1&dtd=1778
Protocol: H2
Server: 50.116.239.135 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEBhGI6hQP21d3OpHeXI8fPg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F179
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEN2CCyhiceu0qfKUnDBZK3Y&google_cver=1&google_push=ASkJ3Fb8c1jXF6G30X12bKiSEP6MSpF2Xi5jFHzU8KrtaTgPtGmiW4kd-qb089__-L7WptUSEppGP0e_kzx6iC9f7U73Z798K-DmBR...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=15E63E7C9B944E919AE44BE275B7B79F&google_push=ASkJ3Fb8c1jXF6G30X12bKiSEP6MSpF2Xi5jFHzU8KrtaTgPtGmiW4kd-qb089__-L7WptUSEppGP0e_kzx6iC9...

170 B
232 B

574ms
273ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=15E63E7C9B944E919AE44BE275B7B79F&google_push=ASkJ3Fb8c1jXF6G30X12bKiSEP6MSpF2Xi5jFHzU8KrtaTgPtGmiW4kd-qb089__-L7WptUSEppGP0e_kzx6iC9f7U73Z798K-DmBRJLBezRLFjjtwjcC6NBkxdBORp5eABWyFnbKMvUyTY

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 22 Nov 2022 08:19:54 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=15E63E7C9B944E919AE44BE275B7B79F&google_push=ASkJ3Fb8c1jXF6G30X12bKiSEP6MSpF2Xi5jFHzU8KrtaTgPtGmiW4kd-qb089__-L7WptUSEppGP0e_kzx6iC9f7U73Z798K-DmBRJLBezRLFjjtwjcC6NBkxdBORp5eABWyFnbKMvUyTY
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 21 Nov 2022 08:19:54 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F179
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGmt-rQsZ8NYyZid4LSBFQQ&google_cver=1&google_push=ASkJ3FZQ7yONuFPx94_B1J6S0m2DYMdDrAU6gRApGMwhNFv0wpvFyDRoSj0_bOWQTqtiB0ar9z3dxaEy-PmKWhnQ6iuluwVad__fl_hi...
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MkM4QkZFMEE3OUM2QkE5OQ==

170 B
188 B

284ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MkM4QkZFMEE3OUM2QkE5OQ==

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MkM4QkZFMEE3OUM2QkE5OQ==
date: Tue, 22 Nov 2022 08:19:55 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F179
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESECmwcFsDz6JUhv6ccIqfyls&google_cver=1&google_push=ASkJ3FY2T6xpZsvX5mh8qLSSEMAeALiZS7r8RzmkZQKeJ6VzGar8GDHyyi1NsWkJAailAb_4JBZcRzyk7w7x3...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESECmwcFsDz6JUhv6ccIqfyls&google_push=ASkJ3FY2T6xpZsvX5mh8qLSSEMAeALiZS7r8RzmkZQKeJ6VzGar8GDHyyi1NsWkJAailAb_4JBZcRzyk7w7x3...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ASkJ3FY2T6xpZsvX5mh8qLSSEMAeALiZS7r8RzmkZQKeJ6VzGar8GDHyyi1NsWkJAailAb_4JBZcRzyk7w7x3SikdHpyaHw8ldRrIt667G-dH0ibY5613dB3Kbgk0GSwKUI...

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ASkJ3FY2T6xpZsvX5mh8qLSSEMAeALiZS7r8RzmkZQKeJ6VzGar8GDHyyi1NsWkJAailAb_4JBZcRzyk7w7x3SikdHpyaHw8ldRrIt667G-dH0ibY5613dB3Kbgk0GSwKUIgTwFwlLAbLVg&google_hm=ekp3a2ptWnVaM09XMkNCQ0lVZzc=

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:55 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=ASkJ3FY2T6xpZsvX5mh8qLSSEMAeALiZS7r8RzmkZQKeJ6VzGar8GDHyyi1NsWkJAailAb_4JBZcRzyk7w7x3SikdHpyaHw8ldRrIt667G-dH0ibY5613dB3Kbgk0GSwKUIgTwFwlLAbLVg&google_hm=ekp3a2ptWnVaM09XMkNCQ0lVZzc=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 279
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F179
Redirect Chain

https://ds.uncn.jp/doubleclick/0/sync_push?google_gid=CAESEChHzrn2axvkrMnqiexmBeU&google_cver=1&google_push=ASkJ3FZLW4B2Ym0jbrdwyiPoPkD8s8uc1cuAr0XZqXPjrdxq3s09J3YL3zGt4rWQP3cATMpfv3I2n6gYV0znvpiFH...
https://cm.g.doubleclick.net/pixel?google_nid=unicorn&google_push=ASkJ3FZLW4B2Ym0jbrdwyiPoPkD8s8uc1cuAr0XZqXPjrdxq3s09J3YL3zGt4rWQP3cATMpfv3I2n6gYV0znvpiFHHLywCynX_WWt0-b3hYezitQ_WxtmfpQL3MzZM33UqJ...

170 B
232 B

575ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=unicorn&google_push=ASkJ3FZLW4B2Ym0jbrdwyiPoPkD8s8uc1cuAr0XZqXPjrdxq3s09J3YL3zGt4rWQP3cATMpfv3I2n6gYV0znvpiFHHLywCynX_WWt0-b3hYezitQ_WxtmfpQL3MzZM33UqJTMl8nrLETxs0&google_hm=AUpQgebC3U0hjQYeDQePnzQ

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=unicorn&google_push=ASkJ3FZLW4B2Ym0jbrdwyiPoPkD8s8uc1cuAr0XZqXPjrdxq3s09J3YL3zGt4rWQP3cATMpfv3I2n6gYV0znvpiFHHLywCynX_WWt0-b3hYezitQ_WxtmfpQL3MzZM33UqJTMl8nrLETxs0&google_hm=AUpQgebC3U0hjQYeDQePnzQ
Date: Tue, 22 Nov 2022 08:19:54 GMT
Server: Apache
Connection: keep-alive
Content-Length: 274
Content-Type: text/html; charset=utf-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F179
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEAilFCVikpUTOFhL2G5cM9A&google_cver=1&google_push=ASkJ3FaO2BctrpuWdWUr1z1FVeFbIKuiZxYfM_1HhzKpNG24kjQZ2MoXwXcbSoExrenM0aB5AyVMoeRVlYOExRYM7ka_-58HEmtMN...
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FaO2BctrpuWdWUr1z1FVeFbIKuiZxYfM_1HhzKpNG24kjQZ2MoXwXcbSoExrenM0aB5AyVMoeRVlYOExRYM7ka_-58HEmtMNUmUhBjqcOOLb0V-uXWioUjtwi83M7...

170 B
243 B

274ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FaO2BctrpuWdWUr1z1FVeFbIKuiZxYfM_1HhzKpNG24kjQZ2MoXwXcbSoExrenM0aB5AyVMoeRVlYOExRYM7ka_-58HEmtMNUmUhBjqcOOLb0V-uXWioUjtwi83M71cviV_j95-B2A&google_hm=b10c4fcb1a7cebb04f59106935b40d71

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=ASkJ3FaO2BctrpuWdWUr1z1FVeFbIKuiZxYfM_1HhzKpNG24kjQZ2MoXwXcbSoExrenM0aB5AyVMoeRVlYOExRYM7ka_-58HEmtMNUmUhBjqcOOLb0V-uXWioUjtwi83M71cviV_j95-B2A&google_hm=b10c4fcb1a7cebb04f59106935b40d71
date: Tue, 22 Nov 2022 08:19:54 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F179
Redirect Chain

https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEGijH8MZO1WiO6vFigapfQ4&google_cver=1&google_push=ASkJ3FalVtwFuGz3qiHKx8k5FMLS67cgiRORyj88UmT2h3qcxcdtDxnfIY2PpTGBhNgd_ds6_yWeafys...
https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.e-volution.ai%2Fsync%3Fexchange%3D193%26google_gid%3DCAESEGijH8MZO1WiO6vFigapfQ4%26google_cver%3D1%26google_push%3DASkJ3FalVtwFuGz3qiHKx8...
https://rtb2-useast.e-volution.ai/sync?adkuid=A6231040601362519438&exchange=193&google_gid=CAESEGijH8MZO1WiO6vFigapfQ4&google_cver=1&google_push=ASkJ3FalVtwFuGz3qiHKx8k5FMLS67cgiRORyj88UmT2h3qcxcdt...
https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTYyMzEwNDA2MDEzNjI1MTk0Mzg&google_push=ASkJ3FalVtwFuGz3qiHKx8k5FMLS67cgiRORyj88UmT2h3qcxcdtDxnfIY2PpTGBhNgd_ds6_yWeafy...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTYyMzEwNDA2MDEzNjI1MTk0Mzg&google_push=ASkJ3FalVtwFuGz3qiHKx8k5FMLS67cgiRORyj88UmT2h3qcxcdtDxnfIY2PpTGBhNgd_ds6_yWeafysGCV8F-3gnE5CQ8T-0mxMY3LdFC07yHESzeyw-GyLt9b5JZ1uxeDpQaAMgDoAtaxF

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=metup_srl_w_bidswitch&google_hm=QTYyMzEwNDA2MDEzNjI1MTk0Mzg&google_push=ASkJ3FalVtwFuGz3qiHKx8k5FMLS67cgiRORyj88UmT2h3qcxcdtDxnfIY2PpTGBhNgd_ds6_yWeafysGCV8F-3gnE5CQ8T-0mxMY3LdFC07yHESzeyw-GyLt9b5JZ1uxeDpQaAMgDoAtaxF
Date: Tue, 22 Nov 2022 08:19:57 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame F179 0
223 B 817ms
272ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LnvFIVGMPLP5NUQmJvn6V5FQNTrI-TGl6lu6VRU7u7GzncwAo8RtWHKFDzH6_dhDUvqInQLQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 29C5 17 KB
7 KB 586ms
345ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:19:54 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 25 KB
10 KB 725ms
239ms Script
application/javascript 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/pbuseridscripts/quantcast.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 275094aa5d73cd24d848e78f0c41c33d9fd61a09d97b9976e5e707dfd24ada00

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
etag: "nAbmxtqHqaYrwBiADJAeFg=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 29 Nov 2022 08:19:55 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 439ms
151ms XHR
application/json 104.16.89.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20221122

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.89.20 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9da0fe4dbc7641c2431d0a9559f190e3472dee21c4f2e24bcbd2bc143419dc7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 19124
x-jsd-version: 1.0.1531
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230021-FRA, cache-yyz4543-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"66c-hQ4fRIJVsyvvzCIJAYWx//oyR6s"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fGFWd7RNEM6P0nyVBHDHKi%2Be0G4RUbHSGBGuKnKuj%2BKdE4FZHVyJDBzlvtEWzilmnUhhnZJdwC0KSN%2FRDwKtsPHdccInSD2wSN9X2o9aSbBEfM4qenoU5srsfJu6gJ%2FwghY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 76e03e2b999caad1-SYD

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
547 B 1339ms
868ms XHR
application/json 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-220-250-200.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://www.bg3.co
content-type: application/json
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 200 adreq Show response
ads.servenobid.com/ 717 B
672 B 1381ms
562ms XHR
application/json 54.75.88.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=1090
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.88.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-88-22.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 037192b727defa55cc176629db61c9c71c1126decfae405ffc3b0fb355a0d705

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
406 B 1944ms
329ms XHR
application/json 52.194.41.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.41.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-41-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: edf3f9c83472feef43da935ce3468c5aa6a91727ff84075e7af5ddfb5077194c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 174
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 185 B
408 B 1928ms
313ms XHR
application/json 52.194.41.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.41.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-41-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: 131202558010ef368dfd0dfc0f92f2ab03fd62d518952059069802d1d2d213e0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 175
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 186 B
408 B 2982ms
1368ms XHR
application/json 52.194.41.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.194.41.20 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-194-41-20.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: bc974d86d700a3be9a29dd665c169c4a890b02682185e7e991b9a94b37178626

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:57 GMT
content-encoding: gzip
x-prebid: pbs-java/1.104.0
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 176
expires: 0

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 472 B
2 KB 1157ms
364ms XHR
application/json 69.173.158.65
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=20616&site_id=395958&zone_id=2209398&size_id=15%3B2%3B8&alt_size_ids=2%2C1%2C13%2C14%2C19%2C43%2C44%2C117%3B1%2C43%2C44%3B&rp_schain=1.0,1!adpushup.com,062d9a21f747ddee7c25d4297776e0aa,1,,,&eid_pubcid.org=91ea02a2-a86b-4c84-b085-e88be2be9297%5E1&rf=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&tk_flint=pbjs_lite_v6.19.0&x_source.tid=921e1374-478e-4eb2-bc5a-cb9b6117bba0%3B7dada669-b4ec-4b68-a063-f7828151adec%3Bdca74a31-825e-4bd5-b819-53756f5029fc&l_pb_bid_id=10291bcfb6450c5%3B110447d78121e27%3B129e53a5661f57f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=3&rand=0.4728268897878132
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.158.65 Ashburn, United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0b505b223537348fe75b273cefbf4b09b963f2f36bcee936066ad9137a81e5d8

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
361 B 996ms
422ms XHR
application/json 35.213.117.18
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.117.18 Tokyo, Japan, ASN15169 (GOOGLE, US),
Reverse DNS: 18.117.213.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1c8bc29d0d4d120abfa31f63929ab18a1ba14eedcd5989c7cf2357500b9cd6eb

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 22 Nov 2022 08:19:55 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
504 B 952ms
472ms XHR
application/json 52.220.250.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.19.0&referrer=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&tmax=3000

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.220.250.200 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
accept-ch: sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1 KB 696ms
409ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUPEPKI9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6fcf44a82badcf6c6228ef61797779a93fa2fcbe0a9d1d5e5cb861abb72776f2

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 172
alt-svc: clear
expires: Tue, 22 Nov 2022 08:19:54 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
331 B 670ms
426ms XHR
application/json 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22338aacdeea81b94%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A7%2C%22msi%22%3A7%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22404088ab793d58%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A250%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22250x250%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22437d96bb187f8be%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A320%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22320x50%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A50%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22300x50%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2244700005afb2d6a%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A120%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2291ea02a2-a86b-4c84-b085-e88be2be9297%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bf27635317f856537f50fc2097b49466a040a3535babb22a10d36e45d7e3324

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zt47p%2FCfRhxdOWCIGOLLRo7pKX4Bp8CnMB0phd5HgCOiVpVynVIqOsjxre9Yb1t4ilm4nC58NS6FDOoiE5A8LweFDianRZR2Qbm%2F2JrbpwHq3DSedalGZKGrB8cZ%2BB20nNRpUnyh"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 76e03e2b7aef1c4e-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 37 B
563 B 529ms
286ms XHR
application/json 172.64.154.237
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=693656&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%22338aacdeea81b94%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A3%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A3%2C%22ou%22%3A3%2C%22allu%22%3A3%2C%22ren%22%3Atrue%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22437d96bb187f8be%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22728x90%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B728%2C90%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A728%2C%22h%22%3A90%7D%7D%2C%7B%22id%22%3A%2244700005afb2d6a%22%2C%22ext%22%3A%7B%22siteID%22%3A%22693656%22%2C%22sid%22%3A%22120x600%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B%5B120%2C600%5D%5D%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22placement%22%3A4%2C%22w%22%3A120%2C%22h%22%3A600%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adpushup.com%22%2C%22sid%22%3A%22062d9a21f747ddee7c25d4297776e0aa%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2291ea02a2-a86b-4c84-b085-e88be2be9297%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bf27635317f856537f50fc2097b49466a040a3535babb22a10d36e45d7e3324

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1GKMozYvk8fJwC9ab3nV0TBJgediYvugiKoS5O84qePKOiX%2Bgq5d%2FgxL8zAIUn7%2FvT2ltovbuhsi%2Fh7UwNIx7wt6K5Hg3Sfie5jt11EDkxRBt15knM6uOFGdq6boHV%2FtvuCRr1eC"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 76e03e2b7af11c4e-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
167 B 1375ms
457ms XHR
text/plain 145.40.89.200
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.89.200 Ashburn, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Tue, 22 Nov 2022 08:19:55 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 377 B
1 KB 1469ms
540ms XHR
application/json 68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.182 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

075d8e89db9216415410085ab7d5f5111dee337cf18506198f43e32b7ad3f7fd

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:55 GMT
AN-X-Request-Uuid: 074120fa-97e6-468d-bbf4-b6419d2311a7
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.bg3.co
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 377
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 3 B
518 B 930ms
313ms XHR
application/json 44.230.118.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&CanonicalUrl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&PublisherDomain=https%3A%2F%2Fbg3.co%2F

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.230.118.67 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-230-118-67.us-west-2.compute.amazonaws.com

Software

Resource Hash

37517e5f3dc66819f61f5a7bb8ace1921282415f10551d2defa5c3eb0985b570

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
via: kong/2.8.3
x-content-type-options: nosniff
x-kong-proxy-latency: 0
p3p: CP="CAO PSA OUR"
x-kong-upstream-latency: 10
content-length: 3
pragma: no-cache
access-control-max-age: 3600
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding
access-control-allow-headers: Accept-Encoding, Content-Type
expires: 0

GET
H2 200 arj Show response
adpushup-d.openx.net/w/1.0/ 174 B
382 B 633ms
344ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=effae5dc-5169-420a-b5a2-69db20aff0fd%2C37fcd8f3-8d58-4788-9d76-f5b05553878f%2Cb13938cc-3015-4d16-9a80-12bcd57718e7&nocache=1669105194496&pubcid=91ea02a2-a86b-4c84-b085-e88be2be9297&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&aus=728x250%2C728x90%2C690x90%2C690x250%2C675x90%2C675x250%2C670x90%2C670x250%2C650x90%2C650x250%2C650x150%2C630x90%2C630x250%2C602x100%2C600x90%2C600x250%2C580x90%2C570x90%2C550x150%2C468x60%2C320x50%2C320x100%2C300x50%2C300x100%2C300x75%2C300x250%2C250x250%2C200x200%7C728x90%2C690x90%2C675x90%2C670x90%2C650x90%2C630x90%2C600x90%2C580x90%2C570x90%2C468x60%2C320x50%2C300x50%2C300x75%7C120x600&divids=ADP_42753_728X250_77a9c22f-ac02-45dd-96bc-b0896a8a7d5a%2CSTICKY_ADP_42753_728X90_d1c10a72-27b4-4931-8ce7-99a18ebbdbae%2CSTICKY_ADP_42753_120X600_104b282a-bd11-4d8d-ad64-0492063b6cba&aucs=%2C%2C&auid=545618347%2C545618347%2C545618347
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: f2a90ae379711cfee6456a709953b2838219f69158d12f662c6cffbaedb24a66

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
504 B 530ms
242ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=d5c85248-3344-492a-b9e6-89003d148f0e&nocache=1669105194496&pubcid=91ea02a2-a86b-4c84-b085-e88be2be9297&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=120&vht=600&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 530ms
242ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=21c93194-62f6-4767-93e0-8d6486930520&nocache=1669105194496&pubcid=91ea02a2-a86b-4c84-b085-e88be2be9297&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=728&vht=90&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 avjp Show response
adpushup-d.openx.net/v/1.0/ 106 B
296 B 540ms
253ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://adpushup-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=d0e4f446-7c44-475e-a499-65b1915c9f07&nocache=1669105194496&pubcid=91ea02a2-a86b-4c84-b085-e88be2be9297&schain=1.0%2C1!adpushup.com%2C062d9a21f747ddee7c25d4297776e0aa%2C1%2C%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A300%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22api%22%3A%5B2%5D%2C%22playbackmethod%22%3A6%2C%22linearity%22%3A1%7D%7D%5D%7D&auid=545618481&vwd=400&vht=225&vos=101&vmimes=video%2Fmp4%2Cvideo%2Fwebm
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
via: 1.1 google
server: OXGW/0.0.0
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.bg3.co
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 106
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
502 B 1174ms
343ms XHR
application/json 184.51.137.72
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.51.137.72 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-137-72.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.bg3.co
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Tue, 22 Nov 2022 08:19:55 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
212 B 783ms
307ms XHR
text/plain 182.161.73.145
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.19.0&cb=76060731842

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.145 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 22 Nov 2022 08:19:54 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://www.bg3.co
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

GET
H3 200 pubads_impl_2022111501.js Show response
securepubads.g.doubleclick.net/gpt/ 381 KB
129 KB 271ms
271ms Script
text/javascript 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4c7748a8849068a7262049472b6b640aea77d843c16a57de3e34d3c47e4a01f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 12:10:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 590981
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132177
x-xss-protection: 0
last-modified: Tue, 15 Nov 2022 09:35:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 15 Nov 2023 12:10:15 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 109 B
97 B 813ms
273ms XHR
application/json 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

57ba9c79273602051bd0fa9f6dcd52a3f199dc59f134308efeeaad35424b8311

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
expires: Tue, 22 Nov 2022 08:19:55 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 86DB 2 KB
1 KB 708ms
234ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y3yGKQAFoaUKaIaIAAYgwMQuxNfWMRpOE5N2EA&u=%7Cevw5r3VRIwk532R%2Fv1WWsBpJJspVuNjZ7HZLB62tBhc%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqc6nygJ274zNPhQpJEnippfnLPctJAgOVJK5QBvON9Ye9GS_f4NkHgJjP411SnRRB4N9zppcsUR56obfg04jLRDchwksXCK1v-Vbm_d4PtWdUW43-WPa8R4lX9iJzgHGmk3iG-01gIzUQQ_SggXE58TLtEVdevqmA8tjsTfiKPP_1y8XA_bBVrj8pyuKvPkbi9EWGVBC_qDfIfaO9moPltv_CZ9TP77Oq62Zw9xxxm3JoUoMLEzamO_YEJniBtOyIiO2JikzTsborXKV5Bi8jlTsapWUlM5UuM776V--xjKfy3Ru9iez5jE0mUKUUQeWE264Q-aC0itKvWzpXwozqU20lRXqLlUhCLpEKQ4lE_VgHki5JsqzzArFwkcr2XJkUDjFLiLOfdW-XnHzDEvOKn-VJ5VvcU-UamBuI4p5ADbzJy3KZmsMELNXGf9bFbhEPxjHmdFnGhH8ByU_rHXFB0AoY29yom1W2nP0Pxiyh7hvmOMdhxJ3qq-6802G3JbLf8oU0hzKJUw3CgYp576rbhcBk8lZgT5bLS1lGdZTl3i_dbQuSTkEBB1wNyp0Mg8JMdeqvWheL1D5cXCYJ9OP9_atulBeYNUFBUQRmrXct7nRw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC3JhbKYZ8Y6XDFoiNogPAwZj4CJj80bFcqoTM5IUBwI23ARABIABgq-yxheAYggEXY2EtcHViLTQ0ODUyMzk0MjU5MjQ3ODfIAQmpAk-FpKWvNaY-qAMBqgS_Ak_Q1EBf5y_FYrslLzTY5b9qVzFLkQqP8ndzBaDjPcPGJEqK9pX5hlXy9JiLed8AnpZUFzEM28q6cJEwtsius_T2PbGVZMNxGOuTkrKicFmNaQRtTadcfkh007YXGOfpLIbDgL8GjXkupqXAFjS9coGYUUOGW1uHskNKsGcwJn-Nv_fAZ9a8kC9Dn-ZsiZKVqrm6EMPsMtnqMYUnDRDj9frqsKd_8yhlwb7PCg7Wjig4luLTjYDg-yINtzs9oyb-js5rFAw7Fo-K7F7lTFn1hAoj5lmgM7BS72YaVFXOQcOi_IiWXXu98u15chgO9wEDytCxNzGDi1YY5SjkhVeIEnOD1wIU2awGkmn8_18lyrpWQKF-ypLO_KXUVjqqR9iwJNYhsE9YsBqz-zYBlVAgLDeroR6lB2tdgsRm2Ly0BnCABoa-5eC5laDtXKAGIagHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3dHZr9d17iGjIKChwhFcj1nmx72A%26client%3Dca-pub-4485239425924787%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 86DB 2 KB
1 KB 709ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 86DB 308 B
636 B 709ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 86DB 293 B
621 B 708ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 86DB 43 B
348 B 710ms
238ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=nR3ns9coigJOBeypeqOkoG4CeIwye5PId1PwXmU3wvB7qkOI-KKlhxLz1yORceVKC2iaQfZdDCfEN2oHIFhwtZOlfB_l58Y51OJuNMMQhfC3ApHm9qFG7AZ4DUQcVPh72gZZ0Q2tMdJG8c81wCS1DjiihKlTkHL16EbCe4WNtARd5u1u4KEvDIlWHlzdUXzHSIXwRpRTMNuKOpenkjjNPI6mVjSq9_mgTfW4MlOHTjFUXZ6aAm1v7l-Y2plNPSHDqZfFC6b7bqbbdjSKIoOeqnWPQLDkYFJ8s9__ic-Mo1KDqhaQTUc202fPLUz2c2B5hbNxHoBUjTCunp0u8Q-HKRj0JD1_3rdCVh280Jk5VZ96EYF4WGTHqdF5Gm6K94ieOQ_4d0lyWgGOC5vNXPw4VqaE6OcdDw8ZdkP2rL4lZPh8yteP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:54 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2970592
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff
static.criteo.net/design/dt/ Frame 86DB 24 KB
24 KB 706ms
236ms Font
application/octet-stream 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

0b81ebd295c56386af5d622092d29db6ecb12a7f8dc8be80fe54cbbfa3d3216e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Origin: https://ads.as.criteo.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 12 Feb 2018 16:12:56 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5a81bd08-5f2c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9E24
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1&C=1

43 B
766 B

337ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNUleEqE_NLS2dMxJBrEcsRZPWBwxpwD-AHf34HrArboAtrrNYSrqowdv7WAeal6xgf6L6fqBfW6r9HsD_uChMZeNMSUPA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9E24
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y3yGK1.3r-m6ESHna6aYFwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1&google_hm=2

43 B
766 B

338ms
337ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNUleEqE_NLS2dMxJBrEcsRZPWBwxpwD-AHf34HrArboAtrrNYSrqowdv7WAeal6xgf6L6fqBfW6r9HsD_uChMZeNMSUPA
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:56 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEpLY0pKlcmd3tngJmuhVQk&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 9E24
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAaUUgKOKzfJy5MESZROyL0&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAaUUgKOKzfJy5MESZROyL0%26google_cver%3D1

43 B
1 KB

469ms
469ms

Image
image/gif

68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAaUUgKOKzfJy5MESZROyL0%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICENn9hYADGL2BgsgBMAE&v=APEucNUleEqE_NLS2dMxJBrEcsRZPWBwxpwD-AHf34HrArboAtrrNYSrqowdv7WAeal6xgf6L6fqBfW6r9HsD_uChMZeNMSUPA

Protocol

HTTP/1.1

Server

68.67.161.182 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:56 GMT
AN-X-Request-Uuid: 7938776e-60e2-4c5c-8145-06ab324001dc
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:55 GMT
AN-X-Request-Uuid: 238c351d-f971-41bd-922f-ac1d68e14179
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEAaUUgKOKzfJy5MESZROyL0%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9E24
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA0ODM4NzMwNjAyMzQzNDc1Mw%3D%3D

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA0ODM4NzMwNjAyMzQzNDc1Mw%3D%3D

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:19:56 GMT
AN-X-Request-Uuid: 50fac42b-f407-4f33-a612-d037b9d3529b
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjA0ODM4NzMwNjAyMzQzNDc1Mw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 8DDF 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 12832469ab571c735b93dd751c8803fa1fb3bc0742271af0c74f540afb8bf525

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B899 41 KB
15 KB 571ms
270ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BBEpAVWSF3u9m1vGK0cPt8p1FxhDb4XJEYfjdOCiiqLQF4wIF0EWdYtPeE3da50YG60Jm5YBaptmgtor8PvIpID1_SNN7RG-gUYGsQbgjMTxkz_W17QbIXE6eUMx_Sq4JazvI-e-SGLzzouDUnP8OKthHEHaOkrWrp4tJunVuPx9wN6UA&cry=1&dbm_d=AKAmf-BDCnRRLXFMIev_IiaSgAtr1xdLrKHU4atBZqw68nrXKXYOSoypo2HFBrQ9PhpYzXewTFZqHRyST1JZMAG3X6W48YgPAj4Z9wARu9LR_b6w_vZyMVtMbAdsrYv4D9R0h6aVYxxGRcZ8fnliKz0B5Cl77uYyw9c0IFs6zPvXsKVOpx5po2Y9iAgK9BN84ZH1tX6eGjNuOsyKwKYesL2p7UGrfelL232Gj8EtnJ3Zq5qijbdprylyX-tWmK1txu3bicKg1HPDrkjlCESfDBQfR9me5fYNDkud59B6f5SOqocb8sJpVTuzGX8UuIhzuuRGBqLNof1lFINzF8UlCWlJq-uvfweKI2Tu5LsMrl1EOa7mfhlEsJIn95UD1NjmzNfYlovMvj85G1cTT_43eIP1_xHfEfy7IABAEguKFfOutZmoVVIkytamVB9Sz2pe_AJFxdSSk7cXllBvlQUeqZaA3KpCLTrnwvImacvD4_lYDF8PeaEDs2fmh_xpsen0JzhaFqI_ta63na6OpUp9tgGQQdDgRaaTyRhOBFcm-_TNFg_cg2eLnWfxl94Z4tHmMX-HMgpnAxOZnB9zeoMfEWztHPYKWR1HXkDf5UVxGzQsyLAaB6rUY5aSpolXsoRxnIEU34_OQVs3F-6ic8Q1cB9f8Yhq_gUfLS3kvWIv3x6ZCQw-d6HBFLvpJWHgNDiViGEWGzSJ_zFVoSx-JRDII5pHBK6KsBsZJqZ36U4B4j3oWDuPzs6ALZBTawWBB__vTUZ_VoVJ1AQxS-fREe-UrIoYiunjpewRr1S0BnTlzdGtkXg3-iABNCebdC3UJraMzXMPNUZztMQ9hAnmK2bV_LcOwXp_XtSwSYmj56v08BMrQX802fraGBrmAXWPaMLZhv9ya-xFO3HpqgTiGQMc6QyT5GfTDhcN7pxURRIBBKfvdcwNfEVXTmx6GL2Ly0p2w4U6k4QY3CT6TpxU9eWe7c8KCSLVRO4_Zyzzrl_U8nn7lXhAO-s7RxEBgFHdhS9VXa3EDJ-XSvM8g6Mlaw8hDV7WqTXpPdKUvv2QoywhjuwYdzN77rkKpTTNowOA_dxZzBuC5_wfR5Fmut39UsuLLR0slAr5bl4YxdjlXkYN69FyLYB2vPHN6xzAV3lBhsqgLeVlIoAhXVdDO2MbtqxOofq4Okb-ZAZ6ajzNAs0GI6Xc9HyaSorSA5n_zjqBgUHpaV_KcAZhbY2vTI7XnQaGfaOFaBotb63JtSx2vF2y86tWuNbMSUx2ugi2k8gEcc893YRh7CuijOuvoTJ0yYwS7Z58xg9JGJrJE8x7HSPL02Eu-hBpsdfF6SDWQmoqEwvHed4-ywL8GEWU_vydoKMLjUeS4HlNkfCCAVOrut3TWeD5TjJK9g3X5E7IdNIfanvbHC-iGWudawasfckQB-_AWPCOccVuVyVj1d8-A12fRL4xwLSJWhgRnL2E5Lc90FkfADKVGuPEAdRX1rirQzpc4ZrYIKxcVVHHpud7RcFN3ro2BWegCqC2Wh954_6Nv4YJDaw15_cNGEy7PgmQDehrr7Zrxqc9RyVzC77OMk_-QXsXAv9YsIEW13xzuMHdweDovPVvx162iSbeZKsUWn52qsc611sll8DcF49hmEWFJ1oH3WueRLJ4PHgXQR4-oDW_qnrnCHFY2jB74_2HdMn2LYjexq8Jk7DCCruUl61Bm5gIDD2rWRk0vEkJJOMAKAsHKv9ZooTI8XneAQ1UXhNofBSL3nNwMB21LXanapCTjz6swdl6VYtiVJSNS_elgwGojzkm9_uygduM-X4iqXUBxlLVQRKodQRSJYMKI7GtFUN5Wa_tXbCkqM6tbN4pyla4c1IbhP-_NHOF6jgEEVXIvAA63y43nhmUrVJMFkFgg40GQn9A5beOSJLEGZYqBjVNZZLuZ0E2AI2ClJqmp96bmu6VP1gWVDNNQm5DtkO1k31Uks6s3kK9ZKOpVD_8U1DvpFT7djsz3fkViKkP5-3KV3HBBhqhpZDnB-2iScX60UW3mAwvsrtzpp2DYnHTLf0uKhPOMUC7IYs2G5t0HfGJD9vOCIu5AuLc5b0SZuy-btLyMwZdiy92UGpbd8hiMy2_gvs2_7-iACo33u709kAKKtvu9r_7SzSeYhAPOve1k8swkV3FzFabVz7d6_2AurzGZW4YUE9FkgdwT793_xlAGHa7o9QNclEMWaSyNY_keRpX__YuQ9MKiUmyG7HgOUECLxmKKWNtZLbPM5fLF3H272TExm8h3tBX9AVmGzSon1wJ99TI0ZtVJVc30pYeg7R9dYqJwOWQ7CLhF0g2SZSEwkJl90VAWABMUVzUIrY-dIlw5dT_agVrMH6vJ1AITh5E9n-AaY0PMvADCD-xZtlvek_Ki5G22k0Z0r7eLUmY3dsEOlJ258ZKdSmeJFw75qjhV6aN8SI75Mvf7KF9VycB8BFj9kNvVJrEzoc2QAkcEM9RiYdmqqw-88Y9nUt6r214s7SWqfOBgi7jDPm3VmnZ5o2dZocw--qtEYajhtX_r7ZT2q5ZWAj5V-rI-CDrFHClpQaTc13SBKBkt2q84m3iRZR-3YjCEul0CR-OwyOAPoLLwlwJ9vvUlj1e7z-4A3ez2_0fL_7qFqBVkMtCYZRw5sUgsng4TcHtG0srhmBLw-xuADioFac7JAzc8DwV1zOGh4QreTBmWtN0WggONDqRf1eqFgkf9EqaDi9ugcjrCKdIuCCxdStXpGe4Ezs4-JNzwb9gncYUsVWKCpCc3aha4nDSHi0DL7DMcLCG1b2bdmYDyIFmLKG9saxOaF59xRKADjsS4uC4w_bQpI444V3ZA1c0wBz2qO-RRu02-XCedjeaaXwkDifzVpOhwLl8OE77hmSTlPNSHWbYcF7CMhYJ02FzJeuf-v_neVew5NBncg2eiTxurIbF-92ZawTjINIqGCc11EKXxhnrtT14bQFOisdwQrwbSbfkynhUQ2tGDmhs-NgurC0nvFJXUPKvXt75EjgGNLKkZAcBICiD17PTEV1DQwLjxnI9jeMmj5TqiStNHULe42zQ7_fWdBf7Ztm826_qOCRRw5PThWdwlP2JIkEURNfF0SIp-QGbtV5VGYUmX3jQA0tILtv-DtJCNLmFgtfsxK0r3sBr0G0ACjQQDYrt9bG0fyCFokF5co3SXDayyvLDg3iTJWoX6xQGSK28jvU5EtmAMVvQ7234_vscCFGbdSSY-OIAY0-2PCbDECKt4lzWq8sC6BALfL9wn8TJRcEJOj1fq3LScP9FF1_lKg5WjSTHSjaFJy3jAyxouB138bBQFjpaSnu0yrY8ccDubxJDbP7tVATIz6baO-aPuKUmQXZbg04wXCP4l0r5kwjhLQuVKRdkES1TuKHX6S_s96d2ZbjnS37rb-mH0Yt7TW6xMDcanKiP44NeLuPxzYvM-R3Nutr7iJ3MaC3Trao6gPU7V60jbnp8&cid=CAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw&rfl=3%2Chttps%253A%252F%252Fwww.bg3.co%242%2Chttps%253A%252F%252Fwww.bg3.co%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 22:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 555127
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Nov 2023 22:07:48 GMT

GET
H/1.1 200
OK frm Show response
www.adtrek.co/adserver/ Frame C299 26 KB
26 KB 730ms
290ms Document
text/html 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 2a20c27bb3b74878b1298ab952c0142b4e08db0a35d6165ccbb546976b0e7bb1

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 26238
Content-Type: text/html; charset=utf-8
Date: Tue, 22 Nov 2022 08:19:48 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Powered-By: ASP.NET

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 24DD 1 KB
643 B 279ms
275ms Document
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 43977
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 21 Nov 2022 20:06:57 GMT
etag: 48472445140208031
expires: Tue, 22 Nov 2022 20:06:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B899 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e507dd2c3e36a8dae5a2feee0eec40d63104367ef647ce16bc7991e0c21c46d4

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 86DB 12 KB
5 KB 441ms
154ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 558376
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JwBw5f5zs%2Bj2uUa3xrJOVt2nv%2Fw7jOTUtUynI85nOdvgfb5bk1PBXzFgQgG2qqrG0%2B4VRUI7IrIZQsiV49xTfMwrLJ06mFSzUgh9Rs%2F7op7ShlKPdypzv7pXSu%2FlQsj2mg3Tqac%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76e03e30bc5caaed-SYD
expires: Sun, 12 Nov 2023 08:19:55 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 86DB 12 KB
6 KB 235ms
235ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 113E 13 KB
5 KB 572ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 163743
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 20 Nov 2022 10:50:52 GMT
expires: Mon, 20 Nov 2023 10:50:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0830 783 B
1001 B 575ms
274ms Document
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e5aca25c583c468cad244009469dc4cde16d2114b2b89cce84c7553d29aed236

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-U2AKTIZmnxBaHSGxnt6SGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-U2AKTIZmnxBaHSGxnt6SGg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:55 GMT
expires: Tue, 22 Nov 2022 08:19:55 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 img
pix.as.criteo.net/img/ Frame 86DB 23 KB
23 KB 964ms
489ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=92&m=0&partner=71731&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F38393%2F210902%2F5040eeb44263442baf5e2a4c19e0442e_horizontal.png&v=3&w=668&s=WkXOAvaQoCmLcMM2m3Gv6Scf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

bb9338391e8fd82b612d7b68d8b3957b335090b5d94ef80df781105f1a706e1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=26596507
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23369
expires: Tue, 26 Sep 2023 04:15:03 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 86DB 7 KB
7 KB 1042ms
567ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdwa5c174f3%2Fimages%2F114752-Master%2F114752-REDCL-front.jpg&v=3&w=400&s=LyqcDXJfOSbrf3ZAmUJ1-_Uk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

5dca70770a6051f433669ffb677876d4db6ab892f411a7362cda46df269c47c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=237272
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6848
expires: Fri, 25 Nov 2022 02:14:28 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 86DB 13 KB
14 KB 942ms
466ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdwec30e73c%2Fimages%2F120129-Master%2F120129-DOL00-front.jpg&v=3&w=400&s=Q-p6zj9AkCnm72wFTk5_rcTk&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

abfa0d18d9922693e3093215bfb6ff22f09f551c2e07217b53a6f13338bacb1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1874538
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13764
expires: Wed, 14 Dec 2022 01:02:14 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 86DB 0
128 B 711ms
236ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=NZxGKX-GkGlDXTZazk_3rquxWfD_5bQoFp4UVl5FBYVxUHzmnTLjv3W3Beed2JLilgHNDGFmqCveM1X-pZSsBe82XQxnn-eJx1UHXnieKUoGvWuny9Hnl7bWQk4Sv89VpANYIhFZJ_8z3I95YsfpamE7AdnBbrvIOvoM9T_KZ7erKYPsLKQLiDdBt9gsMiUFZ3MoXal-OAyqjqOH3jAlTk-1Ju56W2Oxhlh-bmR69hmHKklfN9C6N37j7D-rPGbDyrXzDFdnW2YQ7Sxt&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 86DB 2 KB
1 KB 237ms
236ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 86DB 2 KB
1 KB 235ms
234ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:55 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 16E2 13 KB
5 KB 557ms
271ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 163743
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 20 Nov 2022 10:50:52 GMT
expires: Mon, 20 Nov 2023 10:50:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C447 783 B
741 B 577ms
275ms Document
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

18143000fea7aea064eaad407a547b815ef1b27a4784b9f05803af8681c85097

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EV_fYmyoSxVIXOwDy-NIzg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cdn.aralego.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-EV_fYmyoSxVIXOwDy-NIzg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:55 GMT
expires: Tue, 22 Nov 2022 08:19:55 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 dpixel
cms.quantserve.com/ Frame 24DD 35 B
462 B 240ms
237ms Image
image/gif 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEH9ImyXO3zInkCNFBUNJY7U&google_cver=1&google_push=ASkJ3FaRR4HonjYh3CTcUoWGOEDcaa9Sa6o4W000JWLtdrbB3QFh7gfA_ATs5rj_b_6N-4cduoCXsnHTza_lLvDA3ieZD3eK8XpfXQORDKbew49khxTNtt1jwIULaKmfTn7pewlWndz3_C-0ZT3tpCoI2Xs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 24DD
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEM6pnCY0SgcNMopQD__i7nc&google_cver=1&google_push=ASkJ3Fb0vGwQIuWdLmX13SFK-uzJP98rX6dNQqPJguE8SkN6_1Ojayb...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=4e9723a6434f1b21&is_secure=true&networkId=14000&version=1&google_gid=CAESEM6pnCY0SgcNMopQD__i7nc&google_cver=1&google_push=ASkJ3Fb0vGwQ...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAALfxeXJqDx0wN8cj9gAAAAAAA&expiration=1669191596&google_cver=1&is_secure=true&google_gid=CAESEM6pnCY0SgcNMopQD__i7...

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAALfxeXJqDx0wN8cj9gAAAAAAA&expiration=1669191596&google_cver=1&is_secure=true&google_gid=CAESEM6pnCY0SgcNMopQD__i7nc&google_push=ASkJ3Fb0vGwQIuWdLmX13SFK-uzJP98rX6dNQqPJguE8SkN6_1OjaybTl0FcBUHB21YbAynrkfbyAJ75FEhsZuAKIIINNvDB4nrZ0ugFF4beojNF7WCtd-COgqZLof1HlC6h-HRKH4QY2LGkFquZMRwfGw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AAALfxeXJqDx0wN8cj9gAAAAAAA&expiration=1669191596&google_cver=1&is_secure=true&google_gid=CAESEM6pnCY0SgcNMopQD__i7nc&google_push=ASkJ3Fb0vGwQIuWdLmX13SFK-uzJP98rX6dNQqPJguE8SkN6_1OjaybTl0FcBUHB21YbAynrkfbyAJ75FEhsZuAKIIINNvDB4nrZ0ugFF4beojNF7WCtd-COgqZLof1HlC6h-HRKH4QY2LGkFquZMRwfGw
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 24DD
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEHTYxKgswbv6C4e2nCR_Zfo&google_cver=1&google_push=ASkJ3FbrmtUKgFHvaqlMly3BvoOI8WEkDjKsIJkyMFsGHuhf5_2eBF2haKsKRM4FqoJ4AVWTqA_CO...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ASkJ3FbrmtUKgFHvaqlMly3BvoOI8WEkDjKsIJkyMFsGHuhf5_2eBF2haKsKRM4FqoJ4AVWTqA_COV7EYZxcHkvR-52GdGlZHV3ySmLH_mbQ6cbRVlmvOVzNPqU_0OFLru...

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ASkJ3FbrmtUKgFHvaqlMly3BvoOI8WEkDjKsIJkyMFsGHuhf5_2eBF2haKsKRM4FqoJ4AVWTqA_COV7EYZxcHkvR-52GdGlZHV3ySmLH_mbQ6cbRVlmvOVzNPqU_0OFLru1mZQANeeL1kVyHZlWyZa8ZYz4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 22 Nov 2022 08:19:55 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 28A4E5774FC64F0480CEA668E98B9FA0 Ref B: SYD03EDGE1105 Ref C: 2022-11-22T08:19:55Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=ASkJ3FbrmtUKgFHvaqlMly3BvoOI8WEkDjKsIJkyMFsGHuhf5_2eBF2haKsKRM4FqoJ4AVWTqA_COV7EYZxcHkvR-52GdGlZHV3ySmLH_mbQ6cbRVlmvOVzNPqU_0OFLru1mZQANeeL1kVyHZlWyZa8ZYz4
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXuCtZD+MatZClh/yllyw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 24DD
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESECmtG_jRDuy5AFyq4JDYKQ8&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NWQ4NGJiNWQtNjQ2My00OTlhLWE4NWEtYzg5ZGZkYjYyZmRi&google_gid=CAESECmtG_jRDuy5AFyq4JDYKQ8&google_cver=1&google_push=ASkJ3Fbu...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NWQ4NGJiNWQtNjQ2My00OTlhLWE4NWEtYzg5ZGZkYjYyZmRi&google_gid=CAESECmtG_jRDuy5AFyq4JDYKQ8&google_cver=1&google_push=ASkJ3FbuXr94BV2auh2C7zXl92Yf3q9ZJBSOQgbEtNY69Xk6rcFUTLEg9d66cQfiN_st-vzrya_547s0lLimQli-mtrt8NRZTf5oJ-GKpo_TFChzsFILydrQm0LTmPxLybQKmzrRfsAdRb0l5Poc65IDlRI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:57 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=NWQ4NGJiNWQtNjQ2My00OTlhLWE4NWEtYzg5ZGZkYjYyZmRi&google_gid=CAESECmtG_jRDuy5AFyq4JDYKQ8&google_cver=1&google_push=ASkJ3FbuXr94BV2auh2C7zXl92Yf3q9ZJBSOQgbEtNY69Xk6rcFUTLEg9d66cQfiN_st-vzrya_547s0lLimQli-mtrt8NRZTf5oJ-GKpo_TFChzsFILydrQm0LTmPxLybQKmzrRfsAdRb0l5Poc65IDlRI
date: Tue, 22 Nov 2022 08:19:57 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 24DD
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEP8ZBXRWrpF2e4di6ePMZj8&google_cver=1&google_push=ASkJ3FZdcTc4wWv1nEyJQxCWwRevyEYryinXKytRRdcaiyKbFzWPmsn8G92BEDYs57kgqVPQmINlvEFMwNj7x_xOBMhtEAN...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FZdcTc4wWv1nEyJQxCWwRevyEYryinXKytRRdcaiyKbFzWPmsn8G92BEDYs57kgqVPQmINlvEFMwNj7x_xOBMhtEANUq49di1lstxcDQkES_yItGNg9dRqc5NxwUZkFa...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FZdcTc4wWv1nEyJQxCWwRevyEYryinXKytRRdcaiyKbFzWPmsn8G92BEDYs57kgqVPQmINlvEFMwNj7x_xOBMhtEANUq49di1lstxcDQkES_yItGNg9dRqc5NxwUZkFa0I2wejOK-rR0MvEN_TXLw&google_hm=MzY3NDQyNTU5MjczMTQ2NDUwNA%3D%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 22 Nov 2022 08:19:55 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ASkJ3FZdcTc4wWv1nEyJQxCWwRevyEYryinXKytRRdcaiyKbFzWPmsn8G92BEDYs57kgqVPQmINlvEFMwNj7x_xOBMhtEANUq49di1lstxcDQkES_yItGNg9dRqc5NxwUZkFa0I2wejOK-rR0MvEN_TXLw&google_hm=MzY3NDQyNTU5MjczMTQ2NDUwNA%3D%3D
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 24DD
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEFwg0x9kUJOeORHCQC6jGE8&google_cver=1&google_push=ASkJ3FbwhvqGlnI_qduTBfYakjeUoLwOgdZZ4jtbmIfEbGVbKtLSG59hHA-IWUSk5NYCX5G2s1Z4zHF1L1k0BxudSa00TRcFkna2_...
https://rtb.openx.net/sync/dds?google_gid=CAESEFwg0x9kUJOeORHCQC6jGE8&google_cver=1&google_push=ASkJ3FbwhvqGlnI_qduTBfYakjeUoLwOgdZZ4jtbmIfEbGVbKtLSG59hHA-IWUSk5NYCX5G2s1Z4zHF1L1k0BxudSa00TRcFkna2_...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FbwhvqGlnI_qduTBfYakjeUoLwOgdZZ4jtbmIfEbGVbKtLSG59hHA-IWUSk5NYCX5G2s1Z4zHF1L1k0BxudSa00TRcFkna2_XOTBltFNoLiqi8xs2KlHBtY_svtjP_efT...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FbwhvqGlnI_qduTBfYakjeUoLwOgdZZ4jtbmIfEbGVbKtLSG59hHA-IWUSk5NYCX5G2s1Z4zHF1L1k0BxudSa00TRcFkna2_XOTBltFNoLiqi8xs2KlHBtY_svtjP_efTHFUhP0bUfEI9YYoWLc9wE&google_hm=Ogz-WrC7zT8AdbYEs-_c5g==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=ASkJ3FbwhvqGlnI_qduTBfYakjeUoLwOgdZZ4jtbmIfEbGVbKtLSG59hHA-IWUSk5NYCX5G2s1Z4zHF1L1k0BxudSa00TRcFkna2_XOTBltFNoLiqi8xs2KlHBtY_svtjP_efTHFUhP0bUfEI9YYoWLc9wE&google_hm=Ogz-WrC7zT8AdbYEs-_c5g==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: ioh0t340546rt649j78jpugvkeqn76d6

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 24DD
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESECv-Svdum8ksX41JHQ7_q6M&google_cver=1&google_push=ASkJ3FbxByDeHNFU0eW2OqI-od-3y4bud5nat_o7Sqi4hLISc6aVHzJHXFJJl2sk21X3Hx2fTgJwvOupMPLN5VLly...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=YTc0NmFjNTMtZTZhMS00NzAyLWEwZTMtZWY3NGI5YTMwODcz&google_push=ASkJ3FbxByDeHNFU0eW2OqI-od-3y4bud5nat_o7Sqi4hLISc6aVHzJHXFJJl2sk...

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=YTc0NmFjNTMtZTZhMS00NzAyLWEwZTMtZWY3NGI5YTMwODcz&google_push=ASkJ3FbxByDeHNFU0eW2OqI-od-3y4bud5nat_o7Sqi4hLISc6aVHzJHXFJJl2sk21X3Hx2fTgJwvOupMPLN5VLly0BOiETBnugcbRzGHyoHmGyzyhjkxdZtOyqWe45KrdY9OwAeIZie9NKwc6F_jKHu7ImU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=YTc0NmFjNTMtZTZhMS00NzAyLWEwZTMtZWY3NGI5YTMwODcz&google_push=ASkJ3FbxByDeHNFU0eW2OqI-od-3y4bud5nat_o7Sqi4hLISc6aVHzJHXFJJl2sk21X3Hx2fTgJwvOupMPLN5VLly0BOiETBnugcbRzGHyoHmGyzyhjkxdZtOyqWe45KrdY9OwAeIZie9NKwc6F_jKHu7ImU
date: Tue, 22 Nov 2022 08:19:55 GMT
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 24DD 0
40 B 573ms
271ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IR0EEw6m_yr7OyfNZIc0XOv9vgVWX-DC78EH7eaQcYmdbcpQFSU7hgCnmWDf9ndc4u-vaoSw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H/1.1 204
No Content log
aplogger.adpushup.com/ 0
119 B 857ms
283ms Ping
text/plain 52.183.162.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=glimpse_pageView&data=eyJzZXNzaW9uSWQiOiI0NjA2NDNfMTY2OTEwNTE5NTAyOSIsInVzZXJJZCI6IjQ5NTA3OV8xNjY5MTA1MTk1MDI5Iiwic2l0ZUlkIjo0Mjc1MywicGxhdGZvcm0iOiJERVNLVE9QIiwicGFnZUlkIjoiNDU2NTAyXzE2NjkxMDUxOTUwMjkiLCJwYWdlUGF0aCI6IiUyRmElMkZoYW4teGluZy1saXUtc2hpLXl1YW4tb3UtcWktamlhbi1jaGktd3UtenVpLWthbmctc3UtZGFvLWRpLXdhbmcteW91LWNoYW8tYnUtbWFuLmh0bWwiLCJob3N0bmFtZSI6Ind3dy5iZzMuY28iLCJ1cmwiOiJodHRwcyUzQSUyRiUyRnd3dy5iZzMuY28lMkZhJTJGaGFuLXhpbmctbGl1LXNoaS15dWFuLW91LXFpLWppYW4tY2hpLXd1LXp1aS1rYW5nLXN1LWRhby1kaS13YW5nLXlvdS1jaGFvLWJ1LW1hbi5odG1sIiwicGhhc2UiOjAsInVzZXJUeXBlIjoiTkVXIiwicHJldmlld1ZhcmlhdGlvbiI6ImRlc2NyaXB0aW9uUGFnZSIsImV4cGVyaW1lbnRQYWdlIjp0cnVlLCJ0aW1lc3RhbXAiOjE2NjkxMDUxOTUwMzB9
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.183.162.69 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 22 Nov 2022 08:19:57 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H2 404 L2EvaGFuLXhpbmctbGl1LXNoaS15dWFuLW91LXFpLWppYW4tY2hpLXd1LXp1aS1rYW5nLXN1LWRhby1kaS13YW5nLXlvdS1jaGFvLWJ1LW1hbi5odG1s.json Show response
cdn.adpushup.com/42753/ 555 B
818 B 597ms
595ms XHR
text/html 42.99.140.161
ASN-TELSTRA-GLOBA...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adpushup.com/42753/L2EvaGFuLXhpbmctbGl1LXNoaS15dWFuLW91LXFpLWppYW4tY2hpLXd1LXp1aS1rYW5nLXN1LWRhby1kaS13YW5nLXlvdS1jaGFvLWJ1LW1hbi5odG1s.json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 42.99.140.161 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK),
Reverse DNS: ip-42-99-140-161.pacnet.net
Software: nginx/1.18.0 /
Resource Hash: 6d83b77c3d8c5c0ccc7078540a1fb0bd9fa43eeb82b89f83264d469aa100c088

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-akamai-country: NZ
date: Tue, 22 Nov 2022 08:19:55 GMT
server: nginx/1.18.0
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
x-akamai-device: mobile:false&tablet:false
cache-control: max-age=3600
server-timing: cdn-cache; desc=MISS, edge; dur=47, origin; dur=196
content-length: 555
expires: Tue, 22 Nov 2022 09:19:55 GMT

GET
H2 200 rules-p-54Nt-1NAaEEe0.js Show response
rules.quantcount.com/ 160 B
633 B 715ms
235ms Script
application/javascript 13.33.33.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-54Nt-1NAaEEe0.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.33.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-33-78.sin2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edc30a0e05622f71d52d07a0b7b5e94e654ee06854f893be1954336730eb0db6

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 07:26:40 GMT
via: 1.1 beabd6d4d869f3809233bc395642a58e.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN2-P1
age: 3198
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Thu, 13 Oct 2022 15:29:19 GMT
server: AmazonS3
etag: "05b131079c67d484167fd1b1f6c79577"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: 3LpmrBWdwxKwxtwlDrjCWiwz3iBSWXYz29vsrcXICDt22j9jh4-QhA==

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 3CD9 22 KB
8 KB 271ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 554950
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 15 Nov 2022 22:10:45 GMT
expires: Wed, 15 Nov 2023 22:10:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame C299 136 KB
46 KB 829ms
274ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf6ec42c97f86957a324a484a37dd528b568a9ff2570965be53e6ec4b0dfdae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46978
x-xss-protection: 0
last-modified: Mon, 06 Jun 2022 19:45:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 22 Nov 2022 08:34:29 GMT

GET
H/1.1 200
OK dyn-hype-multiitem.js Show response
www.adtrek.co/Scripts/Inserts/ Frame C299 11 KB
3 KB 143ms
142ms Script
application/javascript 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/Scripts/Inserts/dyn-hype-multiitem.js?v=1-4
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: f824af6240aaa57ba4104f1969365afa9b6904544545284db4a7469e6a94768a

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Apr 2022 14:29:24 GMT
Server: Microsoft-IIS/8.5
ETag: "0fa1131435ad81:0"
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2968

GET
H/1.1 200
OK pol.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 13 KB
10 KB 448ms
155ms Image
image/jpeg 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/pol.jpg
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c6404a6445360d772e0e5b5f502a4b6f07dbee331c5132d95affd837d3b832ba

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:56 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: PPFFP27PWRT2GF28
ETag: "a9fd50a836ea2cd2d6c0d6bce07d76b2"
x-amz-meta-info: polite loading image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 10157
x-amz-id-2: hiv47/HCoFolC5vhSSqy4ecap1zxj3JWPbjP70vLy6BOLdfOysW1zAE2WMbyl78CNkRIwm24gU4=

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 0830 0
0 316ms
315ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022111501&jk=4105699401993174&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 113E 36 KB
16 KB 276ms
276ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299043
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C447 0
0 277ms
276ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022111501&jk=4000916992004846&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 16E2 36 KB
16 KB 276ms
276ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299043
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 3CD9 36 KB
16 KB 276ms
275ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299043
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
77 KB 589ms
288ms Script
application/javascript 142.250.4.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

984f25fc065783eb8d12d3fbcfac12c21a1a4abcd7bdbbe7dbb49a7e86b6123e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:56 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78327
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 22 Nov 2022 08:19:56 GMT

POST
H/1.1 204
No Content log
aplogger.adpushup.com/ 0
119 B 855ms
281ms Ping
text/plain 52.183.162.69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aplogger.adpushup.com/log?event=linkPreview_failed_JSONRequest&data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiIvYS9oYW4teGluZy1saXUtc2hpLXl1YW4tb3UtcWktamlhbi1jaGktd3UtenVpLWthbmctc3UtZGFvLWRpLXdhbmcteW91LWNoYW8tYnUtbWFuLmh0bWwiLCJ0aW1lIjoxNjY5MTA1MTk1NjMzfQ==
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/42753/linkPreview.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 52.183.162.69 Mumbai, India, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Connection: keep-alive
Date: Tue, 22 Nov 2022 08:19:57 GMT
Server: nginx/1.18.0 (Ubuntu)

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 113E 0
10 B 270ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?cSkr7A
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:55 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 16E2 0
10 B 270ms
269ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?eVn0OA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:56 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3CD9 0
20 B 280ms
280ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B15PHKoZ8Y9jPG4yMwgPCh77AAQAAAAA4AeAEAg&bg=!dXaldjLNAAbvMpMzzzI7ACkAdvg8Wv38QcR4aPNfeXg2vwiRwevW5-H3c3CMueGu2NYDeK1HdFB-5gIAAABFUgAAAAJoAQeZAvJHskCgsEvTYVHZWpfDIYB8K-s5VfAoA2lhQ7bGMdhQx-ZTyfGaS7wApqp_5qFrLiyivLJUK1c10ekW2OCrOfVZfG2-lOowD2NjHfLrIHES6pStiITfdAuHYV6U53TSb-dD7d5DAfEJwAD7X0gW3Aj9_sUdKGewmui-fBOd2YJS2zaBOG_R0qVMNxfMTTiAfHZQ_a_mjHKo5jowMnkllqfyWpbWKTcHIct167-Y7AKeOJhjFFt0jsgh9x8EzrTl88ogSLuzVt9_ZSBA35NS8F3dUq9CSIifTyDsl9vzVBlA2CKgeXIcvKfGjxe933AYSy7b-HolzFNAbiCOqDmKRmWyhPyP115mngV8yj9QBILOKlJkAwTnnCICOHBdF8HE4L3BAicLDQFN4rCiy5-yJSagrrSFceizBUt2mwb0L0n3o5UYtur8zp9X5yNGdk4z-E4mnQuAYsCyQG690XpVvXRNYhYSbkHGnG9iFxNn4EziQDUJNtXdsCsK2sbTvxi0HzQdi1BcP8wSxpOZu8WtihSwn1E6KNNNihPgbkTXBnrpDh0NKo2wFpUkLBhO5pYefOccuPeiF0s9BIdbQ5zr2nUveWwbFWmbhl4Tv_inOM6falgpJF2zvalSNhGWgl4JDXQpzNAI1Rc-dm4BSclOztgXhpZ83raXD0aNBaqLS2na2wCFBHDxEHL0nMIsFkLYQ3uqAeV-QjrsqpOAF3SSPkwSe1Wcbq9XPXBEcgyY2qao6lVVk3FpM1iDyYeYYtldeFMSzYQ0Wm1-JkCKstlc21ZiCeKlfaaSeGa-r-0HUQGgczjmwF-kLbMvfOF1hz2MQCx6a_gbki93dDSh17qaE5EBhWkMvU5o6ePRB_bPLuV7-VgcvxpkDJhOBbmYq_3HLjZar3fQLH9bpBaQVoQKMBnIIG23dXDMUQgTB-M671y4Ll7Uacm2MoQ2n2TVmlZ6t4Sgh-xOdb0zK2-B9vHNyhGhtqqtSaF_nUMkAet_mMhwfC1b

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4485239425924787&output=html&h=280&slotname=3006%2F14006&adk=2365071409&adf=3615134179&pi=t.ma~as.3006%2F14006&w=336&lmt=1669105192&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669105191085&bpp=11&bdt=2151&idt=1823&shv=r20221110&mjsv=m202211100101&ptt=5&saldr=sa&correlator=1890690893349&frm=23&ife=1&pv=1&ga_vid=679120549.1669105193&ga_sid=1669105193&ga_hid=397335521&ga_fc=0&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=432&ady=320&biw=1600&bih=1200&isw=336&ish=280&ifk=3782421242&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C44778780%2C31070950%2C31065825&oid=2&pvsid=2129156495938702&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C336%2C280&vis=1&rsz=%7C%7CoE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.29m5olmr67b4&fsb=1&dtd=1839

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=661178477;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33...
pixel.quantserve.com/ 35 B
210 B 300ms
238ms Image
image/gif 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=661178477;rf=0;a=p-54Nt-1NAaEEe0;url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-549126999-1669105195197;pbc=91ea02a2-a86b-4c84-b085-e88be2be9297;ns=0;ce=1;qjs=1;qv=48c6ea86-20221121114006;cm=;gdpr=0;ref=;d=bg3.co;dst=0;et=1669105197129;tzo=0;ogl=;ses=12091798-6f10-47c6-b299-147ab16e3a76

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 22 Nov 2022 08:19:57 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 auctionData
e3.adpushup.com/AdPushupFeedbackWebService/feedback/aphb/ 70 B
317 B 233ms
232ms Image
image/png 13.76.45.37
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://e3.adpushup.com/AdPushupFeedbackWebService/feedback/aphb/auctionData?data=eyJzaXRlSWQiOjQyNzUzLCJ1cmwiOiJodHRwczovL3d3dy5iZzMuY28vYS9oYW4teGluZy1saXUtc2hpLXl1YW4tb3UtcWktamlhbi1jaGktd3UtenVpLWthbmctc3UtZGFvLWRpLXdhbmcteW91LWNoYW8tYnUtbWFuLmh0bWwiLCJzaXRlRG9tYWluIjoiaHR0cHM6Ly9iZzMuY28vIiwicGFnZUdyb3VwIjoiQVJUSUNMRSIsInBhZ2VWYXJpYXRpb25JZCI6Ijk2NzUwMTI1LWI5MGMtNDk3YS04Njk5LTczMTcxZjdiNDkzNSIsInBhZ2VWYXJpYXRpb25OYW1lIjoiQWRQdXNodXAiLCJwYWdlVmFyaWF0aW9uVHlwZSI6MSwicGxhdGZvcm0iOiJERVNLVE9QIiwicGFja2V0SWQiOiIwMDAwQTcwMS02ZDZiZDUzZC1jNDdkLTQ1YWItYjVmYS1lNzU5ZDFlZmU3NWIiLCJzZWN0aW9ucyI6W3sic2VjdGlvbklkIjoiMTA0YjI4MmEtYmQxMS00ZDhkLWFkNjQtMDQ5MjA2M2I2Y2JhIiwic2VjdGlvbk5hbWUiOiJBUF9JX0RfQVJUSUNMRV8xMjBYNjAwXzEwNGIyIiwicGxhY2VtZW50IjoxLCJyZWZyZXNoQ291bnQiOjAsInByZWJpZEF1Y3Rpb25JZCI6ImY4NTQ5YzNiLTVmMjktNDUwNy05NDIwLTg4YmE2YTc1ZDA0MSIsInRpbWVPZkF1Y3Rpb24iOjE2NjkxMDUxOTQ0NjYsImJpZHMiOltdLCJ0aW1lZE91dEJpZGRlcnMiOltdLCJyZXF1ZXN0ZWRGb3JtYXRzIjpbImRpc3BsYXkiLCJ2aWRlbyIsIm5hdGl2ZSJdfSx7InNlY3Rpb25JZCI6ImQxYzEwYTcyLTI3YjQtNDkzMS04Y2U3LTk5YTE4ZWJiZGJhZSIsInNlY3Rpb25OYW1lIjoiQVBfSV9EX0FSVElDTEVfNzI4WDkwX2QxYzEwIiwicGxhY2VtZW50IjoxLCJyZWZyZXNoQ291bnQiOjAsInByZWJpZEF1Y3Rpb25JZCI6ImY4NTQ5YzNiLTVmMjktNDUwNy05NDIwLTg4YmE2YTc1ZDA0MSIsInRpbWVPZkF1Y3Rpb24iOjE2NjkxMDUxOTQ0NjYsImJpZHMiOltdLCJ0aW1lZE91dEJpZGRlcnMiOltdLCJyZXF1ZXN0ZWRGb3JtYXRzIjpbImRpc3BsYXkiLCJ2aWRlbyIsIm5hdGl2ZSJdfSx7InNlY3Rpb25JZCI6Ijc3YTljMjJmLWFjMDItNDVkZC05NmJjLWIwODk2YThhN2Q1YSIsInNlY3Rpb25OYW1lIjoiQVBfTF9EX0FSVElDTEVfNzI4WDI1MF83N2E5YyIsInBsYWNlbWVudCI6MSwicmVmcmVzaENvdW50IjowLCJwcmViaWRBdWN0aW9uSWQiOiJmODU0OWMzYi01ZjI5LTQ1MDctOTQyMC04OGJhNmE3NWQwNDEiLCJ0aW1lT2ZBdWN0aW9uIjoxNjY5MTA1MTk0NDY2LCJiaWRzIjpbXSwidGltZWRPdXRCaWRkZXJzIjpbXSwicmVxdWVzdGVkRm9ybWF0cyI6WyJkaXNwbGF5IiwidmlkZW8iLCJuYXRpdmUiXX1dfQ%3D%3D&c_b=11357.300000190735
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 13.76.45.37 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:57 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST
content-type: image/png
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-robots-tag: noindex
content-length: 70
expires: 0

GET
H2 200 integrator.js Show response
adservice.google.co.nz/adsid/ 107 B
165 B 576ms
275ms Script
application/javascript 74.125.24.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.nz/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 575ms
274ms Script
application/javascript 142.251.12.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.bg3.co

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 122 KB
33 KB 718ms
718ms XHR
text/plain 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3806269693981351&correlator=4244371080970295&output=ldjh&gdfp_req=1&vrg=2022111501&ptt=17&impl=fifs&iu_parts=103512698%3A22574853003%2C22477626096%2C22479095528%2C22579309510&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=320x50%7C728x250%7C728x90%7C690x90%7C690x250%7C675x90%7C675x250%7C670x90%7C670x250%7C650x90%7C650x250%7C650x150%7C630x90%7C630x250%7C602x100%7C600x90%7C600x250%7C580x90%7C570x90%7C550x150%7C468x60%7C320x50%7C320x100%7C300x50%7C300x100%7C300x75%7C300x250%7C250x250%7C200x200%2C320x50%7C728x90%7C690x90%7C675x90%7C670x90%7C650x90%7C630x90%7C600x90%7C580x90%7C570x90%7C468x60%7C320x50%7C300x50%7C300x75%2C320x50%7C120x600&fluid=height%2Cheight%2Cheight&ifi=1&adks=1420297610%2C2857874404%2C4082231052&sfv=1-0-40&prev_scp=adpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30%7Cadpushup_ran%3D1%26hb_ap_siteid%3D42753%26hb_ap_ran%3D1%26fluid%3D0%26refreshcount%3D0%26refreshrate%3D30&eri=1&cust_params=da%3Dadx%26outbrain%3Dtrue&sc=1&cookie=ID%3D92beafd1821227a7-22e645499fd800fd%3AT%3D1669105194%3ART%3D1669105194%3AS%3DALNI_MYvzMqDOM_xTBEUT08tovGlCU160A&gpic=UID%3D00000b810689d449%3AT%3D1669105194%3ART%3D1669105194%3AS%3DALNI_MYkLIEjvyXg8JDWQqt2pHocASrm8A&arp=1&abxe=1&dt=1669105197482&lmt=1669105197&dlt=1669105187600&idt=9579&adxs=236%2C436%2C5&adys=60%2C1110%2C300&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0&ucis=1%7C2%7C3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&frm=20&vis=1&psz=728x-1%7C728x-1%7C120x-1&msz=728x-1%7C728x-1%7C120x-1&fws=4%2C516%2C516&ohw=728%2C1600%2C1600&ga_vid=254707768.1669105197&ga_sid=1669105197&ga_hid=4198&ga_fc=false&ga_cid=amp-7MdPXbRDKhvhZQO2cbKMOQ

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63db2f07ffb7a972191237c0a4e44fae74930c1ef474be81a97052fe4efe3bfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34177
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5F65 6 KB
3 KB 276ms
271ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:57 GMT
expires: Wed, 22 Nov 2023 08:19:57 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.prebid.117.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 277ms
276ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.117.js

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

90c9017a8a6447588520f38cd94ba14cdb9839c92626aa06bb8a4a1052c2ab7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 29 Dec 2021 12:30:46 GMT
server: nginx
etag: W/"61cc54f6-15c19"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 23 Nov 2022 08:19:58 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
106 B 578ms
277ms Ping
text/plain 172.217.194.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Z0TZ7TDHS1&gtm=2oeb90&_p=4198&cid=254707768.1669105197&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1669105197&sct=1&seg=0&dl=https%3A%2F%2Fwww.bg3.co%2Fa%2Fhan-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html&dt=%E9%9F%93%E6%98%9F%E6%9F%B3%E6%99%82%E5%85%83%E6%AF%86%E5%A6%BB%E5%A0%85%E6%8C%81%E3%80%8C%E7%84%A1%E7%BD%AA%E3%80%8D%E6%8A%97%E8%A8%B4%E5%88%B0%E5%BA%95%E3%80%80%E7%B6%B2%E5%8F%8B%E8%B6%85%E4%B8%8D%E6%BB%BF%20-%20%E5%A4%A9%E5%A4%A9%E8%A6%81%E8%81%9E&en=link_preview&_fv=1&_ss=1&_ee=1&epn.value=1&epn.siteid=42753&ep.error_msg=no_mapping_success
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z0TZ7TDHS1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.194.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: si-in-f113.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 29C5 0
0 280ms
279ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022111501&jk=4105699401993174&bg=!sLOls_fNAAbvMpMzzzI7ACkAdvg8WgocGPB4r4B6ybkqzsstjxjhIYQknbVUqkrJeyt0uaIl8ZgbygIAAABVUgAAAAJoAQcKAE-T4OXzN3wsk0NDpWp13zsh2pJy7mqDgcM_jxz67_PRQEYZzhFVmqS3mDd7tCi021WYkMf2ktE1QkQq5wTwgY367XwXZIFGkXIs2O-THBKzmQK9llXhOSTHaCRXGIMF9_6xpK1CmAmxhC89WFr6PJS5ESn8B_FrJycCojGq3UAkPcfmT_igLfoVkcwbHUlRtMRQ0xX9mlgkoUJsWJRTTLwsSM_RGb9ZuSDBBVoiM4_L8f3cCSH-TwxSc1ESQc9ZhjHMafV-H97qqsomZBYbRfwkbUUZFkjQ9Td6iUTGoYkjml84X8cOOynb06DNABvpmTtcs5HFx6W2hyt9fuZ2rZxtG7M_BzZZI_B-AUdDimNN1-hVC9HH3_I9NmqkzTLDD_8NH2tVCGuCZvu6G5ifPc4AjRoqfkRE-vYRA89sGPJf1oiT_nvhDE2Jc-0fT5WHZHhoadMiWRvZmrHRYlf-nkttCEV5vCqcL6JQ362-PtTz7Cr_hjspYYq_lm5rEVMgFARHmxlbt050c7kfBF1fLugjLV_6wdja7nQHwPrjf3ndUfgr9rcDc2sUGh_qcvxNMGDFshOv4MG3_jHb7kLXCJBVQ2ik4rruxaxqaOaHsE8DJFPMEAufS6iNqvU8YE5Iu6OtsALxDnq1edPJDmY6MlIC768g_gdZWyJNrN5zMYLje4U4NoZD_lC7HkyUEhhqXfE3ecLy9RG4ImikSxCi4b2VABy7YHuViGJk7_pNQK_DWzOHsPozoyJFULx3bdWPQWpvXQvawzdnuby7B-G8LMKcQK6f-i70rTvJkvqe98164mjPRtP0mdYXYvHfTqcYVMY6MNHMmCdw-eXsfwPSjD-52yPbGsIsGMlFiq5ezGL3fau2C2iA9jNvhLmnTqTcYyXSJMqT1qF6Q-KXSFKvzGxhueznIe6AbS99xGqsdpVgoZ3e6XDgwPINvsnjPOFRQY3JmP3rIDeGINu2hWbKp3PptrvsWpVjLE6HkaUJjZdyN9Vy8J-RmOQWMalh5UB8N5l2xkZNtcbrIbPsSzEYuAE
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 48CB 0
0 280ms
279ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022111501&jk=4000916992004846&bg=!PzylPHjNAAbvMpMzzzI7ACkAdvg8Ws5t959oodJZrKo52aHHpze7N81M3WIzIBntX8QCnOKBW6XTKwIAAABWUgAAAAJoAQcKAAEFmQLAxqW0Hj1mG14cImJe-Me17jjoZicdkL1CMaBG7EScNL9Tsc6DffUqqc7zwYXhY3FY0RIR4E9eEQmgk2-3Z4TzJ4zPR3AXSMNJyL00avVxjp89cPm5JsviGI1YIMa6OZ_CofLahZkDDVc3OCnstUj4ar2etMyeJPc4k0U8qf2TALE4y0UxkZlHTOCSigdNvXoVbSf2a8NeqOd74xdH62TTkmRoezudocBnZJJnsgp7pamrCDBGFKTfNzROOWmiO5p_Mc1M5AyOvb3E_TkiIKJFvsy6BRPlioqMS_9JkCxNKRJIyrIRHcFJr_yNN_zWyIbQ2bwXNCZEnq06JVRBLAM2-3J9hQcH1TfUN7IvyFhG8pUeetN1qxsLv7yI1z93LuyOVh_OO21EPp2K9rv_ywKUKLZGOs5tDsV4ZmeSID7z_UzcFJldkeFwVYhLgpSfn1bPwh1pblUV9EHWvDtrx4I3sU05JuWLJjsZjnmSYtLJUt6gcIpinwNOMrUGtMGOvIhrA1XSaR5FjqimkHmiJ6-auFrRhIszFvsDi6wXnq9RCgF_w87vpSAd3ZkyloXTyo8EXijDxDLrrSohXeEAJzcE6TPeRsjxNb2Jr6sovWJCcWfJoAHKp0PObDoRquKf-PWPvhux62WyFdz_nuxcJ5dqFkgELwt1QEVDkPJYR2W6UVqnlX6_LjBUSLDYzgV3_APh4JmMvJ2QXUjNQphfgUwLnk3ZXNg2HG-D565v8vD_-yfEQHDhM0o1VGn4sZg3fnesiUMiBjcQBdz_D33aSpbplVjytK6OMfHYqQ6SpOyPOouO6oz0h0krEqkURoaS86K9HlrIhRuCwWSsjMg7E2h7foiJxlVxKwCqT-0ae8VyFbQWZdG46XL3xgTdfcbIGlBLbe_fd6YY8kI7zqDvtOWkjlPK9ZnqM1P8Z-C-OArbeAQ
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://cdn.aralego.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html Show response
963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 098F 6 KB
3 KB 574ms
272ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:58 GMT
expires: Wed, 22 Nov 2023 08:19:58 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C5DA 6 KB
3 KB 583ms
282ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:58 GMT
expires: Wed, 22 Nov 2023 08:19:58 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 28C8 6 KB
3 KB 587ms
286ms Document
text/html 74.125.200.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.200.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:58 GMT
expires: Wed, 22 Nov 2023 08:19:58 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A021 16 KB
12 KB 288ms
288ms XHR
application/json 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dde35064a71cdb72f02a2c5175bcba080ae1e392e910fd9f89f0f416cd43c31d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12558
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame B786 16 KB
12 KB 287ms
286ms XHR
application/json 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221110&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e545db2a013a969519f6e4fdee7a501455eae9af0e381fbcb6b789331d21c33b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12517
x-xss-protection: 0

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 298ms
298ms XHR
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.117.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

61c1317e433c125a2ebbbdaf22fc3a0b3606bcb0c9cfea151425adf7b5195f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 24 Oct 2022 11:21:19 GMT
server: nginx
etag: W/"6356752f-16294"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 23 Nov 2022 08:19:58 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A021 17 KB
6 KB 273ms
272ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:19:58 GMT

GET
H/1.1 200
OK ad-s.css
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 1 KB
697 B 156ms
155ms Stylesheet
text/css 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ad-s.css
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2a6cad09468b70f58c8a3c0645f508612ec535ea5ec918036bc3f12d53a536b3

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:59 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: 9SDDYD9YHNT9SFXS
ETag: "8403b199cd6d832d75430c3e993c5296"
x-amz-meta-info: inline html5 ForScript
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 277
x-amz-id-2: XQUyfqjUNwX4+0fABV/7vMaMPyWSXAz9IfVirdEsUojk0Ue8m9uYaK5QQzqLPxv+A3jN7gkqnpU=

GET
H/1.1 200
OK hype_generated_script.js Show response
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 38 KB
9 KB 313ms
157ms Script
application/x-javascript 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/hype_generated_script.js?497
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 03a0c039fbeb263242214ffc9f0d4addcf263f266b6a13bb55f04d6e5098b6f2

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:59 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: 9SD5NJVYF3KMJQYK
ETag: "73f1203f462c5808f970180064c0e13a"
x-amz-meta-info: main HYPE file
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 8451
x-amz-id-2: yFmTEX7TWOCN4EkBlWGjXpwu2avVf2Z/4smD+SrW2yoMx1t13fQFDsI/QioodPl1RSSCKKxoEqg=

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 098F 23 KB
9 KB 273ms
272ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite_fy2021.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61651edfb03aae1c1007d6741f98171447ae7b1a67aaa520d8b0a959e0400885

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 16:21:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57496
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9428
x-xss-protection: 0
server: cafe
etag: 246362764157784863
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 16:21:42 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 098F 8 KB
1 KB 836ms
280ms Stylesheet
text/css 172.253.118.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.118.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sl-in-f95.1e100.net

Software

ESF /

Resource Hash

684dfe949ae87a38c2afbcee199f51b0025dd9121b524d62e881cf40846cdd21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 22 Nov 2022 07:52:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 22 Nov 2022 08:19:59 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/ Frame 098F 14 KB
3 KB 815ms
270ms Stylesheet
text/css 142.251.10.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/outstream.min.css

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f95.1e100.net

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 21:58:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 555688
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Mon, 14 Nov 2022 11:42:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Nov 2023 21:58:31 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/ Frame 098F 388 KB
131 KB 817ms
272ms Script
text/javascript 142.251.10.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/outstream.min.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f95.1e100.net

Software

sffe /

Resource Hash

101b8d837f8e01156fc293db1932eead16c29f9f16da622bfa89f394fbfd1273

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 22:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 555330
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134376
x-xss-protection: 0
last-modified: Mon, 14 Nov 2022 11:42:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Nov 2023 22:04:29 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 098F 18 KB
7 KB 349ms
349ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 16:21:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 098F 0
0 498ms
497ms Image
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTWkTNz1tBE6zSg8NRvY9SjXaU9yNYgzPqYxsTpoA-kfxP1q9bKtTa5Q33j5RuxcGib1gsrxyTXLIyXRpWwKdH6U_Av-g
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame B786 17 KB
6 KB 528ms
528ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211100101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:19:59 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 13E9 640 B
262 B 286ms
285ms Document
text/html 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXAlAEQ7oWwARim887UATAB&v=APEucNVzazkCWcKDDjMbv6QhQudJMekxD0kIi_ZD4Yo5OI3-b5lWdgyeHDlWNwwP9vpkfWimj7-gUrEVPB3GdaS-ZVhwssKlEg

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:58 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C5DA 76 KB
27 KB 284ms
284ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27387
x-xss-protection: 0
server: cafe
etag: 15442950961169408521
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 22 Nov 2022 08:19:58 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5DA 42 B
63 B 279ms
277ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BSIAR-IubME_PrhxRbbyyUWajsVDXH47SK_IWn3subBwbwbLG9y2df3SMQ-AgH3g95Gsr1KgZ8CmatusJdO-8LsYTPGHD8dTYVjgTyXOQ9svJH288

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5DA 0
20 B 279ms
278ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4707248713885878467&x=1&ct=119

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:58 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame C5DA 3 KB
1 KB 501ms
500ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 11:03:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 11:03:25 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame C5DA 18 KB
7 KB 335ms
334ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 16:21:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C5DA 0
0 318ms
318ms Image
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTARmxGAanTgsk-Rjebh7hcmBoaFhXsWMqeeoow9lGye-aiP5eWOOlBp0PZV5ZkQ3jhicFIjUzO0ABMJUXDO48yp8AeFA
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C5DA 154 KB
47 KB 2768ms
2467ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:20:01 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 28C8 0
0 280ms
280ms Fetch
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C50EULYZ8Y-GiKJHBz7sPiqOy2AiY_NGxXKqEzOSFAcCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi04OTMzMzI5OTk5MzkxMTA0yAEJqQJPhaSlrzWmPuACAKgDAaoE3gJP0M7Kd-uEs72UypNMPS4erv42TtxsveFmcUx927mrWJcilxkvB1GCLKw0vo8JATB-XMA-_rSUiL8c7P6Lne4Ez8LVOgIFJa_5dI2Unrz-9btXHJS2CvajJEkEsupmzoNwnibV2Z5_mHxduSOuA1XlDMcHyswLaBf2lhtRDl-Ii4nzlCbscf-RtxzeaSIKIffEUechtnIoaaZdn7pQgzzRW0Y7nSSyWjBKtTvvAxVhbmEiTa2YsShsAS8EIfi3pA-6DzRqVha1VlnAfMbboQygKi8mY34qVsvXpOQOdFQWTWCCcPtShAVsHMWpYIpu3HIKqNZpY__18m49DwipAkTS-Xo7RVBpPoMlgUOgBTw70jMdKJJCXoTpPVSMSYOOVPz52eHUA8FJvk44B-DzjgdlSDhsBS3IL08KSwIgTCp0FqzIms0aS2V07mAUr8Wr6pAZEibNvZJxOhOwdzlf3uAEAYAGhr7l4LmVoO1coAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItODkzMzMyOTk5OTM5MTEwNBjKqx4&sigh=bD3aexoxTrQ&uach_m=[UACH]&cid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f156.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 notify
rtb.jp2.as.criteo.com/google/auction/ Frame 28C8 0
0 311ms
310ms Fetch 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.jp2.as.criteo.com/google/auction/notify?profile=14&payload=kMjmDfn1BnjYBGL4LRICAAAA-ONZtFtuTcMQLYZ8Y3MN4ydKHtVxtUWUABIAAA&wp=Y3yGLQAKEWEBc-CRAAyRioydFSHjf_7onl3OJQ

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 162855
content-length: 0

GET
H2 200 afr.php Show response
ads.as.criteo.com/delivery/r/ Frame 16B9 132 KB
45 KB 306ms
305ms Document
text/html 182.161.73.148
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.as.criteo.com/delivery/r/afr.php?z=Y3yGLQAKEWEBc-CRAAyRioydFSHjf_7onl3OJQ&u=%7C2hr1qQo1D3OhmSua3F5W9m%2Fi3Vh%2BOl0zi5EdDy1vehE%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqcyzkjJURFcWTWQMoaHPHUQRj3OndWtmugvoyzfR__71cNF421UA8y2AbP0iB51MPBHsZKDaXyCdcSks5su00u-X7XWdKKZ_FVVNCXkU4s3GFAwtZitCGXB8mIjp3amQp3c8fEa5Rced5fBE7R-0sDaFqI0519xvTmv9eFXvbM8bo0_U6ewz-zVTAErZYKfMzSRgOlG6uGKnj8nmdbnQmQQc7iaAnVNeJaizrG5RPL3hb4zGDvkDYA036H8weTFz-YU6dYcMcWdIUeIAu2Lok4QOnoJ7-NYPPtaVqzUBeFnArN0LA3TMT8qOKWqywI1ou4G5iOWpY0NShP_IzYmmyAYjkGPVoa0rZRwI1uq_aaW2QS6vhga5QHS0nYf9dLu4kGi5QwUBUwOEdWNLKg_gqMOmC1xkotMcfEzTFAqW-LG451jPPLboLcGdFdwo9HtUjjt-RLjSf55eW9XBdD7zgQsN4xfZNIuY1XqcMkAz_07NzDmAA0AxED3pPlde1bHX-EC2_nnH1mIxDn-DydKIx9k-CF6tjxZ0WIia_3pu9uJbOzgslWEnZ2D4og6uampED17LNQCnzoYVZ2w9ruWCcbzspeNEeICFrGl6bAAiAewCZ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCU_P2LYZ8Y-GiKJHBz7sPiqOy2AiY_NGxXKqEzOSFAcCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi04OTMzMzI5OTk5MzkxMTA0yAEJqQJPhaSlrzWmPuACAKgDAaoE4QJP0M7Kd-uEs72UypNMPS4erv42TtxsveFmcUx927mrWJcilxkvB1GCLKw0vo8JATB-XMA-_rSUiL8c7P6Lne4Ez8LVOgIFJa_5dI2Unrz-9btXHJS2CvajJEkEsupmzoNwnibV2Z5_mHxduSOuA1XlDMcHyswLaBf2lhtRDl-Ii4nzlCbscf-RtxzeaSIKIffEUechtnIoaaZdn7pQgzzRW0Y7nSSyWjBKtTvvAxVhbmEiTa2YsShsAS8EIfi3pA-6DzRqVha1VlnAfMbboQygKi8mY34qVsvXpOQOdFQWTWCCcPtShAVsHMWpYIpu3HIKqNZpY__18m49DwipAkTS-Xo7RVBpPoMlgUOgBTw70jMdKJJCXoTpPVSMSYOOVPz52eHUA8FJvk44B-DzjgdlSDhsBS3IL09ISSOyqeT9aFNB61PxHf-3x3QeOM-F8niR4XBXdCxvFgtXnKghIXoqbOAEAYAGhr7l4LmVoO1coAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODD6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1f5rc9SALGmqOTMm2oqUs-v376oA%26client%3Dca-pub-8933329999391104%26adurl%3D

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.148 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

c8da748eb833b3df7a72c08dd551be865e5a88c5373ac116c2f139522717f99d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:58 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.as.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.as.criteo.net/heavyad?cppv=3&cpp=yfXazX-GkGlDXTZasof2Xj1cDjR2SVtWzVF1A3wbk4DvhL77EbR-n0EwOjeRjtKThh0xcWIsHHFBMKBajK1Fjse3soiFpKgsPwwdW_wLs26-8RkgbQG3aYz5Gr1Jd1Rz0UDQR1RjZyP7DxuBxA951pUwULcgktMxRwZF3DvXGfYWAhi9irhw2BCrK5Ci3T4qen5i3KjE2-mmH8z00PcTIHNb1NMeUwXrXCdw2iX02wf9HJJvYQWEl9DDJdQgjxIaY7QUrHRZIy1KoB23"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 41940780
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 28C8 3 KB
1 KB 500ms
500ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 11:03:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 11:03:25 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1235 1 KB
643 B 280ms
279ms Document
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 43981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 21 Nov 2022 20:06:57 GMT
etag: 48472445140208031
expires: Tue, 22 Nov 2022 20:06:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 28C8 18 KB
7 KB 369ms
369ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 16:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 16:21:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 28C8 0
0 317ms
316ms Image
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTekPv4jAnTM551duWTv0hkapMXzIKanqMLaMkw0GUCrDtAW7AYipJXtJ8RKC5T4EMtHMsOe-oj02vWLef8OGc51Bhy9A
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.24.103 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sf-in-f103.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 28C8 24 KB
6 KB 413ms
412ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 22:24:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 554107
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 15 Nov 2023 22:24:51 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 28C8 154 KB
47 KB 2840ms
2539ms Script
text/javascript 172.217.194.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.194.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 22 Nov 2022 08:20:01 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame FB94 13 KB
5 KB 277ms
277ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 163747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 20 Nov 2022 10:50:52 GMT
expires: Mon, 20 Nov 2023 10:50:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame AF9C 783 B
536 B 274ms
273ms Document
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ba9ba3a9a99ec3a48c69c297fc4479c40524c6f0e7434f4178672ee2ba66f456

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-U_vTVh7xn5s9DIYKBpt9CQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-U_vTVh7xn5s9DIYKBpt9CQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:59 GMT
expires: Tue, 22 Nov 2022 08:19:59 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK HYPE-664.full.min.js Show response
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 91 KB
39 KB 153ms
153ms Script
application/x-javascript 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/HYPE-664.full.min.js
Requested by: Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/hype_generated_script.js?497
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 89c75549ec37405096a983599087bad612e0b0b109e81f1ed33bbe3e38ff5524

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JXAVKMZ9KYE9WV
ETag: "7d5ba1b9c9885006b1b59cd93626333b"
x-amz-meta-info: HYPE file
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 39629
x-amz-id-2: 7icstWGdt3RYF7POo6/74ci0hXMBdx1qSRCh6xFAH5BtqRHZAUoG7mC96XlDDoULhOM9GHV31T8=

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 13E9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAjvhKemlw3rDMbls9ayDsk&google_cver=1

43 B
61 B

389ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAjvhKemlw3rDMbls9ayDsk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXAlAEQ7oWwARim887UATAB&v=APEucNVzazkCWcKDDjMbv6QhQudJMekxD0kIi_ZD4Yo5OI3-b5lWdgyeHDlWNwwP9vpkfWimj7-gUrEVPB3GdaS-ZVhwssKlEg
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAjvhKemlw3rDMbls9ayDsk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 13E9
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YzkzNWE3YWMtZDA0YS0yYWI1LWYzZTEtYTAwYWFhMTQyODNj

170 B
188 B

273ms
273ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YzkzNWE3YWMtZDA0YS0yYWI1LWYzZTEtYTAwYWFhMTQyODNj

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXAlAEQ7oWwARim887UATAB&v=APEucNVzazkCWcKDDjMbv6QhQudJMekxD0kIi_ZD4Yo5OI3-b5lWdgyeHDlWNwwP9vpkfWimj7-gUrEVPB3GdaS-ZVhwssKlEg

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YzkzNWE3YWMtZDA0YS0yYWI1LWYzZTEtYTAwYWFhMTQyODNj
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame 13E9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEACpwCt_1_LzO5GveU0EkE4&google_cver=1

23 B
172 B

330ms
330ms

Image
image/gif

184.51.137.72
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEACpwCt_1_LzO5GveU0EkE4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPXAlAEQ7oWwARim887UATAB&v=APEucNVzazkCWcKDDjMbv6QhQudJMekxD0kIi_ZD4Yo5OI3-b5lWdgyeHDlWNwwP9vpkfWimj7-gUrEVPB3GdaS-ZVhwssKlEg
Protocol: H2
Server: 184.51.137.72 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-137-72.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

expires: Tue, 22 Nov 2022 08:19:59 GMT
pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEACpwCt_1_LzO5GveU0EkE4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 13E9
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NDYxYmIyM2MtNjJkYS00ZGIwLTlhMTEtNzVkM2MzZTkyMzlh

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NDYxYmIyM2MtNjJkYS00ZGIwLTlhMTEtNzVkM2MzZTkyMzlh

Requested by

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: akka-http/10.2.9
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=NDYxYmIyM2MtNjJkYS00ZGIwLTlhMTEtNzVkM2MzZTkyMzlh
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Tue, 22 Nov 2022 08:19:59 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 16B9 2 KB
1 KB 235ms
234ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.as.criteo.com
URL: https://ads.as.criteo.com/delivery/r/afr.php?z=Y3yGLQAKEWEBc-CRAAyRioydFSHjf_7onl3OJQ&u=%7C2hr1qQo1D3OhmSua3F5W9m%2Fi3Vh%2BOl0zi5EdDy1vehE%3D%7C&c1=2P_wVlUbBFsw5yK-nUdqcyzkjJURFcWTWQMoaHPHUQRj3OndWtmugvoyzfR__71cNF421UA8y2AbP0iB51MPBHsZKDaXyCdcSks5su00u-X7XWdKKZ_FVVNCXkU4s3GFAwtZitCGXB8mIjp3amQp3c8fEa5Rced5fBE7R-0sDaFqI0519xvTmv9eFXvbM8bo0_U6ewz-zVTAErZYKfMzSRgOlG6uGKnj8nmdbnQmQQc7iaAnVNeJaizrG5RPL3hb4zGDvkDYA036H8weTFz-YU6dYcMcWdIUeIAu2Lok4QOnoJ7-NYPPtaVqzUBeFnArN0LA3TMT8qOKWqywI1ou4G5iOWpY0NShP_IzYmmyAYjkGPVoa0rZRwI1uq_aaW2QS6vhga5QHS0nYf9dLu4kGi5QwUBUwOEdWNLKg_gqMOmC1xkotMcfEzTFAqW-LG451jPPLboLcGdFdwo9HtUjjt-RLjSf55eW9XBdD7zgQsN4xfZNIuY1XqcMkAz_07NzDmAA0AxED3pPlde1bHX-EC2_nnH1mIxDn-DydKIx9k-CF6tjxZ0WIia_3pu9uJbOzgslWEnZ2D4og6uampED17LNQCnzoYVZ2w9ruWCcbzspeNEeICFrGl6bAAiAewCZ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCU_P2LYZ8Y-GiKJHBz7sPiqOy2AiY_NGxXKqEzOSFAcCNtwEQASAAYKvssYXgGIIBF2NhLXB1Yi04OTMzMzI5OTk5MzkxMTA0yAEJqQJPhaSlrzWmPuACAKgDAaoE4QJP0M7Kd-uEs72UypNMPS4erv42TtxsveFmcUx927mrWJcilxkvB1GCLKw0vo8JATB-XMA-_rSUiL8c7P6Lne4Ez8LVOgIFJa_5dI2Unrz-9btXHJS2CvajJEkEsupmzoNwnibV2Z5_mHxduSOuA1XlDMcHyswLaBf2lhtRDl-Ii4nzlCbscf-RtxzeaSIKIffEUechtnIoaaZdn7pQgzzRW0Y7nSSyWjBKtTvvAxVhbmEiTa2YsShsAS8EIfi3pA-6DzRqVha1VlnAfMbboQygKi8mY34qVsvXpOQOdFQWTWCCcPtShAVsHMWpYIpu3HIKqNZpY__18m49DwipAkTS-Xo7RVBpPoMlgUOgBTw70jMdKJJCXoTpPVSMSYOOVPz52eHUA8FJvk44B-DzjgdlSDhsBS3IL09ISSOyqeT9aFNB61PxHf-3x3QeOM-F8niR4XBXdCxvFgtXnKghIXoqbOAEAYAGhr7l4LmVoO1coAYhqAemvhuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODD6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1f5rc9SALGmqOTMm2oqUs-v376oA%26client%3Dca-pub-8933329999391104%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 16B9 2 KB
1 KB 236ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 16B9 308 B
636 B 236ms
234ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 16B9 293 B
621 B 236ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H2 200 lg.php
cat.sg1.as.criteo.com/delivery/ Frame 16B9 43 B
347 B 238ms
237ms Image
image/gif 182.161.73.132
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.sg1.as.criteo.com/delivery/lg.php?cppv=3&cpp=46o1I6j6nZviH64Rugd5zJvCkRJBXfBtDphsixRYzUqZbTpH3-44IN33en50KgngdlgoVZmyKuhs_HUY27j4A0EMafUCqb9xJi3S6ahXLo-AzLTlIKLn9tz_PXanH2NBD6P9gq7Wi30WkTQjKUvkxO36l_2BX78C9iTFHwoO7RVxZwr1iAaS8nSK0-vlXlVXwJKpCXPNWZ34XJQGkv0j-EGLvMwrVPAa1Frwjag5oLqlXiBYpI-h0Ybvsp_OF-RAuTOgjg1wJJrglc2zZHbeuWh-MZJSHrMXZXqHzucLVWu2RltsZtRAMYxHQBL8oS3WIhWT2ZHbKulFpnsioV6xDowScQ09FkNNZ4hCtvDEfK4lWbnlerlJxbcZqo7PXYwlHsbHOYR5uJHrcHcYZbYgZenySNBndqE_cV16DTUo8A4G6AeU

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.132 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:58 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2550652
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1235
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEH9ImyXO3zInkCNFBUNJY7U&google_cver=1&google_push=ASkJ3FbUuXSXJynFXrSA8mQT59qJbtO5-sGFzfD0IhifKksW8NPeB8p18q...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ASkJ3FbUuXSXJynFXrSA8mQT59qJbtO5-sGFzfD0IhifKksW8NPeB8p18quxc4AZAFc__VEVVPwfuhNxcPDIStloBFEV1lKBITd03SHShQje_luuRzc3h...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ASkJ3FbUuXSXJynFXrSA8mQT59qJbtO5-sGFzfD0IhifKksW8NPeB8p18quxc4AZAFc__VEVVPwfuhNxcPDIStloBFEV1lKBITd03SHShQje_luuRzc3hGjnEpSJgQeC6RIxL79At_tdQZce&google_hm=sVVPeEYkbU4VCrdL_LqFsQ

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ASkJ3FbUuXSXJynFXrSA8mQT59qJbtO5-sGFzfD0IhifKksW8NPeB8p18quxc4AZAFc__VEVVPwfuhNxcPDIStloBFEV1lKBITd03SHShQje_luuRzc3hGjnEpSJgQeC6RIxL79At_tdQZce&google_hm=sVVPeEYkbU4VCrdL_LqFsQ
pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 1235
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEGWuXP9hl2KERmuSPaK0bE0&google_cver=1&google_push=ASkJ3FZmg4P9xG_g0AAjtB6vQAP9vdRyhvfQZjaf2kUehp4PtHjWaZfuPwQONQLEn0Gv96sa4yXIH8rzmoBRDvn-HBID2TBiMCISP...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGWuXP9hl2KERmuSPaK0bE0&google_cver=1&google_push=ASkJ3FZmg4P9xG_g0AAjtB6vQAP9vdRyhvfQZjaf2kUehp4PtHjWaZfuPwQONQLEn0Gv96sa4yXIH8rzmoBRDvn-HBID2TBiMCI...

43 B
414 B

263ms
258ms

Image
image/gif

104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGWuXP9hl2KERmuSPaK0bE0&google_cver=1&google_push=ASkJ3FZmg4P9xG_g0AAjtB6vQAP9vdRyhvfQZjaf2kUehp4PtHjWaZfuPwQONQLEn0Gv96sa4yXIH8rzmoBRDvn-HBID2TBiMCISPXPWzqvjw0lLHZII41MowGmAR0qEQQk5TU0lmqInz1fH&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DASkJ3FZmg4P9xG_g0AAjtB6vQAP9vdRyhvfQZjaf2kUehp4PtHjWaZfuPwQONQLEn0Gv96sa4yXIH8rzmoBRDvn-HBID2TBiMCISPXPWzqvjw0lLHZII41MowGmAR0qEQQk5TU0lmqInz1fH%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.18.24.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 76e03e4aab9f1c60-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 9918
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGWuXP9hl2KERmuSPaK0bE0&google_cver=1&google_push=ASkJ3FZmg4P9xG_g0AAjtB6vQAP9vdRyhvfQZjaf2kUehp4PtHjWaZfuPwQONQLEn0Gv96sa4yXIH8rzmoBRDvn-HBID2TBiMCISPXPWzqvjw0lLHZII41MowGmAR0qEQQk5TU0lmqInz1fH&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DASkJ3FZmg4P9xG_g0AAjtB6vQAP9vdRyhvfQZjaf2kUehp4PtHjWaZfuPwQONQLEn0Gv96sa4yXIH8rzmoBRDvn-HBID2TBiMCISPXPWzqvjw0lLHZII41MowGmAR0qEQQk5TU0lmqInz1fH%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 76e03e48e93b1c60-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1235
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=1&acc=crimtan_au&google_gid=CAESEJbJpQQz-Jpqlh4JtuyHKzo&google_cver=1&google_push=ASkJ3FYnpN4aCZoDW22AyI3HjkLqbZmWGYfUjcXs9kuBsSDeNAkfJ8VK2EHC9luDGG86HB66_BLx3Wa...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FYnpN4aCZoDW22AyI3HjkLqbZmWGYfUjcXs9kuBsSDeNAkfJ8VK2EHC9luDGG86HB66_BLx3WaSBW7QMzhCJ9REk3OevVWjQZ23_6FwbHGdkgsmYt-cGDnkYoFy...

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FYnpN4aCZoDW22AyI3HjkLqbZmWGYfUjcXs9kuBsSDeNAkfJ8VK2EHC9luDGG86HB66_BLx3WaSBW7QMzhCJ9REk3OevVWjQZ23_6FwbHGdkgsmYt-cGDnkYoFyWT4vs730m6ZX9RK0&google_hm=HtzoDC2qS56Uri1ntFODoso

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:58 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FYnpN4aCZoDW22AyI3HjkLqbZmWGYfUjcXs9kuBsSDeNAkfJ8VK2EHC9luDGG86HB66_BLx3WaSBW7QMzhCJ9REk3OevVWjQZ23_6FwbHGdkgsmYt-cGDnkYoFyWT4vs730m6ZX9RK0&google_hm=HtzoDC2qS56Uri1ntFODoso
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1235
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEC4v0YHBVn5_1Wq947e_mFY&google_cver=1&google_push=ASkJ3Fb25aKd0Fqgw6goKXaQ1qiCdKKiz8vXzeIdxPauJdSWPXmzv_QwH06Si6ix3dJ-aWBQu9ybqFJDXvZN9zw...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=5c7ndhxIThBLgFKcSXuX-nRaSso&google_push=ASkJ3Fb25aKd0Fqgw6goKXaQ1qiCdKKiz8vXzeIdxPauJdSWPXmzv_QwH06Si6ix3dJ-aWBQu9ybqFJDXvZN9z...

170 B
188 B

277ms
276ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=5c7ndhxIThBLgFKcSXuX-nRaSso&google_push=ASkJ3Fb25aKd0Fqgw6goKXaQ1qiCdKKiz8vXzeIdxPauJdSWPXmzv_QwH06Si6ix3dJ-aWBQu9ybqFJDXvZN9zwexyA_JREKffANK64zCanRKcIKmpfTKx3oEBo27UXjhd1_xGL9t_VeOGGV

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=5c7ndhxIThBLgFKcSXuX-nRaSso&google_push=ASkJ3Fb25aKd0Fqgw6goKXaQ1qiCdKKiz8vXzeIdxPauJdSWPXmzv_QwH06Si6ix3dJ-aWBQu9ybqFJDXvZN9zwexyA_JREKffANK64zCanRKcIKmpfTKx3oEBo27UXjhd1_xGL9t_VeOGGV
Date: Tue, 22 Nov 2022 08:20:00 GMT
Connection: keep-alive
Content-Length: 286
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1235 0
12 B 275ms
273ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IiUbauaNlfS_149AHKPzbPW7yVpjv3GjlfqumM2HrLai05F38_

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame AF9C 0
0 277ms
277ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=2781778878858997&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 16B9 12 KB
5 KB 307ms
162ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 486705
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pVcjbXj%2BksF6rKkfqk65nPTh8Z%2BC%2B96vj03H6M59Rn41s%2BsXg4iU9FyEq6bCtaxwnUuMNvunFMUv7tj1xqDfRtLVx3Tj6NreM2mgyp54e0Lrx9N5788zSYvNIkUAZ%2FN4y%2BVOO75x"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 76e03e487ed16a45-SYD
expires: Sun, 12 Nov 2023 08:19:59 GMT

GET
H2 200 5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff
static.criteo.net/design/dt/ Frame 16B9 24 KB
24 KB 236ms
235ms Font
application/octet-stream 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/5ab904e70ba04f04aab36995c6fce95d_futura+book+font.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

0b81ebd295c56386af5d622092d29db6ecb12a7f8dc8be80fe54cbbfa3d3216e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
Origin: https://ads.as.criteo.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Mon, 12 Feb 2018 16:12:56 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5a81bd08-5f2c"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame FB94 36 KB
16 KB 276ms
275ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299047
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5DA 0
20 B 277ms
277ms Ping
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4165528153484&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5DA 0
20 B 278ms
278ms Ping
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4165528153484&version=m202209210101&ct=119&x=1&cor=4707248713885878000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C5DA 80 KB
34 KB 321ms
321ms Script
text/javascript 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BKXlK8VHrZkuSJgsCC-wbI0GWR_wFnC0aEJ0bg___YMUFmifDTT_4Px8Niv_O-pk7SW7N6MM3zEaS6OW-RiZpS2dUAsBjDDt5V2ymggI_ixgy_QagPYzq_z54VlXLXm4TPcRNKy8UEGkmpsVz6MThlfGbVizG75CHpLPXUboNVNca9kNQ&cry=1&dbm_d=AKAmf-A-L4oxOquK3gPztZrElgnwks6UB3IfIpyeDBbVmDUfeVpWIWjNWkrCcJt7yEIGR3cvAfeL8lPUUxIyDiysCULU6Ap_VhoYUDVBL7mI5t9sIwm6UYJ4E-RX-pdYYfz88Nn94Fy7439Ke3EIcO0qYxSm-uktGMBWFljKnuFozBxHlab9X7i4sh5YR1kZWxFFOMYx2TBerwKkRu6cu09O-0vDAfpTJCBCnfQ2Qq7LXE0qPzv_scgPWQWo-LwR08g34lo9hpzwiU3tMnsi6bhSXvGwbudSJBrcLEPmlp_fGwX9lrv4nfTDwLLe1BpSR-BTp7Oo7PoWQV0Q1t5PeWm6FdUDUIfo06MlRhygA5WH-yLtjf8yQKJxZZ6MErMKnfhtF9mNvxDW5CXZ-RAfd2SWJYtE-HZeWcyugfcdPU3wv-n_36p-08YBvjzZB7OgF78nxklLcIDBxJQ3PxDho6YRVUpzgnSp4wG6W6MdqnPezzRG_cwXtwdZjKJ1sCZY7KHsCgo7MKbH62SBnT3KVljZSpHcIu6BiQKgOKavqJ6t632r69uPoF6lST_mFVfi__eZuiT40Pvp5oC0ND9y7IWeP2AUW8n0XSjXPIskcQdDlyyHMV_Zd_hbDK7-IGTgJLrv6Wb4lIn2FpeHDokDEfSuYl66WoaH5MH5kjA_rmKWqJsnEh6ZrD2sNVUskQy6LOUfCOgPTUBZzWirfwseSvEvFU0OpPK7YzttYtifgHYemaYNJj3-Ql7xcBqbW_nms7vFOAI-GmXs5dXTmrx9ZQhvsSX3D9E92Blx-XZPmMGrhuR3jQVu3czhiZru6yQ_zqXXFPbJhNVqZHmMtrIvLh-JMb5PDc0-dT3K488O1g9x2zt4UiFN0j0YuRdVgKF4SKEXEpD0bXodpWDyJY5SiXPlXwDlCtAzWerWHeAOA4FydfPjj7lo6UftLhcuPr_3iorGHi3shePAFoJ4d1a6bZrfsuojfJaEUaETu9JcHO33b6wEI_8KwKJtuz4sb4objtUacP5rgZXGeKFbNA_t4bO5DsixPRVh4zhWcgE2vZSe1Y86M3XhukgfLxryYLtnYsniNKLsF6hAZM1zYNgBXnydUUESmHLxRCZnCF-OcEFInAbougwYVTMejMQIQvpR9Z93pFi2fb_1Bi5YU7r1RCKxnaaNdSidr7PcbZjmL4rfsK0O3_w7fjEUA3TobKi7novmHJw_X638dInG2rIOBqExdGBIu5p0-GlvZkBP0pdpV12TfzA2XLN2Smi0daYLXVXtb_Si7AmHt39HocUxA22HjWsaVx92Oceb000RKHkSlSHPyzUkzeQkATcHaolIONK0ygS55_1DFYB1gtsv3MznfhW8LpNYULQJGy0G3ocJcJdxRNekhR84k31eRgJA00hzhsoF8CyrEFPYS1y6ps2oHqZQUzkdATSFttV0zV8V493ZmpIeu2M_ZGe8zLhwmz1GtmetoNMjN4L6pwfBMVRX0w9Kp-GuWbvPaWIBT4RvPQFr9gxt68qZntkqC4lHTnMrXsHHuE3LMNx-3dz5CENA66A5KnT1-IJzUx9zRC0KAxO6RiLa3ue6-n_46bOX2-DoIrZtn3D4pRo2HWeHr-KgFn9ZA0pYmXJ5GtUXoHdKdHIFlo9sDgCVlOLF97x8g71uHwZYjAPg1kpywUoQfD-_fjyAVxv35nSossYYeiU9K5jbiYmwvyLWaJy3HvNOHieaCYTVvM0EUvBSmi27wtfU2_qXMBZszv69hG_L7FAYr4EVpmwMrhxRqz6gOWLx6159lgutJ6UCBFb5ufpW1e5x4LkPOit5qrpYE6ubD4LhVkd73a5LGjYgj2xk0RG5-yEl3xc4_W-YXWz1Yzp-xEEWkkWUGziDUg03dL-nbG7PJ_rKwpAWe_vvt7yTeW3ocKBBES8RCqJb8Yb8rg1ZnGXkh4-zEozLE68-EM2ddR6JE99glVNtIL_NSn5RmnPxhGpu8EX3_TZ-Wg9j1gu1XooxMzySM0iv0NZR5yJa1rrdztOGxSDc81lUW7mGx589vJbUOS-XcNVEwqzkozVBVqljHA-WsKAl2bryysU8JxtGOgLMfArQRi8ECV1EOcgv3hh46EEOHq_jFqoYvNNs_senmOZ6u7ax7Qku1tEnUeE3YzTtgsTg_TSx8VillPy69TSuLolvJNMJ4Esogj0T6mxdtgvyiFCSzakby4FVSFcNFC-UzAVU89YnmBn_FxZzwjJ_TVYBDdzkm72hP401rGAiKoDERxD165GgqK-tRA3i4wTmq1bkPaVmPo_XG9K77Zr0zCPZYhsDyadLSR0Ykd2eGYg2FB7JNUv4mY-y3Hy-6TTQHYYbAA1KudHITGPKnIHu4zrlRsM4DAueuLK3Do7S7kHBVwecVpRDZeBJdB7CsecEfRfiyXvWnVPFn0MBNqxQTkJw0s7xRp9kPi0DJh94Ql9JC2voun7yuXlY9zY_7oNPPc_OjDyt_P0xoOq2akJAvomE0F9tPt_Uev1vmC1pBcSM2nLD4ehaWRPtNwVybRiqJFGrO_dSHMz774wD8aPiEr7ALELYjQEFaUMkUJ2MBrgVq32POIKlH2hJ1Gv5UXy4g6XzuIrsjy5mG3uUFjuvrM-ZmMc887mURtEDu71Ey_uNQ6s6JxAL3tnrXDDSzO_7I1lD0NiAVAkN1gRjR9QrNmgEv7OW0WBxu574R4JLcGq7XvPlxDgmnOj8aDuaLbpECJxDBfNisI8QTh17tm_09mMeGFNWencahSqvhDo0tROr-vnoHfU9PJRymn2D-a1DTRuYbM3r2Z5w_RC6TwPmPWbIy751rR1wb7AThmoAEWFNx9xorkVZ9x7P4R-1x-RdwtP0MSn0JOfRoGWx2aGpyH93v4r7jOT8hrnYTIgDx4eYMHGjJb6C_fDKLxdSxEgoKrT2m_4GxZ97wxIAr65XuxB3o6QnqwAPDqCLS5v6mY8ChSQBYM4ITR_ffe-J9cJCmvi6IdvMtuBnwDvUOkrUDkvcpLSubL8uIYG0uWbaPtz_v0l16E6EHQ1wWP6QDLzmULr9s-l6xohGLM2ehuZ34Z9JjMwub4524Q76Z8ZKdU5kD7ysHYX9NA_JGgFE8eMOUc9BrU4-0TCq7btnJTo74ZlnIUcYWyQ2LzDBzVD3KQJ09qTTBtw3beKeTv_QJRl5G6qOCIWEjwFRKBbq93_FYGMOnpwd8Wvl3EZ1yAb8YTobOkncrSENRZy53YSHAnK7q-WCdNkHgVrEX7lL507-w0NE_rR2Pjhv8jUJlLxQFd4xgdXoygE3CD5Dz6xpi-5IU0FCUmKXsoatosgF7w7xXEiugSCFXj45u_Btuh1zrtWFSHlhk0BRkuwYm4mEdGQvvyNoDwMNh4PR73PLA1eYD8AnOz6OUwUXtpcpMw45ITRC-hhlKNp7gwIhqBT7h0O1N2AuM-diDj6Mz-DdryELfRwp12WpZkmDX1sGxQAoi4Zkl8PpLnh8ob5k0o_BXH2B_hEm9JQpgxSJZUY5emI42qaw35EE4wX2arrqHTaGCWX_Gnp7CjirYyH1kvSUP3KcI5DtvQxYAQAIYIWAGruBFJugFQxKeKcJyroRMzjPHnl0aDP9Jmeryk3-Gt5BAjKSM0S9akpoHGHvz0RuDZZsm3IrgS224eV1N_MXfUfB0hzalWNK2Q&cid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM&dv3_ver=m202209210101&rfl=https%3A%2F%2Fwww.bg3.co%2F&ds=l&xdt=1&iif=1&cor=4707248713885878000&adk=3047537735&idt=361&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09852699847dca7684b218c63e21a43c4046f2ee37c303c062973e8c2d938450

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34773
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK HYPE-664.waypoints.min.js Show response
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 11 KB
4 KB 154ms
153ms Script
application/x-javascript 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/HYPE-664.waypoints.min.js
Requested by: Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/hype_generated_script.js?497
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6ffbe7900c0aac72ca80d9ec3b1e44090b1ca2b37f9f3faa8a0a321f3d546c63

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JX41FQYEGG7XS1
ETag: "5daa49b11df8b1a9c1efbd8b5f5006af"
x-amz-meta-info: HYPE file
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 3359
x-amz-id-2: dvp7ZGash2xHlaA3oLxyrqBSsR3Iv9dhmSr0MTYwT2vfY8e7EtLDgL6r8KGn0uUrdkrMQH8tzp0=

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 16B9 12 KB
6 KB 243ms
242ms Script
text/javascript 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 16B9 7 KB
7 KB 291ms
290ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

5dca70770a6051f433669ffb677876d4db6ab892f411a7362cda46df269c47c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=237268
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6848
expires: Fri, 25 Nov 2022 02:14:28 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 16B9 9 KB
9 KB 290ms
290ms Image
image/png 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?h=110&m=0&partner=71731&q=80&r=0&u=http%3A%2F%2Fstatic.sg1.as.criteo.net%2Fdesign%2Fdt%2F38393%2F210902%2F0c03df1b887746c395e1df3e4c5d8235_logo_n_square.png&v=3&w=236&s=YNLzPWrZJ95BJ2AGimXG_-fh

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e9d902fddf4a556e67d4a2d2fa0b321cc6fbd77c59f2627fe586aadd883fab4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=26682497
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8964
expires: Wed, 27 Sep 2023 04:08:16 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 16B9 10 KB
10 KB 326ms
326ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdwd0a336c6%2Fimages%2F112906-Master%2F112906-BRN00-front.jpg&v=3&w=400&s=lBXN2060Hcve7Eoucn092vr1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

10e74dcc71d9e586d942b9fcfd2707b43b3207cd8a796e447a484dea1a42f4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:58 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=127916
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10450
expires: Wed, 23 Nov 2022 19:51:55 GMT

GET
H2 200 img
pix.as.criteo.net/img/ Frame 16B9 10 KB
10 KB 300ms
299ms Image
image/webp 182.161.73.135
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.as.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=71731&q=80&r=0&u=https%3A%2F%2Fwww.macpac.co.nz%2Fon%2Fdemandware.static%2F-%2FSites-macpac-master-catalog%2Fdefault%2Fdwaebf9359%2Fimages%2F119372-Master%2F119372-SEAG0-front.jpg&v=3&w=400&s=u187_y8kMyqT3S-RCBqvfHhS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.135 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

65d5a6716ba8de82c297671db48af37fd0c98c591feb36750022d3bcd9491512

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1243637
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 10222
expires: Tue, 06 Dec 2022 17:47:17 GMT

POST
H2 200 all
csm.as.criteo.net/ Frame 16B9 0
127 B 237ms
236ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.as.criteo.net/all?cppv=3&cpp=yfXazX-GkGlDXTZasof2Xj1cDjR2SVtWzVF1A3wbk4DvhL77EbR-n0EwOjeRjtKThh0xcWIsHHFBMKBajK1Fjse3soiFpKgsPwwdW_wLs26-8RkgbQG3aYz5Gr1Jd1Rz0UDQR1RjZyP7DxuBxA951pUwULcgktMxRwZF3DvXGfYWAhi9irhw2BCrK5Ci3T4qen5i3KjE2-mmH8z00PcTIHNb1NMeUwXrXCdw2iX02wf9HJJvYQWEl9DDJdQgjxIaY7QUrHRZIy1KoB23&sds=2&rev=83599&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 22 Nov 2022 08:19:58 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 16B9 2 KB
1 KB 235ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 16B9 2 KB
1 KB 236ms
235ms Image
image/svg+xml 182.161.73.129
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.129 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.as.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 17 Nov 2023 08:19:59 GMT

GET
DATA 200
OK truncated
/ Frame 28C8 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 426d093acf362a7117c718181af8201de50c4a85c8a8d71ef9181e3db5f47026

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 893B 13 KB
5 KB 273ms
271ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 163747
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 20 Nov 2022 10:50:52 GMT
expires: Mon, 20 Nov 2023 10:50:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D3DE 783 B
535 B 276ms
275ms Document
text/html 74.125.24.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.24.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5c8e054a48db752b14de6e692708eda5581f023e1d7fe49261b795ee6e2a0c3f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-8TOWNnGJE8eEJ-sX6X9EmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-8TOWNnGJE8eEJ-sX6X9EmA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:19:59 GMT
expires: Tue, 22 Nov 2022 08:19:59 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK BG.png
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 464 KB
465 KB 161ms
160ms Image
image/png 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/BG.png
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4241ea327760166712f8b8d5db03c02d86aad9cecc8fb034ba23e58084d79041

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JHDFQ2A24J0SVT
ETag: "b54aeef6cf7c57a5a997e5aa10a1900f"
x-amz-meta-info: resource files
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 475731
x-amz-id-2: 95leYgSHbqNOxJKRWrxlNvFbMkSLNkQJC4UXLiSN/Z62UcmXzhP5V9RRbVyOppn0au0J+JAk2xw=

GET
H/1.1 200
OK __Arrow-Button.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 880 B
948 B 161ms
159ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/__Arrow-Button.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 48a9560e9dddf4834139c3b4abd37300dfc9879ac686d3fba921a1488ee4dfe2

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JGW9ERMP5MRGR8
ETag: "7fb04916458ddfc35012cb9c7eb0bf06"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 531
x-amz-id-2: SRRKw4+reXyf9ZSJinD1/dSAVkF+tp3PK86YVxzeujOKmVGYuAEUxqcEXRPcRkF4J83806q0T2w=

GET
H/1.1 200
OK 10330%20-%20left%20Arrow.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 462 B
717 B 320ms
158ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10330%20-%20left%20Arrow.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 95e68c47129d6385026c1d1023eb3ebc673b14c04e2ba231b50ca92c64394ebc

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JKQ1SAV2S9JB4S
ETag: "4f2fb388c2b2c0c93ff33a646a2fc6e7"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 300
x-amz-id-2: k+6E8tyWk1KUj5qse/ko6KdESK0Fr9/GjN8OlxUjQ32NNNsGEGVG6yg2T/fXStH771OoO2fVTWY=

GET
H/1.1 200
OK 10330%20-%20T%27s%20%26%20C%27s.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 5 KB
2 KB 442ms
156ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10330%20-%20T%27s%20%26%20C%27s.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5d19578ce8569d6e11f49de6a368c1d50127789c74ed6a22ec2e729603c83d89

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JVGC1SG6MXVQB6
ETag: "4a8755e9915ec3eac683790b96c7e967"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1693
x-amz-id-2: LpbfsAHoiaxJ+NrKu78RpwUrkVjJbhb2d6YDbelYlCSDZ8T9akh+2FFA/dvVB3MLroFc6YDcMo0=

GET
H/1.1 200
OK 10330%20-%20Price%20Tab.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 276 B
616 B 442ms
156ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10330%20-%20Price%20Tab.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: b5324356e31a6d74709d8bf8d391935177832384e730b5f750e0e8e64a4aa687

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JQ8TQ2PREGY2YQ
ETag: "528253923f45ac7e23df9dcbedb39eb9"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 199
x-amz-id-2: 99EwsQ5k8smDDSXDnn3xHcvJA3CHvU0bWF3sp/vC9nml/3i65YseABf1qj3nYmMbvdo63SFMTl8=

GET
H/1.1 200
OK 1Logo-V21.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 3 KB
1 KB 440ms
154ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/1Logo-V21.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: eb4f52fc122c0242eef6f384c14dc3276cdf50c7b44493d37217a9d215e851a9

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JWY0V4RX9F91Z7
ETag: "88cab12993a9501e3835e2e864907b68"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1115
x-amz-id-2: RLaMD4OFD8CY8fcw4gj+d5W/T+oosURT6mjph0LVlAIIIbJgzRsslfbFv/umGwPF/j/no3qSGNg=

GET
H/1.1 200
OK 10397%20-%20300x250%20BG.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 268 B
612 B 281ms
155ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10397%20-%20300x250%20BG.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6fb356dfd35ec78b65317c8714faf5c01233ad66ba4ff38b29c5ffbd09f56817

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JP5DNXRC6YW19C
ETag: "d367a3fd6ba903a068130e29bdff294f"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 195
x-amz-id-2: RObXdbkBJsYTlMwuFDH+7Ph8vzu4nY+NbHmPbvfqh1vSVoC9Y00kAuuY1StNmY8hTuStCZ9jiT0=

GET
H/1.1 200
OK 10397%20-%20Logo.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 2 KB
1 KB 157ms
157ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10397%20-%20Logo.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c514ff2c0620e171a036dd0c73b943110a86e54dd155b968d279e2aef9009a84

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JND53TR2TM1PFZ
ETag: "ac857d697b7514af617d45a98e34eaa4"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1031
x-amz-id-2: O0gnJbk7qfYa+drv973zrpNVP2RB8L2u3l7JJ97hsVENRp3JS3KSTie9cFHZHi0Utfrc6c/kt4I=

GET
H/1.1 200
OK 1Logo-tagline-V21.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 4 KB
2 KB 156ms
155ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/1Logo-tagline-V21.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3ad3e06e306529fa8b95980be3e7dd1f44ba6d1cfe604513fd83b7056eddf727

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JPMH4B0TS91P6A
ETag: "f52b0e0304f7116922de87f47797c37f"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1716
x-amz-id-2: Rv3WLWZ6EPWuVTHdgk4MeXA5WNx7bnFVSUElgaYvQXshaNQzL+OGG0fshu0pJRi9Q8Dc7s9tfjg=

GET
H/1.1 200
OK 10397%20-%20Arrow.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 355 B
651 B 156ms
156ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10397%20-%20Arrow.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 59f73c2a7b531c662a9bf3dde2ec64ce25120467f81ac11a53db9e758fe26f6f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: Z7JPQSWB37VGHVHC
ETag: "36c8f9731ac58cf894efe82be86c0b12"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 234
x-amz-id-2: 4NxhNMq12IdnNPaxt7sxV3D+Hj2rnkybFWFfM1J8G7YLfboJIIt1r/zAFfOEHGGg3+hZhmEsclQ=

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B899 42 B
64 B 289ms
288ms Fetch
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst2SaqK1rBvF96BjMo1f58juFcuBOg3zreZCVoxdfTXpCyuOPA9GaZcNYQyXWV0-crg1ORmpfggCbANL9eE61oLntl9X_gvNcpn9aF1UyLNkaQulyKNYyU557-iiExN7gNtvpM&sai=AMfl-YRLu0p13k519W51PV_lhp_JmcYwuqOM8NzfuRbaZN5daDzMY9Mgzx6oT-w2UaplnZjtFah8kFP8nIswgGMRpWfmah9niVGKVA_HSg&sig=Cg0ArKJSzEc0sVQX-KAVEAE&cid=CAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw&id=lidar2&mcvt=1000&p=0,0,254,300&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=2365071409&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669105193923&rpt=4558&met=mue&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:19:59 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame FB94 0
10 B 270ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?QSlRSg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:19:59 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame C5DA 106 KB
37 KB 810ms
270ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 02:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20835
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 23 Nov 2022 02:32:45 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame C5DA 8 KB
3 KB 276ms
276ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BKXlK8VHrZkuSJgsCC-wbI0GWR_wFnC0aEJ0bg___YMUFmifDTT_4Px8Niv_O-pk7SW7N6MM3zEaS6OW-RiZpS2dUAsBjDDt5V2ymggI_ixgy_QagPYzq_z54VlXLXm4TPcRNKy8UEGkmpsVz6MThlfGbVizG75CHpLPXUboNVNca9kNQ&cry=1&dbm_d=AKAmf-A-L4oxOquK3gPztZrElgnwks6UB3IfIpyeDBbVmDUfeVpWIWjNWkrCcJt7yEIGR3cvAfeL8lPUUxIyDiysCULU6Ap_VhoYUDVBL7mI5t9sIwm6UYJ4E-RX-pdYYfz88Nn94Fy7439Ke3EIcO0qYxSm-uktGMBWFljKnuFozBxHlab9X7i4sh5YR1kZWxFFOMYx2TBerwKkRu6cu09O-0vDAfpTJCBCnfQ2Qq7LXE0qPzv_scgPWQWo-LwR08g34lo9hpzwiU3tMnsi6bhSXvGwbudSJBrcLEPmlp_fGwX9lrv4nfTDwLLe1BpSR-BTp7Oo7PoWQV0Q1t5PeWm6FdUDUIfo06MlRhygA5WH-yLtjf8yQKJxZZ6MErMKnfhtF9mNvxDW5CXZ-RAfd2SWJYtE-HZeWcyugfcdPU3wv-n_36p-08YBvjzZB7OgF78nxklLcIDBxJQ3PxDho6YRVUpzgnSp4wG6W6MdqnPezzRG_cwXtwdZjKJ1sCZY7KHsCgo7MKbH62SBnT3KVljZSpHcIu6BiQKgOKavqJ6t632r69uPoF6lST_mFVfi__eZuiT40Pvp5oC0ND9y7IWeP2AUW8n0XSjXPIskcQdDlyyHMV_Zd_hbDK7-IGTgJLrv6Wb4lIn2FpeHDokDEfSuYl66WoaH5MH5kjA_rmKWqJsnEh6ZrD2sNVUskQy6LOUfCOgPTUBZzWirfwseSvEvFU0OpPK7YzttYtifgHYemaYNJj3-Ql7xcBqbW_nms7vFOAI-GmXs5dXTmrx9ZQhvsSX3D9E92Blx-XZPmMGrhuR3jQVu3czhiZru6yQ_zqXXFPbJhNVqZHmMtrIvLh-JMb5PDc0-dT3K488O1g9x2zt4UiFN0j0YuRdVgKF4SKEXEpD0bXodpWDyJY5SiXPlXwDlCtAzWerWHeAOA4FydfPjj7lo6UftLhcuPr_3iorGHi3shePAFoJ4d1a6bZrfsuojfJaEUaETu9JcHO33b6wEI_8KwKJtuz4sb4objtUacP5rgZXGeKFbNA_t4bO5DsixPRVh4zhWcgE2vZSe1Y86M3XhukgfLxryYLtnYsniNKLsF6hAZM1zYNgBXnydUUESmHLxRCZnCF-OcEFInAbougwYVTMejMQIQvpR9Z93pFi2fb_1Bi5YU7r1RCKxnaaNdSidr7PcbZjmL4rfsK0O3_w7fjEUA3TobKi7novmHJw_X638dInG2rIOBqExdGBIu5p0-GlvZkBP0pdpV12TfzA2XLN2Smi0daYLXVXtb_Si7AmHt39HocUxA22HjWsaVx92Oceb000RKHkSlSHPyzUkzeQkATcHaolIONK0ygS55_1DFYB1gtsv3MznfhW8LpNYULQJGy0G3ocJcJdxRNekhR84k31eRgJA00hzhsoF8CyrEFPYS1y6ps2oHqZQUzkdATSFttV0zV8V493ZmpIeu2M_ZGe8zLhwmz1GtmetoNMjN4L6pwfBMVRX0w9Kp-GuWbvPaWIBT4RvPQFr9gxt68qZntkqC4lHTnMrXsHHuE3LMNx-3dz5CENA66A5KnT1-IJzUx9zRC0KAxO6RiLa3ue6-n_46bOX2-DoIrZtn3D4pRo2HWeHr-KgFn9ZA0pYmXJ5GtUXoHdKdHIFlo9sDgCVlOLF97x8g71uHwZYjAPg1kpywUoQfD-_fjyAVxv35nSossYYeiU9K5jbiYmwvyLWaJy3HvNOHieaCYTVvM0EUvBSmi27wtfU2_qXMBZszv69hG_L7FAYr4EVpmwMrhxRqz6gOWLx6159lgutJ6UCBFb5ufpW1e5x4LkPOit5qrpYE6ubD4LhVkd73a5LGjYgj2xk0RG5-yEl3xc4_W-YXWz1Yzp-xEEWkkWUGziDUg03dL-nbG7PJ_rKwpAWe_vvt7yTeW3ocKBBES8RCqJb8Yb8rg1ZnGXkh4-zEozLE68-EM2ddR6JE99glVNtIL_NSn5RmnPxhGpu8EX3_TZ-Wg9j1gu1XooxMzySM0iv0NZR5yJa1rrdztOGxSDc81lUW7mGx589vJbUOS-XcNVEwqzkozVBVqljHA-WsKAl2bryysU8JxtGOgLMfArQRi8ECV1EOcgv3hh46EEOHq_jFqoYvNNs_senmOZ6u7ax7Qku1tEnUeE3YzTtgsTg_TSx8VillPy69TSuLolvJNMJ4Esogj0T6mxdtgvyiFCSzakby4FVSFcNFC-UzAVU89YnmBn_FxZzwjJ_TVYBDdzkm72hP401rGAiKoDERxD165GgqK-tRA3i4wTmq1bkPaVmPo_XG9K77Zr0zCPZYhsDyadLSR0Ykd2eGYg2FB7JNUv4mY-y3Hy-6TTQHYYbAA1KudHITGPKnIHu4zrlRsM4DAueuLK3Do7S7kHBVwecVpRDZeBJdB7CsecEfRfiyXvWnVPFn0MBNqxQTkJw0s7xRp9kPi0DJh94Ql9JC2voun7yuXlY9zY_7oNPPc_OjDyt_P0xoOq2akJAvomE0F9tPt_Uev1vmC1pBcSM2nLD4ehaWRPtNwVybRiqJFGrO_dSHMz774wD8aPiEr7ALELYjQEFaUMkUJ2MBrgVq32POIKlH2hJ1Gv5UXy4g6XzuIrsjy5mG3uUFjuvrM-ZmMc887mURtEDu71Ey_uNQ6s6JxAL3tnrXDDSzO_7I1lD0NiAVAkN1gRjR9QrNmgEv7OW0WBxu574R4JLcGq7XvPlxDgmnOj8aDuaLbpECJxDBfNisI8QTh17tm_09mMeGFNWencahSqvhDo0tROr-vnoHfU9PJRymn2D-a1DTRuYbM3r2Z5w_RC6TwPmPWbIy751rR1wb7AThmoAEWFNx9xorkVZ9x7P4R-1x-RdwtP0MSn0JOfRoGWx2aGpyH93v4r7jOT8hrnYTIgDx4eYMHGjJb6C_fDKLxdSxEgoKrT2m_4GxZ97wxIAr65XuxB3o6QnqwAPDqCLS5v6mY8ChSQBYM4ITR_ffe-J9cJCmvi6IdvMtuBnwDvUOkrUDkvcpLSubL8uIYG0uWbaPtz_v0l16E6EHQ1wWP6QDLzmULr9s-l6xohGLM2ehuZ34Z9JjMwub4524Q76Z8ZKdU5kD7ysHYX9NA_JGgFE8eMOUc9BrU4-0TCq7btnJTo74ZlnIUcYWyQ2LzDBzVD3KQJ09qTTBtw3beKeTv_QJRl5G6qOCIWEjwFRKBbq93_FYGMOnpwd8Wvl3EZ1yAb8YTobOkncrSENRZy53YSHAnK7q-WCdNkHgVrEX7lL507-w0NE_rR2Pjhv8jUJlLxQFd4xgdXoygE3CD5Dz6xpi-5IU0FCUmKXsoatosgF7w7xXEiugSCFXj45u_Btuh1zrtWFSHlhk0BRkuwYm4mEdGQvvyNoDwMNh4PR73PLA1eYD8AnOz6OUwUXtpcpMw45ITRC-hhlKNp7gwIhqBT7h0O1N2AuM-diDj6Mz-DdryELfRwp12WpZkmDX1sGxQAoi4Zkl8PpLnh8ob5k0o_BXH2B_hEm9JQpgxSJZUY5emI42qaw35EE4wX2arrqHTaGCWX_Gnp7CjirYyH1kvSUP3KcI5DtvQxYAQAIYIWAGruBFJugFQxKeKcJyroRMzjPHnl0aDP9Jmeryk3-Gt5BAjKSM0S9akpoHGHvz0RuDZZsm3IrgS224eV1N_MXfUfB0hzalWNK2Q&cid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM&dv3_ver=m202209210101&rfl=https%3A%2F%2Fwww.bg3.co%2F&ds=l&xdt=1&iif=1&cor=4707248713885878000&adk=3047537735&idt=361&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 12:37:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70943
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 05 Dec 2022 12:37:36 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame C5DA 29 KB
11 KB 278ms
278ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 00:37:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27749
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 06 Dec 2022 00:37:30 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D3DE 0
0 305ms
304ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221110&jk=2129156495938702&rc=
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 893B 36 KB
16 KB 305ms
304ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299047
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

GET
H/1.1 200
OK 10397%20-%20Logo.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 2 KB
1 KB 159ms
158ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10397%20-%20Logo.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: c514ff2c0620e171a036dd0c73b943110a86e54dd155b968d279e2aef9009a84

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: NSW4VPTCJ1TWAF3S
ETag: "ac857d697b7514af617d45a98e34eaa4"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1031
x-amz-id-2: 2ptQW8jwlvioa6Aq3lgqCHEapLJou3j/R4WyLm36/u7YmeAf+Ts2E2mtDA48phiFA3ewB0/bhb0=

GET
H/1.1 200
OK free-delivery-display-560x270.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/69c8ac60-2998-4915-9900-20460fa9b1ca/d08ff667-0e48-4c40-9ef3-d6427e2ba7de/ Frame C299 58 KB
46 KB 161ms
158ms Image
image/jpeg 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/69c8ac60-2998-4915-9900-20460fa9b1ca/d08ff667-0e48-4c40-9ef3-d6427e2ba7de/free-delivery-display-560x270.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 71c90c4754e4d1d2be5e0627027a46931baf4a7e5dd5e504a11c0bd8681d5a0d

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 20 Jun 2022 23:22:24 GMT
Server: AmazonS3
x-amz-request-id: NSW55C58EX0T4PH5
ETag: "d0e304181f18834adb5d5e162a68ab6b"
x-amz-meta-info: feed-image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 46969
x-amz-id-2: Jhn5KtjT67ETuMG+88bFZK81dljANrZ0ku4UGJ02EgOTMKQ8cQ73S+elGFsDfwXT53hfmRFnqS0=

GET
H/1.1 200
OK 10330%20-%20Price%20Tab.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 276 B
616 B 158ms
155ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10330%20-%20Price%20Tab.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: b5324356e31a6d74709d8bf8d391935177832384e730b5f750e0e8e64a4aa687

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: NSW551WEE0S0KHA5
ETag: "528253923f45ac7e23df9dcbedb39eb9"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 199
x-amz-id-2: 2mL8yZ6OVsRGLKnkR8EiHxqLk292k9ZWNzHl7uyBcA9STqGpkuhY0bdvUmsoZRdhY9U/Jb0Mkbc=

GET
H/1.1 200
OK 350102-prod-1.jpg
s3-ap-southeast-2.amazonaws.com/adtrek/971ed134-cb45-47be-886f-250aaa10e28e/f2f8938c-64f1-4511-ab33-b2d243aab33f/ Frame C299 17 KB
16 KB 159ms
157ms Image
image/jpeg 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/971ed134-cb45-47be-886f-250aaa10e28e/f2f8938c-64f1-4511-ab33-b2d243aab33f/350102-prod-1.jpg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5477d8ca5eff9fb6dffb92766a3166e47cbc7d94935fc116576c676da0412193

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 21 Nov 2022 17:56:43 GMT
Server: AmazonS3
x-amz-request-id: NSWA96Y6DGSGEZTN
ETag: "f404e54aadb2bf0d6cd0d1ececde6100"
x-amz-meta-info: feed-image
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 16304
x-amz-id-2: PirfHlN7Y84Ob17e+1mReMWSAkWybvQB5Xs+FNKGVEue3J6ddfUU6vUP2sjCeglBOOzFMU7C1ao=

GET
H/1.1 200
OK 10397%20-%20300x250%20BG.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 268 B
612 B 158ms
156ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10397%20-%20300x250%20BG.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 6fb356dfd35ec78b65317c8714faf5c01233ad66ba4ff38b29c5ffbd09f56817

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: NSW0WJVZE4E0ZENF
ETag: "d367a3fd6ba903a068130e29bdff294f"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 195
x-amz-id-2: j3nCoS1N5gOZpfRhbgQKjSay7RI5zxJvseWIatun3Xx6GUn45ze+mBpEuJXFIH3zJqkgS3bNoCo=

GET
H/1.1 200
OK 1Logo-tagline-V21.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 4 KB
2 KB 156ms
154ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/1Logo-tagline-V21.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 3ad3e06e306529fa8b95980be3e7dd1f44ba6d1cfe604513fd83b7056eddf727

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: NSW6Y2TB15EMYNNR
ETag: "f52b0e0304f7116922de87f47797c37f"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1716
x-amz-id-2: RcHWd9MnyiCXKiLq8I43PWr6fvbGnH4DmHC5iDm7eCFK9U3vaOoxFWopy3TLxSyuVZVrySkmVyk=

GET
H/1.1 200
OK 10397%20-%20Arrow.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 355 B
651 B 312ms
157ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10397%20-%20Arrow.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 59f73c2a7b531c662a9bf3dde2ec64ce25120467f81ac11a53db9e758fe26f6f

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: NSW3TDVSS85BJRR9
ETag: "36c8f9731ac58cf894efe82be86c0b12"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 234
x-amz-id-2: C/xYzrdMPLE5nQxyjXmpbZYAyMvo+ThSbm9C6+tuh1XvkuLN7jOmwNeyRI6XX6g+AA6UkzIbgUU=

GET
H/1.1 200
OK 10330%20-%20T%27s%20%26%20C%27s.svg
s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ Frame C299 5 KB
2 KB 309ms
153ms Image
image/svg+xml 52.95.128.211
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/10330%20-%20T%27s%20%26%20C%27s.svg
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.128.211 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-ap-southeast-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5d19578ce8569d6e11f49de6a368c1d50127789c74ed6a22ec2e729603c83d89

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Jan 2022 02:20:14 GMT
Server: AmazonS3
x-amz-request-id: NSW8CCT37FPZTBKZ
ETag: "4a8755e9915ec3eac683790b96c7e967"
x-amz-meta-info: resource files
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 1693
x-amz-id-2: 0d6vzkrH1FWzdo161snI1XrVavoafePu5tmTm9ANx7tSk19lBLjJ73Sw3BqvXbUIxI0qK6L5c4Q=

GET
H/1.1 200
OK Kanit-Bold.ttf
www.adtrek.co/content/webkits/Kanit/ Frame C299 169 KB
169 KB 144ms
143ms Font
application/octet-stream 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/content/webkits/Kanit/Kanit-Bold.ttf
Requested by: Host: s3-ap-southeast-2.amazonaws.com
URL: https://s3-ap-southeast-2.amazonaws.com/adtrek/5d2b69a0-9f47-41c8-82da-92b27c2f871e/ad-s.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 75d6293d3b3b235995b241146df53aeb2b9c5105cf70bc77ba83ba8fcc642eb5

Request headers

Referer: https://s3-ap-southeast-2.amazonaws.com/
Origin: https://www.adtrek.co
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:58 GMT
Last-Modified: Tue, 30 Nov 2021 19:16:30 GMT
Server: Microsoft-IIS/8.5
ETag: "0fb6dc71ee6d71:0"
X-Powered-By: ASP.NET
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 172876

GET
H/1.1 200
OK AstLd Show response
www.adtrek.co/adserver/ Frame C299 16 B
292 B 459ms
175ms XHR
application/json 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adtrek.co/adserver/AstLd?cc=c7614e22-e63f-4894-8505-f9be4aae4495
Requested by: Host: www.adtrek.co
URL: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.adtrek.co/adserver/frm?cc=c7614e22-e63f-4894-8505-f9be4aae4495&clk=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCY5FnKYZ8Y4DIFtrkogOyrLWgApjKk7Rtip7hvYYQzdXD_NAqEAEg0syBGmCr7LGF4BigAeDUsp4oyAEJqQJULj7DWoikPqgDAaoElQJP0JJIKTPoq0ruNDnAY_i7hZ8zYNL4Tl1qfHvBdtOvVaHL0wBTHS4QyxMRAlFUAR3tuBOldCLWFz5HKBniO-5r60RXv9jSOFBfMwAahrwiLcF8tzcSjhPnG8Q_LoUArdlBKA_RzEVHVrfq_pqFBg-iatYlWqTWIrWEu6PqDOX6yDkEhyIpt9VOVLgVwy3zXvQplkYGE92yknhyF4LFu5OiKzQko-Bxoqhki_tJd9n_ICDXncykO4RwgRD5X9Nw14nPo75CjSfGBeTKA_5uQyeHth4PRGsdgb4iaBceFKzGbMj-wJsYWG-gYUrNj12DfStSaACRVLIvm75b7lwXhAAEqwo1tzOhB6S1p4wVBOgEmSryV_6bwASUjMXl5gPgBAOQBgGgBk2AB-CMg_4CqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGF0yAooCOgKAQIAKA5gLAcgLAYAMAbAT1Y2cEcgTw_Dn3gPQEwDYEwrYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSKQDq26N9gCbBUK0pyKPr9Zmy4MZDgF7OpnII6zlsOn4qFfUCbSOl-1NzGAEgEw%26sig%3DAOD64_3IlpwhYCAWxvT0_pzauXmM_pCl4A%26client%3Dca-pub-4485239425924787%26dbm_c%3DAKAmf-D4E9t7mR6HBX-uxVB_Bd2Z0xb6hXiakZi0liV40ncnYB2gmi9TrjXHu3zubStGSYGAq9ghZsTSGBcZjrJd29bPCgn5_yQIdy5ciw61azEg9dlckm3Z039q-tZ3xIGXCQ0ie8QeIdgPK7nFUIWfUASiz-wPhmKGfLhGbTyC6X3dGlthTk0%26cry%3D1%26dbm_d%3DAKAmf-B2AaxNqvqCy3p0U2dASrkxh4TsJ1nEAvOzJ2nkQtfWHBdCSwFTkxUZrW2kBI-eI-KC5oDFBIj0S_eq1GV6JSbDyms5LPakevRTJ19fvNInHv7TvzYYSL8pH-oDoQWwZYimfgkFOOMpk09vwvklsJ126NK_I4KyRYIZDo_1Fzssl8as2IU8UKCBRsqCyXjAc0jerrH6uMzQhz_po-x5b_Q5ObZYZykq_YyJuLEU2W_kl57VM-oY1PDFK1_yybd7pt3dczW2mK4JDfO2-E8mpaV9e6WIv-XjwNfg4aYHY9yyH6OIn93tBV2A0xaV50O-dGdddhf0bxMAGp0E1nfcKy-AYxBGlfscCnpxcwcfM-YQ6CHLOOT9YwmqMdfgrWp6PhYQ8VBxQ7-l-3tfl7UbrQEvrImG6Thyo3RlVqPIJX9XGMO5KnQkal9jLh-YJGbp0w1Qqa7vnOiMwI6oDHI1becEkcnaPk1UlyCZgmdI_UuiSACLzLU2H8AzgceeRZ5o-zzLap8nv2uzKNz8KsdybevyJy52Lamh0SORvCankDEkUNpgNsIC4SP83VZj56QOQYqU8oU8OOJfoX3tL3r-tIVZtQVZ0tcR7v241k0n9knBSw0RP2OJmpMEnRTuPaO-Qt-mYxg7gYZEDmy_LTLE5iRULq_02w%26adurl%3Dhttps%3a%2f%2fwww.adtrek.co%2fadserver%2fclick%3fcc%3dc7614e22-e63f-4894-8505-f9be4aae4495&ord=1669105193369664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:19:57 GMT
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: application/json; charset=utf-8
Cache-Control: private
Connection: keep-alive
Content-Length: 16

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C5DA 41 KB
15 KB 271ms
271ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 15 Nov 2022 22:07:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 555132
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Nov 2023 22:07:48 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 54A6 1 KB
643 B 278ms
277ms Document
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 43983
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 21 Nov 2022 20:06:57 GMT
etag: 48472445140208031
expires: Tue, 22 Nov 2022 20:06:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C5DA 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 492812d87c95d59ffdacf277792d52208866e68a0529ee35d4ecd2b1ab237558

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 893B 0
10 B 270ms
270ms Image
text/plain 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?DFSQrA
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:00 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H2 200 all
csm.as.criteo.net/ Frame 16B9 0
127 B 235ms
235ms Ping
text/plain 182.161.73.142
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.142 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.as.criteo.com/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 22 Nov 2022 08:19:59 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5D45 22 KB
8 KB 271ms
270ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 554955
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 15 Nov 2022 22:10:45 GMT
expires: Wed, 15 Nov 2023 22:10:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 54A6
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEH9ImyXO3zInkCNFBUNJY7U&google_cver=1&google_push=ASkJ3FbrNjsa58eVidqpMIRM3kKcKEUsVc3_Qjvw1rvuOBvT5pjdfzwt6d...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ASkJ3FbrNjsa58eVidqpMIRM3kKcKEUsVc3_Qjvw1rvuOBvT5pjdfzwt6d2AlpGIbyI7YztI44pXe_wxj6Ml7bCEw57MbMVtWSW4Gg&google_hm=sVVP...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ASkJ3FbrNjsa58eVidqpMIRM3kKcKEUsVc3_Qjvw1rvuOBvT5pjdfzwt6d2AlpGIbyI7YztI44pXe_wxj6Ml7bCEw57MbMVtWSW4Gg&google_hm=sVVPeEYkbU4VCrdL_LqFsQ

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=ASkJ3FbrNjsa58eVidqpMIRM3kKcKEUsVc3_Qjvw1rvuOBvT5pjdfzwt6d2AlpGIbyI7YztI44pXe_wxj6Ml7bCEw57MbMVtWSW4Gg&google_hm=sVVPeEYkbU4VCrdL_LqFsQ
pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame 54A6 43 B
612 B 401ms
280ms Image
image/gif 104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEGWuXP9hl2KERmuSPaK0bE0&google_cver=1&google_push=ASkJ3FZW9qC3WkrSUQXPhxXGML1-k83PUlwYzfZJ8SppPmx3qQi8n1euwq9753RMbYlPOhK9QGVKCdtdZI45_m1tR4BbfiMIhgwZUw&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DASkJ3FZW9qC3WkrSUQXPhxXGML1-k83PUlwYzfZJ8SppPmx3qQi8n1euwq9753RMbYlPOhK9QGVKCdtdZI45_m1tR4BbfiMIhgwZUw%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 76e03e4f9b44eea2-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 54A6
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=1&acc=crimtan_au&google_gid=CAESEJbJpQQz-Jpqlh4JtuyHKzo&google_cver=1&google_push=ASkJ3FaN6CI-G4QXzHh0HGk07tB7KG3Z6Nl2WESRxRf9iZ1A0Jbs_Ok325DiQw05gszCz2NDBqf4EjD...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FaN6CI-G4QXzHh0HGk07tB7KG3Z6Nl2WESRxRf9iZ1A0Jbs_Ok325DiQw05gszCz2NDBqf4EjDp-_2CA5oT0W6wSgyF99NqCQ&google_hm=HtzoDC2qS56Uri1...

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FaN6CI-G4QXzHh0HGk07tB7KG3Z6Nl2WESRxRf9iZ1A0Jbs_Ok325DiQw05gszCz2NDBqf4EjDp-_2CA5oT0W6wSgyF99NqCQ&google_hm=HtzoDC2qS56Uri1ntFODoso

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FaN6CI-G4QXzHh0HGk07tB7KG3Z6Nl2WESRxRf9iZ1A0Jbs_Ok325DiQw05gszCz2NDBqf4EjDp-_2CA5oT0W6wSgyF99NqCQ&google_hm=HtzoDC2qS56Uri1ntFODoso
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 54A6
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEC4v0YHBVn5_1Wq947e_mFY&google_cver=1&google_push=ASkJ3FbnOsyflF9V0llWMicZ3yzbu8Gg6XuECsI1aKiZiFiWZVV7oJF3lCSYeYaAzVjpmk3vM3_6GDaYz9vq-EU...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=-3LIx-guQ7t7nPa_CYCR1HRaSso&google_push=ASkJ3FbnOsyflF9V0llWMicZ3yzbu8Gg6XuECsI1aKiZiFiWZVV7oJF3lCSYeYaAzVjpmk3vM3_6GDaYz9vq-E...

170 B
188 B

275ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=-3LIx-guQ7t7nPa_CYCR1HRaSso&google_push=ASkJ3FbnOsyflF9V0llWMicZ3yzbu8Gg6XuECsI1aKiZiFiWZVV7oJF3lCSYeYaAzVjpmk3vM3_6GDaYz9vq-EUJJt8CyM880l37

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=-3LIx-guQ7t7nPa_CYCR1HRaSso&google_push=ASkJ3FbnOsyflF9V0llWMicZ3yzbu8Gg6XuECsI1aKiZiFiWZVV7oJF3lCSYeYaAzVjpmk3vM3_6GDaYz9vq-EUJJt8CyM880l37
Date: Tue, 22 Nov 2022 08:20:01 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 54A6 0
12 B 274ms
272ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jnl4WuMClxQjo5M_9mQ4PxvKs8tK-YF9rF29qsO6ESlwil7JFM

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:00 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 204 csi
csi.gstatic.com/ Frame 098F 0
327 B 1411ms
481ms Ping
image/gif 142.251.128.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lary535k&c=3439079425245&slotId=1719539712622.5&qqid=CJ_tmLOtwfsCFZHgcwEdipEMiw&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C44752538%2C75259414%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.128.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: gru06s68-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 098F 15 KB
16 KB 902ms
349ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f94.1e100.net

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 12:44:20 GMT
x-content-type-options: nosniff
age: 329741
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 12:44:20 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 098F 15 KB
16 KB 830ms
279ms Font
font/woff2 142.250.4.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f94.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 03:38:40 GMT
x-content-type-options: nosniff
age: 103281
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 03:38:40 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 098F 0
20 B 279ms
279ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=CvxzxLYZ8Y9-iKJHBz7sPiqOy2AjhqpCSbcLysJbeEJrZ4PvCLRABILqEwDNgq-yxheAYoAGwgquTAcgBBakC-v9Gyx-KpD6oAwHIA5sEqgScAk_Q4yODAGCpiPvgzSRgx9rKXR5L883toHc0d1DpRqpqXUuHSSPX7uoRGgP-j2T820BGOkvYWh_txvWio-kONveq3KqExvq-W3qbh3SJ93KqDIstZvNP89BLDRX5JHMYULYmDTyrGlrRybpp49z2T4c6YqwGdUnXuA7grl0bsGjPGHmDb0DRHvnGYqjPK4_OXOaXlZyAE3Hns8iMoPc75iwB_dFw0ePZjD7eJ_qtAtDk_FKIBtm55ePv1iIJeEEK35LN0lPzEZEIKw2CahbjTEuQ3T4iWZ3OjUukqmUVlEvzQQIJ8igQtFLETXiCdfF6muP7uNLSeAWGGarZ5lovXDHTrYLN2p72jcXLjN-MU9JREHU3fXcVXRnIeDdpwATI_uXVnQTgBAOQBgGgBnaAB7j91OwCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGB0yAooCOgKAQPIIG2FkeC1zdWJzeW4tNTIzOTkzODIxMzg3MDM4MIAKA8gLAeALAYAMAbAT9N6XEcgT2q6s4QPQEwDYEwqIFAPYFAHQFQH4FgGAFwE&eventType=clickstring&clientTime=1669105200452&ai=CvxzxLYZ8Y9-iKJHBz7sPiqOy2AjhqpCSbcLysJbeEJrZ4PvCLRABILqEwDNgq-yxheAYoAGwgquTAcgBBakC-v9Gyx-KpD6oAwHIA5sEqgScAk_Q4yODAGCpiPvgzSRgx9rKXR5L883toHc0d1DpRqpqXUuHSSPX7uoRGgP-j2T820BGOkvYWh_txvWio-kONveq3KqExvq-W3qbh3SJ93KqDIstZvNP89BLDRX5JHMYULYmDTyrGlrRybpp49z2T4c6YqwGdUnXuA7grl0bsGjPGHmDb0DRHvnGYqjPK4_OXOaXlZyAE3Hns8iMoPc75iwB_dFw0ePZjD7eJ_qtAtDk_FKIBtm55ePv1iIJeEEK35LN0lPzEZEIKw2CahbjTEuQ3T4iWZ3OjUukqmUVlEvzQQIJ8igQtFLETXiCdfF6muP7uNLSeAWGGarZ5lovXDHTrYLN2p72jcXLjN-MU9JREHU3fXcVXRnIeDdpwATI_uXVnQTgBAOQBgGgBnaAB7j91OwCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGB0yAooCOgKAQPIIG2FkeC1zdWJzeW4tNTIzOTkzODIxMzg3MDM4MIAKA8gLAeALAYAMAbAT9N6XEcgT2q6s4QPQEwDYEwqIFAPYFAHQFQH4FgGAFwE

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 098F 31 KB
16 KB 308ms
304ms XHR
text/xml 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CaWqLdkdgy5gVBAWOe7dPaJXM5lapr5vA-xjNWmvnX7Ibxec64K2Gzwfk2SExGejJ4H4WdNKXlKgr5txRnm49xbAxRaw&cry=1&dbm_d=AKAmf-B6u94N4AYYTMvnMOB6Ei1q4AWZOtZzK6tcc-bqQ8gNflKe4HtbAXme1QIktAABEACqEksye4zH5Sn1F8j0ZC-VfEYviPY_rPZi1aEf0M4weB7nss2x8WCtZd0HihnCHNlPWYEge7gp89uqL3TPdysWZAu3id84kvtyYaWA5rnXNE3OZrNoxqEg-17ctLOJVQjPf2gosEA4v3c4shol9eplT_zszCdYGCdmv8ese3KkaxC6j1Wbt2QHI4ZnEOiomxQn5MmJXQwhPn-ZuKUWZFLlISpFUl-cqTm0JFGbzLwNVUjGcMQq7dMYEUMQeWe-JHTDvTxqBwBWIWcAVVvVrFH7DVVi0HNdhPcx-lrvwnX62R_pPAske3X_kfIMS7v8r8KQnULmtzWYOj8w7-Qn9RY6V_7-Bobr3BZQIFMW5vzSUd0P_r7-sB8MBT4zqRWPyQ-tJrhQYoqkLi4P0jRuoUmB2CzGMxV0PtpFsIfltGoJGXG1PmMLtjwrbZ8-u5mLNFb__7rKieBKhKKEGKH8aeI6teOLxHgFZKeuISQDgZmI5gqODknxTJwMZSAhmG_vinskDBnk-VoysdX4KDJJcHOuKkVF9ZPM_7Hv4dprx7yiNQlABD60iTqQmpvP8D7JbOlVLO-xpTCZfPvLr2LytKfuQvZXZFFY0VM_zohYEgeDTeXVWvwV4rLNEejgNGNt7oWLC17Om7PszdHxa_G9M0Ts2PgLIkKuwNMvEj9_laJX2DWp1yFVq2nN7MNKXnzA7ybgPibh8K3EteE4pKWa9kLuFtrue1b08zOpXC_BrHQgoVXN8nRqncKsoTw__JYwqk9qRdcBPZ9fPk1bwIQaNPxzkjKfJp59oJieWbz1uMP_reh5g1gYsE_wpKGLCmJx_EDNHXtCzYeXlkWYpMmTUFO5NnINafaG-lBAD-tiYV6qv3_FzD6Lp2PnlaxSUcnk6KienM4S3oA4CofMCWgbNt5s1OufBzWWYzTaole_tCmFo9SXiA_JLza47Qs-p2-soQxYghEeicO6Qxnzp__ydpkYU8sZxuj15CYFY-UMwklw72uMlv20fcpQW5XdSNvZCKiEICWof7NIAysUwE9qTPOHg_2avYCy3HHm394j78FTZCEoT4OYn70eYsCPnY2lFdkzAY_E7T1v5v57qUGhc6WvOillLJrLNPD5awsK68t-F4iqO1zkPTX14O9yy9lUl7bXpzUpYVywZQlYKvefLbaAudm5zWpf16SLWS2WM5P_pF5a9gnCZnTWA1vCrHopKKFX35A4CCSX8uONADjfBDhqgGoGZjVjGsBht8Ep9EMwh8ZqtvmCEXsLhxJpemkejvDxpbtUW87EoHgS4BLH0h4YhelNCE2GwwzKcJ1cIibqT15bgrhDJXxxYtdcdncea3Ctx06jfF5RCp_ms4mw0BqaCm3I8ShIKmju2S5KNj2RzItmC_uxUlYukIDcayOZWF7ZDT_K3bj17VNifCBvz5gf5-ixLnVYfHcw6PGe_I_7RKy_KTl4HbsNIPlqOK7EDcng_lnZwlmsplbnqlpgq1UItboDdtnrFTP56MgY8haKqDUzsCZfktw-oYVM6F0NcE685rCN06K9LeFqH42fGUJt7dlNVZxXb9pz0LA9vsS3MnUkrP68ti7lvLIiVGFzmHcfHo656Fo81uhW6kWOaQq5RQCTJ24FKcdmDemUktl6bcPbtFnhkinEbkhaY5Ob6BH1nUrtTveujBtBO1xhPkFXqefGbC2A7ZsSvgtYkrO6ADJhS5pCuiv-Ur6RqE-w7EO9fngLEaMgZOk8GAuJVnLEIUp6-dSMqqIoK3pYMeOeqEEpCrtxKTdaoJ2N6e4OofwXY1pZfzEfeoom28zYYzjE6lF7RV7BH2h1HLOuBcWOOtloVSIXLtk2F8wu97zc9tGEjx0G3g_5e5jaPdzi8dt-0lJF_KvYuKMzY8Sy9SLYpBvrccjGjV9EHuC025upyzJARfoYjFWHd2VdzxeMm1iVDG4ysmJepvOVupU7xPheHnghzkBImWbVR6_iDtbxcc2ZHvkOiWJJCxJz0e4pJMYOMUVBtzb-t8NAqV-_-hXtrjVp_iatIUk6f3_SYAuaOqMXhUKhxn3W1NV-sbrlzgL0YMGAwMWyAKQAgZyns4RlERUL_4cgucFApNLq73Qebux5AByatiIwbfJNjryy4jb2nLb5M7yDHBpS2BpqSwp85YcPPK7Pof1natcQzq_Ld0VLHtE6LfHE0DObB1AzzBk1J0D4QXCdQ7bpLC0cp8fCmNulCyaNCe-1NpoLgDT1tIroNSGK_Iu1Jw-Ooa3Eqi46syW69ndbUljw1niWUx1HJ5ruhFrHVcdLLV5apMZ3ai5rnyaYm2vWi_9SxY5gZKV4Gfh4hQEiFfBZlZ0tevBmkiwPaTUh0SvI9DHlebkXkn3hRo3J_sNMC9elEzgdqr9aay5M6aiMn5fLHlZPXRoNReJZrsikNBsWa6316hJYXC5U0I6QyUQUPjuBUv_gXICEMwY13pGjOTLcghQRPw7EZs2BR_gLfdpOh7j50ZrytCIZi5jj17-5t83tUdPZKrdBzF5ckeqGqK8UgFKedI3i9zqXHBZqvwNLXXUyy79zAiUFsh4m7wybsyWOIIkqAc-jXVbguX7PQX4H7LGwCn6tV2-8e2mwdrRUZ_s05UJhQdmEKuu3xZd-Mx_bnkIa7pYd6ikXeVlp3s0sDBGcNAn_XcVl5uuB6VNpvbMg0Gv9apZQ9w0dQHWVd13tNuRUduJSxHB2uK1oTimKHJGmxjIG_ya49hXOcdaLpeRcM7mSxIQbpkMt-VGfn4hRiE40r0ZAu4EAKkK4K2x4l8Qy8Ec8LpTspbPi2Dl9fflNhOUpb_7RTE8Q2dt9psqD1GvKZ7kH3PWtU1dsgoc8mqp_srOVnwKp0MxRZARc94Tj9V1H0kNYI2-8I0DupM5DLOARK7dpX3U7hnbcOUzzxcPE-1a1kcU_iogErIiinWVrqtMSVvuWrE1SA-gBWCfe4c_zkLJVb2OJHXbSqWPRefwgodj9YkzErPxTvhAp7EmhzgJcp7bQhAitccEpkiRZIqhtgKR5rl6vyCiysCVvkaJO4WrxwJtc7Czek2LdrdpaU036hM54-dL9Le_Bt5-tvCInCHtMx4p67cNth9HayejmuHCJt3x-2H9nmdu76XF0POuxeC_0OR9Dj8PGn-Cd-EJ2DADOyWyIjB25Xertt97nQmcx8O1yoAdp5GaqV62BQ8kooEtk_idCH-Q4bp2y5aEf04l8IsLOVHX_SZgspRY1ygrdQU475TS85QQ5UKfXCGSZZSlLXSHNOc2xH9Vd4IvQQ-By2PlZE2OIHkjtClH9Y3tp1GUvRK7ZSI6AbddM7F7RWj50vb5qE9btCBvLxYwo90LKm5AVXT5Bd0HoPsUhrO9mDn8Fk_16UZt_Ho4CdamOc04DjdIBa36LDny7j0L1wUWK8B7xdJk3udTL64PTacX_cMpSvI7MW8kiZcf2ULkYobG--kqqAyajeM8TnIDJ-S9uj6YoCU3jMgZzHJ_1baxhtB6ZN-EHfYStoLQ-kF06QFYXY11Py0kR590RipJ9GoiZR6rFsR01cKXNDr8zvWNwfB5G67migAlsNN3cneE628sjuVacppke6Zc3NYT8fT8SHzUzcLZzV5oEvRW4dkKioWl06p0SlsPrqlDf19Zpme_D6SotOdf6kZZmP4sDIhKXZI2_QfUwSrl7yCYR8Yt6dGSEFb9Z5EFMNw-Gb1eobKPDkhgJz65OKEEdfv2rWcjtuty5vmKI5pB7ezDR70aqMc8tgjc&cid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

363b775433416f17dd4115eab2b539d77eb19a1017140e46d6d7bda5e7b7b516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16478
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 098F 0
0 274ms
274ms Fetch
text/html 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CwKhsLYZ8Y9-iKJHBz7sPiqOy2AjhqpCSbcLysJbeEJrZ4PvCLRABILqEwDNgq-yxheAYoAGwgquTAcgBBakC-v9Gyx-KpD6oAwGqBJkCT9DjI4MAYKmI--DNJGDH2spdHkvzze2gdzR3UOlGqmpdS4dJI9fu6hEaA_6PZPzbQEY6S9haH-3G9aKj6Q4296rcqoTG-r5bepuHdIn3cqoMiy1m80_z0EsNFfkkcxhQtiYNPKsaWtHJumnj3PZPhzpirAZ1Sde4DuCuXRuwaM8YeYNvQNEe-cZiqM8rj85c5peVnIATceezyIyg9zvmLAH90XDR49mMPt4n-q0C0OT8UogG2bnl4-_WIgl4QQrfks3SU_MRkQgrDYJqFuNMS5DdPiJZnc6NS6SqZRWUS6tAmPxhulYm9hXKGnvy169b-BV5-jzjUGmqxvrssiV1KQJgAZg1J3Kk69NuFVVIPLLpXRtl0fHCezHABMj-5dWdBOAEA4gFqteW4EWSBQYIAxADGAOSBQYIGxABGAGSBQsIIhABGAFIkYfZAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAHuP3U7AKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChChiw0Y1Oa11wHSCA8IgGEQARgdMgKKAjoCgEDyCBthZHgtc3Vic3luLTUyMzk5MzgyMTM4NzAzODCACgPICwGwE_TelxHIE9qurOED0BMA2BMKiBQD2BQB0BUBgBcBshceChwIABIUcHViLTg5MzMzMjk5OTkzOTExMDQYyqse&sigh=OCA5UQMaz9I&uach_m=[UACH]&cid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM&vt=10
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.10.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sd-in-f156.1e100.net
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BAC1 1 KB
643 B 276ms
276ms Document
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a184-51-136-24.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 43983
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 21 Nov 2022 20:06:57 GMT
etag: 48472445140208031
expires: Tue, 22 Nov 2022 20:06:57 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 098F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5084a67c8ba643c2925a3d9f7f03b8c9e6574d5bb301270dd5289fa04cfb2c66

Request headers

accept-language: en-NZ,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 720ms
237ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.bg3.co
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 22 Nov 2022 08:20:01 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 276689
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ 351 B
655 B 720ms
238ms XHR
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bg3.co%2F&domain=www.bg3.co&cw=1&pbt=1&lsw=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

b43a395197591450bc1fb6be72395ab844c5576c4d272ef010c904db165fc2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1208327
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
539 B 433ms
144ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 047027153d3b461f958db9d1c8681a521aef4eb375b2878913c69757e0279ab8

Request headers

Referer: https://www.bg3.co/
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 22 Nov 2022 08:20:00 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.bg3.co
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Thu, 22 Dec 2022 08:20:00 GMT

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 0722 3 KB
2 KB 384ms
139ms Document
text/html 104.18.36.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.94 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 19
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 76e03e50f8a71c5e-AKL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 08:20:00 GMT
expires: Tue, 22 Nov 2022 12:20:00 GMT
last-modified: Mon, 25 Jul 2022 19:18:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 77FB 52 KB
17 KB 1121ms
294ms Document
text/html 184.51.240.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.240.199 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-240-199.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 22 Nov 2022 08:20:01 GMT
ETag: "623de86a-cf34"
Expires: Wed, 23 Nov 2022 08:20:03 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H2 200 pd Show response
u.openx.net/w/1.0/ Frame ED3E 533 B
637 B 240ms
237ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 88d9acb8263ce85a291dc27a5b077baa3f8041838545a86d749b87b513849b67

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 326
content-type: text/html
date: Tue, 22 Nov 2022 08:20:00 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 9278 36 KB
12 KB 840ms
296ms Document
text/html 184.51.136.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.51.136.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

12fb5f68666a3cae1cd6c8c0212a02d2b4c763cd008c0f63c9fd0d5a42935012

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 11837
content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 08:20:01 GMT
expires: Thu, 24 Nov 2022 08:20:01 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame A2EB 9 KB
4 KB 1143ms
382ms Document
text/html 52.84.45.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.45.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-45-7.mrs52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 55240e190af93c329c339c44aef4e37701f7cac83c65df0afb7e801b7eead39f

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

age: 57034
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Mon, 21 Nov 2022 16:29:27 GMT
etag: W/"02a59c9399d935f64b331e61178d2c9f"
last-modified: Mon, 14 Nov 2022 16:28:27 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 51f76c8cc795edfca51e07563f87887c.cloudfront.net (CloudFront)
x-amz-cf-id: JuHptKs5LhmYuMOwtJy5eZIk0Acsnl7w_WzxcBygOlOHdkLlw8wq9A==
x-amz-cf-pop: MRS52-P1
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:9114884f-60db-4078-afb1-cde242f68696
x-amz-meta-codebuild-content-md5: 3d437d58b8bd54e8a0e378e97cd0e39f
x-amz-meta-codebuild-content-sha256: 85fe75fc3aebfc86893a7760fc0ac12e3ff269743874600311aae7eb8917fccd
x-cache: Hit from cloudfront

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame E904 281 B
554 B 871ms
271ms Document
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 22 Nov 2022 08:20:01 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 2756 4 KB
2 KB 634ms
395ms Document
text/html 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1669105195821

Requested by

Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

27f0e8af4787993b10c5fcff00b81e100d7f345843d282a90bf403bef9a4eb3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1374
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H2

200

sync Show response
eb2.3lift.com/ Frame B506
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

1 KB
2 KB

237ms
236ms

Document
text/html

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: cdn.adpushup.com
URL: https://cdn.adpushup.com/prebid/pb.42753.1663912421366.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: 6c2a1e86f859a1ebb249b99e0280b77d348ed052036eb2affc0742794ea15b8f

Request headers

Referer: https://www.bg3.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1148
content-type: text/html; charset=utf-8
date: Tue, 22 Nov 2022 08:20:01 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Tue, 22 Nov 2022 08:20:00 GMT
location: /sync?&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame 5D45 36 KB
16 KB 276ms
276ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299048
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED3E
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4453138422428063496&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

241ms
241ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4453138422428063496&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4453138422428063496&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED3E
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=e55a7466-193d-7411-e601-fab360f6e65c&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=e55a7466-193d-7411-e601-fab360f6e65c&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=54263d8c-323e-4ce9-8362-325b87be81e0&ttd_puid=e55a7466-193d-7411-e601-fab360f6e65c&gdpr=0&gdpr_consent=

43 B
62 B

241ms
240ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=54263d8c-323e-4ce9-8362-325b87be81e0&ttd_puid=e55a7466-193d-7411-e601-fab360f6e65c&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=54263d8c-323e-4ce9-8362-325b87be81e0&ttd_puid=e55a7466-193d-7411-e601-fab360f6e65c&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 335

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame ED3E
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y3yGMcCo8YQAAAwqKTAAAAAA

43 B
114 B

239ms
235ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y3yGMcCo8YQAAAwqKTAAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

X-SO-Cluster-ID: 17
Date: Tue, 22 Nov 2022 08:20:01 GMT
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":17,"gdpr":false,"ipv4":"116.90.74.202","key":"Y3yGMcCo8YQAAAwqKTAAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad177"}
X-SO-Key: Y3yGMcCo8YQAAAwqKTAAAAAA
Server: nginx
X-SO-Upstream-ID: m-ad177
P3P: CP="See also http://www.scaleout.jp/privacy/"
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=Y3yGMcCo8YQAAAwqKTAAAAAA
Cache-Control: private
X-SO-HostName: m-ad177.dc4p.scaleout.jp
Connection: keep-alive
X-SO-Ads-Time: 4
Content-Length: 0
X-SO-LB-Hostname: m-tgng32.dc4p.scaleout.jp
X-SO-IP: 116.90.74.202

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame ED3E
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AVo61zM__MTlks8ADxz9j4ww1c8AAAGEnmwyKA

43 B
61 B

238ms
237ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AVo61zM__MTlks8ADxz9j4ww1c8AAAGEnmwyKA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
via: 1.1 09c63a510feb1b96fe87d2cfe41d34ae.cloudfront.net (CloudFront)
server: Logicad
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront
p3p: CP="NOI DEVo TAIo PSAo PSDo OUR IND UNI NAV", policyref="http://cd.ladsp.com/xml/w3c/p3p.xml"
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AVo61zM__MTlks8ADxz9j4ww1c8AAAGEnmwyKA
cache-control: no-cache
content-length: 0
x-amz-cf-id: w58Ldzhj_fw_KPwXVMHVGwPd76tKxssKovzgRHqWW_VQiv_0kZWNQw==
expires: -1

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame ED3E 170 B
188 B 275ms
274ms Image
image/png 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YzkzNWE3YWMtZDA0YS0yYWI1LWYzZTEtYTAwYWFhMTQyODNj

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame ED3E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAjvhKemlw3rDMbls9ayDsk&google_cver=1

43 B
61 B

239ms
238ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAjvhKemlw3rDMbls9ayDsk&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAjvhKemlw3rDMbls9ayDsk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 111 KB
22 KB 579ms
277ms Document
text/html 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5afacfe8f06706ea2deebc951f78e3a69b8e8dc507f9a301f332dd1eb7554ebd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 19439
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21900
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 02:56:02 GMT
expires: Wed, 22 Nov 2023 02:56:02 GMT
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C5DA 0
0 842ms
292ms Fetch
image/gif 142.250.4.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstidZ2_-Lx77MCUC373O24XH-GHK0ZcAL2XB-X8YjXe4_XEZp6iyhz-MFi9ck07v9OvY3yUHCvhNtdXS8ZHadjaeNTcYl00AZnjg8C_96TJHhf5u6KtJn8vSWrdPjYhXgIW5ZizO_Dsow25skwQMQrrsqeWmKCVREbSEcDuNs7cFh__RcnMwpThEyX5rkXo2Y_Obsa2WIG_66Y061rFNXr7IosJguSv6HLyPB_jSQV5pxFFGzZIvppJVDPYV0HQmwyyxTXlB12dsGDmT4S6aZoUelHZFhGpXFZ2AKiihjfWV5u9nJQ2Pomic6v4T8eaznqO-Y2Rppg5_ew0BVr-GsRGKNkib-FvBf6PSdYz_RzKBTg1fVYtQuPOqeIYMM6bB9bPqySAl_6qOybKSIdTRKDymTYUSJYqhqiJq8uDjZQCxwNoH35M6wblHDpUZEdwW4KsDN4uIQOw3jMaRM0CIDGCaFEjVpzrejr3XuAbAy2mYozg2qfW8J6VmchdHaxHlDpLfKmT5wX1rNW7D08gl0OrfI_jodB--iWdDq93BD91C5WTvxht7XTelUGsKz3gvVJwR5iWh2eNv4STkBjLWpx4Y_Rt0vRvynGRBmjVhpHSJIyPu5Ct0zivQtlLJuq86NODugE00lYRg8JJUW55SeR5QCxFMkBHfl07rIdBcwuKWe80Bh7bQ7VP3afJxpmnWZc_X4YXHMc7GeDYcNVTqE46Db56YoJErS9zFffGc3R_nkZjq4lhha8WrE0_z3J9TtqaQQqfzjBj_plskwL2mbqm47eUA_W4kRjlUTVxPhey9Y6ceaGAC065PKfgxlDDRWa6XOIOR2c1ItJ8_c_aE2bNbMhkGlchTacSsvRyg-04XWj6pWrlAwmPfnqJdIe67rVwFxlEkAjIEA3RphZnk8OmDl8GKBH-_yBKXM0WwVjfjPcwVCL6VWgSNFXpxgspIwzwswr90ualXy2vOStUDb1m0pgFPD-SN4l97d9aPMGo3kX7HKAXJl3wQxVCdFGJrLJ5gXuUlzyi7J4-R50RNcI8KDHKkPbBQnrFHv6RZKX1gSW05wCVKDaTrz4MUuq0fwLzzVghQWnDf8cfImiKOFYOzBVBfEhAzPacrdbqW5sjtveUEOLzCq5DVJ-0FG6L-IAvre4AhlSmcH4RjntWxi5NHyYqHhbHWJ2QFqxew7zdlZkofZflZGx6yD_3vHaZxqFRBOrCD9Cq2XTzg16P2mBQ9n6v-IXGzsNFm5vjaPp91YrB_RdlqBEn62E4ctFJVqzLpBgj274ezz895gNvVK8speNIQFgSU7xyVGU&sai=AMfl-YQfl5Z6yA94qqki10bJRKJtTILi58nj4J0S65N06Gv3wDPdNe5crfKSKCwp-fiH_0dJMN0Eeid1RvMPIp76oRN4uXGvrmKkkaVYaeR6d5kKfs9wQmMT1NPrbzVDOOMBsNpKjYHVIRjDK5epG9pbxZcJPRlWnkH3vd1AEgdi4m7qBTHfSKbVgLvw-zF3uWEpxBic78nBzbVgJ0HFc6W5urQDsrazP5MvUC4qBMFmLQxodIjijx8lrRL4F6vqsphBQyXncSAEqoVnnQ&sig=Cg0ArKJSzBrIreRTtaX2EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1049&cbvp=1&cstd=1045&cisv=r20221110.24729&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 22 Nov 2022 08:20:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 22 Nov 2022 08:20:01 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame BAC1 35 B
210 B 240ms
233ms Image
image/gif 103.229.10.247
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEH9ImyXO3zInkCNFBUNJY7U&google_cver=1&google_push=ASkJ3FZ7mnDX2fBrpMeuxWjYlBf4zgHOcAZidf8CNdYw7g9JCwlnSByjv52SKPI5O7CIKKMU_P_75ybZwu6xnMC8cjTjp-vsI6p49JLr_G2YWGIZ0yvKuRGgqBWY3fP5i1zIE4AKhWqpQMKq6I8_b3S02dU

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.229.10.247 , Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 i.match
a.tribalfusion.com/ Frame BAC1 43 B
573 B 287ms
281ms Image
image/gif 104.18.24.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEGWuXP9hl2KERmuSPaK0bE0&google_cver=1&google_push=ASkJ3FYfKiw42Z_78zKaaZDtygXPDJX6ryOkWggeCd1DKg0_e__gd3OflfSMi_p16h4M1yJmgvrhiSS7xbQcMuPTACPiRyxWu1XBbP-RhHBQeXYDLCOGUHiqO-AJ3XZF-yB4twqkODrASyA9n0zA_W7YKFc&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DASkJ3FYfKiw42Z_78zKaaZDtygXPDJX6ryOkWggeCd1DKg0_e__gd3OflfSMi_p16h4M1yJmgvrhiSS7xbQcMuPTACPiRyxWu1XBbP-RhHBQeXYDLCOGUHiqO-AJ3XZF-yB4twqkODrASyA9n0zA_W7YKFc%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.173 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 76e03e514c67eea2-AKL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BAC1
Redirect Chain

https://ipac.ctnsnet.com/int/cm?exc=1&acc=crimtan_au&google_gid=CAESEJbJpQQz-Jpqlh4JtuyHKzo&google_cver=1&google_push=ASkJ3FaQrOpZU4-regfUsgwQabvmxOr50aqnygH0UQXNDvW_lHNXJfTleahuajO0Exx004fG5dgS4pn...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FaQrOpZU4-regfUsgwQabvmxOr50aqnygH0UQXNDvW_lHNXJfTleahuajO0Exx004fG5dgS4pn7qzEqZWPha1hA8iWR4Z-96KVeQ1T_4RbvRINQgVZnZNE-x08V...

170 B
188 B

276ms
276ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FaQrOpZU4-regfUsgwQabvmxOr50aqnygH0UQXNDvW_lHNXJfTleahuajO0Exx004fG5dgS4pn7qzEqZWPha1hA8iWR4Z-96KVeQ1T_4RbvRINQgVZnZNE-x08VZkZV0XjPlaJlnrPiRfuFzv7lDz8&google_hm=HtzoDC2qS56Uri1ntFODoso

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:00 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_au&google_push=ASkJ3FaQrOpZU4-regfUsgwQabvmxOr50aqnygH0UQXNDvW_lHNXJfTleahuajO0Exx004fG5dgS4pn7qzEqZWPha1hA8iWR4Z-96KVeQ1T_4RbvRINQgVZnZNE-x08VZkZV0XjPlaJlnrPiRfuFzv7lDz8&google_hm=HtzoDC2qS56Uri1ntFODoso
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BAC1
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEC4v0YHBVn5_1Wq947e_mFY&google_cver=1&google_push=ASkJ3FZlAhGHVdWYouMEOuE1BMDlP07tDTD6UTZxN-mjwZ_HC3caUaWMVbUnkvfZGOQLEHzDa2l1ZZxLnEMrRvt...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=CSnrxoDxSpRXanu2cdFc3XRaSso&google_push=ASkJ3FZlAhGHVdWYouMEOuE1BMDlP07tDTD6UTZxN-mjwZ_HC3caUaWMVbUnkvfZGOQLEHzDa2l1ZZxLnEMrRv...

170 B
188 B

274ms
274ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=CSnrxoDxSpRXanu2cdFc3XRaSso&google_push=ASkJ3FZlAhGHVdWYouMEOuE1BMDlP07tDTD6UTZxN-mjwZ_HC3caUaWMVbUnkvfZGOQLEHzDa2l1ZZxLnEMrRvt5JT8BlCJ2Cc7WznYC3jMBsnjDt_EfliDhD6yiyaiqC9DCyrwF_2z2OBeiWuY6jdfGTVc

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=CSnrxoDxSpRXanu2cdFc3XRaSso&google_push=ASkJ3FZlAhGHVdWYouMEOuE1BMDlP07tDTD6UTZxN-mjwZ_HC3caUaWMVbUnkvfZGOQLEHzDa2l1ZZxLnEMrRvt5JT8BlCJ2Cc7WznYC3jMBsnjDt_EfliDhD6yiyaiqC9DCyrwF_2z2OBeiWuY6jdfGTVc
Date: Tue, 22 Nov 2022 08:20:01 GMT
Connection: keep-alive
Content-Length: 297
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame BAC1 0
12 B 277ms
271ms Image
text/html 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LDKNr0gkX-IoAl68L70Ez8Ac1JgjKL7D006uxMRz_QbD4QOjFg

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:00 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 098F 41 KB
15 KB 272ms
272ms Script
text/javascript 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 17 Nov 2022 16:07:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 403977
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Nov 2023 16:07:03 GMT

HEAD
H/1.1

200
OK

file.mp4
r2---sn-ntq7ynle.c.2mdn.net/videoplayback/id/11f49df0cdbf9228/itag/59/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1700641200/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 098F
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/11f49df0cdbf9228/itag/59/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1700641200/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signat...
https://r2---sn-ntq7ynle.c.2mdn.net/videoplayback/id/11f49df0cdbf9228/itag/59/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1700641200/sparams/acao,ctier,expire,id,ip,ipbits,itag...

0
0

435ms
142ms

Fetch
video/mp4

74.125.109.231

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-ntq7ynle.c.2mdn.net/videoplayback/id/11f49df0cdbf9228/itag/59/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1700641200/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/8104F3084551346DD395A6350C93D8E499A52FB0.3A3113717247D166C901AF0C3BDCE6BBCDF4B7AD/key/cms1/cms_redirect/yes/mh/iT/mip/116.90.74.202/mm/42/mn/sn-ntq7ynle/ms/onc/mt/1669104794/mv/m/mvi/2/pl/24/file/file.mp4

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

HTTP/1.1

Server

74.125.109.231 -, , ASN (),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:02 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1760820
Last-Modified: Thu, 07 Jul 2022 21:23:55 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

date: Tue, 22 Nov 2022 08:20:01 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 642
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
location: https://r2---sn-ntq7ynle.c.2mdn.net/videoplayback/id/11f49df0cdbf9228/itag/59/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1700641200/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/8104F3084551346DD395A6350C93D8E499A52FB0.3A3113717247D166C901AF0C3BDCE6BBCDF4B7AD/key/cms1/cms_redirect/yes/mh/iT/mip/116.90.74.202/mm/42/mn/sn-ntq7ynle/ms/onc/mt/1669104794/mv/m/mvi/2/pl/24/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 098F 0
54 B 502ms
485ms Ping
image/gif 142.251.128.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lary535x&c=3439079425245&slotId=1719539712622.5&qqid=CJ_tmLOtwfsCFZHgcwEdipEMiw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=738&mt=video%2Fmp4&vs=854x480&ulv=1&cll=0&vast_v=2.0&vmfc=12&vhc=0&msm=1&aits=0%2C18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=59&vsrc=web_video_ads&ape=1&met.4=videopreviewvisible.2m9
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20221114_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.128.35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: gru06s68-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame BE5C 2 KB
1 KB 699ms
402ms Document
text/html 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.19 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6a5d35f8e931306814851f41b97d600e246a35482f8ed323ad75a78598d13614

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 76e03e53eacba823-SYD
content-encoding: br
content-type: text/html
date: Tue, 22 Nov 2022 08:20:01 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kKnfVLcSR0OSt3UNhb%2BVNRwJq9GfPKSHJjdwhLOSwYYWnJtw4gB6YtRupmRReLWEvLjKqoJptIsKgtJSJy1Oxxz2jGGlybKt%2B8xnbmxv9THrLtDa0fJw1qzl2HPBAEJ8Ls%2FLyatuQBBazw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5D45 0
20 B 282ms
282ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B6Wd5L4Z8Y7mYFquJssUPgJaI6AcAAAAAOAHgBAI&bg=!urmluf3NAAbvMpMzzzI7ACkAdvg8WrGtm7Z8uWBmhWyII1eRyK7qXEbcdB3WgbgmFIHalheVHABGSwIAAABjUgAAAANoAQeZAu2Ugdo_YWM7c4GIY6hG0i4ZR2nE13i6xZ72yasazdc268FZwN7EJ8H8f998jRN20suwbk8vETjgII_LNMX5GnDxR_oJHDvIdW3pv2HxHiB0XglwCaS_ukWC6GpaNO6Lm85fAcJlWq9XCsvf-QI4arNrkiv9HD-wvzctuYq_ziXyfJjQHYW4yV8-KYLayYNptqlGVzp6NU5AmFhgCxWvxKbrkbZYPuDy7m0IZkDiEgvEtYdWKI-4OnyWXCWlZcH41neEQbclcTzusXClJBptMdX26XiPjnbFm9sqjE7L4JqHrIVm9ObFDNKu_-JqprpzgaqGu1VUUPnDz2U0euTwswLIfmBH_m7Rmtnelu8sPOgqn72HszOhYXCnzg6nNEu_vcPtmjE2hfyD8XmAaexAG2bbFjm9zVm2ShMtM01Z8oVWJSwZlFPCvOXQN2dowwE-BHZhIMWSFNo4cnrf50FsDYULQA19AafPsE5Tp-zgXi8WyK1F9A2sDzU2NX1Tlt4x1AMGaJx0bavKDcSHtpqbENaMyfBTvolPZI7NyZ1tJjpERul5gsjWK7fYLKQsT4_RVmVg0ovCN0MueWWWXR9i_jdJSJsA4yOcA_UVG27bZKkD0VMjStmoO6yvExwepdsaPAcv6jF1jH955JeP4j8q643hoZpKXL3XwzbjcP6lC9BF4VkrtyhpSv8TOB7IgDFQ8hscbIhhx6mNwysWvaBUmwo4koAOrc1-Tn-89JE10V1HO_VQ4ACx47DdO4EzvYRm0ijIv5bPJOaNeoEg0FsxLyVTYPDRp_9ZoXk8N1Xd5raMUqGLKhAb_iMD_PoELzo_of0kBKt5E5zPqHzmz-f7Lu57ToLPdE4Eu0vtZfOvlivjCzhEyX7e3Aj4vLJ1BlqHVt7smaPBCQhKtSrMUYt55uungY_gnhe0o2pzo-9e4vRIMK4amGxn9mqRLX6URFxFDdBDYFznG2vhEuqzdSIky0DHk161MYCS6KUXM93j-Q

Requested by

Host: 963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
URL: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 2756
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=aca2637c-8631-4000-9bea-8e8c990f01ff&gdpr=1&gdpr_consent=

0
340 B

392ms
392ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=aca2637c-8631-4000-9bea-8e8c990f01ff&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Server: MT3 169 32252b7 master hkg-pixel-x7 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=aca2637c-8631-4000-9bea-8e8c990f01ff&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Nov 2022 08:20:00 GMT

GET sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 2756 0
0

GET
H2

200

/
onetag-sys.com/match/ Frame 2756
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=5541281037779136794

0
340 B

392ms
392ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=5541281037779136794

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:01 GMT
AN-X-Request-Uuid: 4460ef07-a6f7-40f2-ad3d-52c7922bca63
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=5541281037779136794
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 2756 42 B
678 B 1367ms
236ms Image
image/gif 69.173.158.64

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=xLmntVupV2K4d590Ok8AVGGmgfCPppYpjjLFAVSgW28
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2756
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhJ5sML4ChJ3NYGHWQR7miZwq9xGUArjypg

170 B
188 B

274ms
273ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhJ5sML4ChJ3NYGHWQR7miZwq9xGUArjypg

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhJ5sML4ChJ3NYGHWQR7miZwq9xGUArjypg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1 200
OK sync
ssbsync-global.smartadserver.com/api/ Frame 2756 0
75 B 906ms
236ms Image
text/plain 23.106.127.164

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.164 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:01 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 2756
Redirect Chain

https://id.rlcdn.com/711916.gif?ct=4&cv=
https://id.rlcdn.com/1000.gif?memo=COy5KxoNCLGM8psGEgUI6AcQAEIASgA
https://onetag-sys.com/match/?int_id=110&uid=

0
340 B

392ms
391ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=110&uid=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

date: Tue, 22 Nov 2022 08:20:02 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://onetag-sys.com/match/?int_id=110&uid=
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET

ecm3
s.amazon-adsystem.com/ Frame 2756
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=pgJ7otcx4llsqX9IZf0Kv2h-KkStwOWHO-I0XJ5LNas

0
0

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 2756 0
42 B 727ms
236ms Image
text/plain 103.231.98.197

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.197 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 2756
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEBBaTERzBvYSYXufiyzEDOU&google_cver=1

0
340 B

394ms
394ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEBBaTERzBvYSYXufiyzEDOU&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEBBaTERzBvYSYXufiyzEDOU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 2756 0
125 B 490ms
240ms Image
text/plain 52.74.13.196

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.74.13.196 -, , ASN (),

Reverse DNS

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 2756
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=54263d8c-323e-4ce9-8362-325b87be81e0&gdpr=0&gdpr_consent=

0
340 B

393ms
393ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=54263d8c-323e-4ce9-8362-325b87be81e0&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/match/?int_id=29&uid=54263d8c-323e-4ce9-8362-325b87be81e0&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 2756 43 B
235 B 288ms
287ms Image
image/gif 35.213.12.39

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1669105195821
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.213.12.39 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame F51E 23 KB
9 KB 272ms
272ms Document
text/html 142.251.10.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.10.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a184-51-136-24.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
age: 553675
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 15 Nov 2022 22:32:06 GMT
expires: Wed, 15 Nov 2023 22:32:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sync Show response
gum.criteo.com/ Frame 9278 61 B
301 B 561ms
237ms Script
text/javascript 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Kestrel
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 291496
expires: 60

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 4EB9
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
https://eus.rubiconproject.com/usync.html?p=medianet

281 B
554 B

270ms
269ms

Document
text/html

23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=medianet
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 22 Nov 2022 08:20:02 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 22 Nov 2022 08:20:02 GMT
location: https://eus.rubiconproject.com/usync.html?p=medianet
server: AkamaiGHost

GET cm
p.rfihub.com/ Frame 1926 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame A0F4 15 KB
6 KB 828ms
268ms Document
text/html 184.51.240.213

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dpba%26refUrl%3D%26vid%3D91052013673121068017444213000V10%26ovsid%3DPM_UID
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.240.213 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://contextual.media.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=168988
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 08:20:02 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 24 Nov 2022 07:16:30 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
unused62: 8096267
vary: Accept-Encoding

GET
H2

200

cksync.php
contextual.media.net/ Frame 9278
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dapx%26refUrl%3D%26vid%3D91052013673121068017444213000V10%26ovsid%3D%24UID
https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=apx&refUrl=&vid=91052013673121068017444213000V10&ovsid=5541281037779136794

45 B
452 B

288ms
287ms

Image
image/gif

184.51.136.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=apx&refUrl=&vid=91052013673121068017444213000V10&ovsid=5541281037779136794

Requested by

Protocol

Server

184.51.136.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 08:20:02 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:01 GMT
AN-X-Request-Uuid: 45b4b028-2976-4c17-9850-1818c678c71d
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=apx&refUrl=&vid=91052013673121068017444213000V10&ovsid=5541281037779136794
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cksync.html
contextual.media.net/ Frame 9278
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3121068017444213...
https://contextual.media.net/cksync.html?cs=8&vsid=3121068017444213000V10&type=opx&refUrl=&vid=91052013673121068017444213000V10&ovsid=2d761df9-b23d-4ef1-854e-84ddd2197480

219 B
219 B

298ms
297ms

Image
text/html

184.51.136.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.html?cs=8&vsid=3121068017444213000V10&type=opx&refUrl=&vid=91052013673121068017444213000V10&ovsid=2d761df9-b23d-4ef1-854e-84ddd2197480

Requested by

Protocol

Server

184.51.136.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-51-136-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 08:20:01 GMT
server: Apache
vary: Accept-Encoding
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: text/html;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 219
x-mnet-hl2: E
expires: Tue, 22 Nov 2022 08:20:01 GMT

Redirect headers

date: Tue, 22 Nov 2022 08:20:01 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://contextual.media.net/cksync.html?cs=8&vsid=3121068017444213000V10&type=opx&refUrl=&vid=91052013673121068017444213000V10&ovsid=2d761df9-b23d-4ef1-854e-84ddd2197480
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

cksync.php
contextual.media.net/ Frame 9278
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dmma%26refUrl%3D%26vid%3D910520136731210680174442...
https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=mma&refUrl=&vid=91052013673121068017444213000V10&ovsid=32ff637c-8632-4000-9be6-feb0dba95266

45 B
465 B

288ms
288ms

Image
image/gif

184.51.136.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=mma&refUrl=&vid=91052013673121068017444213000V10&ovsid=32ff637c-8632-4000-9be6-feb0dba95266

Requested by

Protocol

Server

184.51.136.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-51-136-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 08:20:02 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

Date: Tue, 22 Nov 2022 08:20:02 GMT
Server: MT3 169 32252b7 master hkg-pixel-x18 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=mma&refUrl=&vid=91052013673121068017444213000V10&ovsid=32ff637c-8632-4000-9be6-feb0dba95266
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Nov 2022 08:20:01 GMT

GET

generic
match.adsrvr.org/track/cmf/ Frame 9278
Redirect Chain

https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dr1%26refUrl%3D%26vid%3D91052013673121068017...
https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&zcc=1&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dr1%26refUrl%3D%26vid%3D91052013673121...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7564938386

0
0

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 9278
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzEyMTA2ODAxNzQ0NDIxMzAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFDo_X2JOSoAeXh1LHysvBU&google_cver=1

45 B
610 B

909ms
288ms

Image
image/gif

96.17.188.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFDo_X2JOSoAeXh1LHysvBU&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 96.17.188.24 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:02 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFDo_X2JOSoAeXh1LHysvBU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 9278
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Ddxu%26refUrl%3D%26vid%3D91052013673121068017444...
https://pm.w55c.net/ping_match.gif?scc=1&ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Ddxu%26refUrl%3D%26vid%3D91052013673121068...
https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=dxu&refUrl=&vid=91052013673121068017444213000V10&ovsid=xb567rIt1OXovE5

45 B
451 B

304ms
291ms

Image
image/gif

184.51.136.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=dxu&refUrl=&vid=91052013673121068017444213000V10&ovsid=xb567rIt1OXovE5

Requested by

Protocol

Server

184.51.136.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-51-136-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 08:20:02 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:02 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/595ea14#595ea1444a96c0bdac4aa333a73d7028cf966fc7 i-052f9362e060162a9@ap-southeast-1a@dxedge-app-ap-southeast-1-prod-asg
Location: https://contextual.media.net/cksync.php?cs=8&vsid=3121068017444213000V10&type=dxu&refUrl=&vid=91052013673121068017444213000V10&ovsid=xb567rIt1OXovE5
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

cksync.php
contextual.media.net/ Frame 9278
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=115&p=226&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=fe6d915d-59ed-4a37-ace9-2e99aec75cd1

45 B
614 B

288ms
288ms

Image
image/gif

184.51.136.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=fe6d915d-59ed-4a37-ace9-2e99aec75cd1

Requested by

Protocol

Server

184.51.136.24 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-51-136-24.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 08:20:02 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 45
x-mnet-hl2: E
expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=fe6d915d-59ed-4a37-ace9-2e99aec75cd1
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1087245
content-length: 0
expires: Tue, 22 Nov 2022 00:00:00 GMT

GET

pixel
cm.g.doubleclick.net/ Frame 9278
Redirect Chain

https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://x.bidswitch.net/ul_cb/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=medianet&bsw_param=fb779136-5f76-4983-9d8e-ad1efd3c5300&google_hm=ZmI3NzkxMzYtNWY3Ni00OTgzLTlkOGUtYWQxZWZkM2M1MzAw

0
0

GET

/
b1sync.zemanta.com/usersync/bluekai/callback/ Frame 9278
Redirect Chain

https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dzem%26refUrl%3D%26vid%3D91052013673121068017444213...
https://stags.bluekai.com/site/23178?id=zJwkjmZuZ3OW2CBCIUg7&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPL2JJ3WW2TNLJ2VUM2PK4ZEGQSDJFKWO...

0
0

GET sync
rtb.mfadsrvr.com/ Frame 9278 0
0

GET um
cs.emxdgt.com/ Frame 9278 0
0

GET
H/1.1

200
OK

cksync
cs.media.net/ Frame 9278
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=54263d8c-323e-4ce9-8362-325b87be81e0

45 B
621 B

287ms
286ms

Image
image/gif

96.17.188.24

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=54263d8c-323e-4ce9-8362-325b87be81e0
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUPEPKI9&prvid=2034%2C2033%2C2031%2C2030%2C112%2C2029%2C233%2C2028%2C2027%2C236%2C2069%2C237%2C117%2C51%2C97%2C55%2C99%2C3012%2C2043%2C2040%2C244%2C201%2C2039%2C3007%2C246%2C4%2C203%2C9%2C2055%2C172%2C173%2C294%2C251%2C175%2C132%2C178%2C255%2C3018%2C3017%2C214%2C3016%2C337%2C338%2C70%2C77%2C2022%2C2021%2C141%2C262%2C186%2C222%2C345%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol: HTTP/1.1
Server: 96.17.188.24 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:02 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 45
X-MNET-HL2: E
Expires: Tue, 22 Nov 2022 08:20:02 GMT

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cs.media.net/cksync?cs=1&type=ttd&ovsid=54263d8c-323e-4ce9-8362-325b87be81e0
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 199

GET
H2

200

xuid
eb2.3lift.com/ Frame B506
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3658&xuid=54263d8c-323e-4ce9-8362-325b87be81e0&dongle=0cfd

37 B
354 B

238ms
238ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=54263d8c-323e-4ce9-8362-325b87be81e0&dongle=0cfd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 22 Nov 2022 08:20:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://eb2.3lift.com/xuid?mid=3658&xuid=54263d8c-323e-4ce9-8362-325b87be81e0&dongle=0cfd
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 209

GET
H2

200

ebda
eb2.3lift.com/ Frame B506
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzA4Mzk3NDAyNzI4NjcyMTU2MTUyOA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

235ms
235ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame B506
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFyf3r6pAZquTxb0vogdkLo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
354 B

238ms
238ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFyf3r6pAZquTxb0vogdkLo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 22 Nov 2022 08:20:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFyf3r6pAZquTxb0vogdkLo&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B506
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzA4Mzk3NDAyNzI4NjcyMTU2MTUyOA%3D%3D

170 B
188 B

276ms
276ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzA4Mzk3NDAyNzI4NjcyMTU2MTUyOA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzA4Mzk3NDAyNzI4NjcyMTU2MTUyOA%3D%3D
date: Tue, 22 Nov 2022 08:20:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

/
p.adsymptotic.com/d/px/ Frame B506
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3083974027286721561528&dbredirect=true&gdpr=0&consent=
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3083974027286721561528&dbredirect=true&gdpr=0&consent=&cookiesTest=true
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=b231387b-80ed-4fd3-bfd9-e21d6e8e084d&_noobservation=1
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=b231387b-80ed-4fd3-bfd9-e21d6e8e084d&_noobservation=1&_expected_cookie=46e73cb...

43 B
141 B

246ms
243ms

Image
image/gif

104.18.100.194

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=b231387b-80ed-4fd3-bfd9-e21d6e8e084d&_noobservation=1&_expected_cookie=46e73cb7551818fe68d55697acc60502
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 104.18.100.194 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

p3p: CP='NON DSP COR CONi OUR BUS CNT'
date: Tue, 22 Nov 2022 08:20:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 76e03e5d2acea8b9-SYD
content-length: 43
content-type: image/gif

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=b231387b-80ed-4fd3-bfd9-e21d6e8e084d&_noobservation=1&_expected_cookie=46e73cb7551818fe68d55697acc60502
date: Tue, 22 Nov 2022 08:20:02 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 76e03e5b88d0a8b9-SYD
content-length: 0

GET

adxcm.aspx
inv-nets.admixer.net/ Frame B506
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=3083974027286721561528&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=3083974027286721561528&gdpr=0&gdpr_consent=
https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=0&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtrip...

0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame B506
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/3083974027286721561528?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-vwa9UYBE2oSpV1It0bjbFHE2pZXHIQVjYtiIyK_Z8g--~A&dongle=0883

37 B
354 B

248ms
239ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-vwa9UYBE2oSpV1It0bjbFHE2pZXHIQVjYtiIyK_Z8g--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 22 Nov 2022 08:20:01 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date: Tue, 22 Nov 2022 08:20:01 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-vwa9UYBE2oSpV1It0bjbFHE2pZXHIQVjYtiIyK_Z8g--~A&dongle=0883
content-length: 0

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame B506 0
0

GET
H2 200 c.gif
c.bing.com/ Frame B506 42 B
667 B 798ms
288ms Image
image/gif 13.107.21.200

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=3083974027286721561528&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 -, , ASN (),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
last-modified: Thu, 13 Oct 2022 15:58:17 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1E733C8100AC4B9B981894106885965F Ref B: SYD03EDGE1313 Ref C: 2022-11-22T08:20:02Z
etag: "e997be9b1cdfd81:0"
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type: image/gif
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H2

200

xuid
eb2.3lift.com/ Frame B506
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
https://eb2.3lift.com/xuid?mid=3335&xuid=5541281037779136794&dongle=4d58&gdpr=0&gdpr_consent=

37 B
354 B

237ms
236ms

Image
image/gif

35.71.178.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3335&xuid=5541281037779136794&dongle=4d58&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol: H2
Server: 35.71.178.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ade9ecc7904667038.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eb2.3lift.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
date: Tue, 22 Nov 2022 08:20:02 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:02 GMT
AN-X-Request-Uuid: c3c7d7ed-92cb-4dae-8a17-8b59ca9523b9
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://eb2.3lift.com/xuid?mid=3335&xuid=5541281037779136794&dongle=4d58&gdpr=0&gdpr_consent=
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame E904 34 KB
10 KB 270ms
270ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 59775916c5dc568fd4d2ea64b09d0b2d9def879f13d1a7382636cf70fe716c03

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 21 Nov 2022 20:11:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=42701
Connection: keep-alive
Content-Length: 10066
Expires: Tue, 22 Nov 2022 20:11:42 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 75E3 29 KB
10 KB 278ms
277ms Script
text/javascript 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 18:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51526
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 22 Nov 2022 18:01:15 GMT

GET
H3 200 rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js Show response
pagead2.googlesyndication.com/bg/ Frame F51E 36 KB
16 KB 276ms
276ms Script
text/javascript 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rVlqs_C6MEoymNIgrpYBY2eJfhVJuMjEUeWab4z9yRM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-74-143-166.ap-southeast-1.compute.amazonaws.com

Software

sffe /

Resource Hash

ad596ab3f0ba304a3298d220ae96016367897e1549b8c8c451e59a6f8cfdc913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 18 Nov 2022 21:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299049
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15986
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 21:15:52 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BE5C
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=54263d8c-323e-4ce9-8362-325b87be81e0&expiration=1671697201&gdpr=0&gdpr_consent=

43 B
766 B

1059ms
353ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=54263d8c-323e-4ce9-8362-325b87be81e0&expiration=1671697201&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=54263d8c-323e-4ce9-8362-325b87be81e0&expiration=1671697201&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 323

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame BE5C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGG0gsBST68WnJqEpP6Ish8&google_cver=1

43 B
876 B

385ms
384ms

Image
image/gif

104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGG0gsBST68WnJqEpP6Ish8&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H3
Server: 104.18.33.19 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sH1blqhe2o5m4XYJPpzIxjlxPgLlvwYh5turhKkUtaHCm9ytyqCZGMp9Lw37DCmZTdOnxbp3EwzuqtwKojNU3zJthUfJhCE8jSQfViyXtE7GwVnFh0rwG%2FXNiihx4vsMWSv8Nggk1A0%2F2A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 76e03e583b43a831-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEGG0gsBST68WnJqEpP6Ish8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET dcm
s.amazon-adsystem.com/ Frame BE5C 0
0

GET

crum
dsum-sec.casalemedia.com/ Frame BE5C
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=5541281037779136794

0
0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BE5C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=Y3yGMgAAAOjD2gAT
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y3yGMgAAAOjD2gAT&_test=Y3yGMgAAAOjD2gAT

43 B
766 B

582ms
357ms

Image
image/gif

139.5.84.243
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y3yGMgAAAOjD2gAT&_test=Y3yGMgAAAOjD2gAT
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: HTTP/1.1
Server: 139.5.84.243 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:02 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

x-served-by: cache-mel11263-MEL
pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1669105202.409477,VS0,VE0
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Y3yGMgAAAOjD2gAT&_test=Y3yGMgAAAOjD2gAT
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET

/
b1sync.zemanta.com/usersync/bluekai/callback/ Frame BE5C
Redirect Chain

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=
https://stags.bluekai.com/site/23178?id=zJwkjmZuZ3OW2CBCIUg7&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3S...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD26SKO5VWU...

0
0

GET
H2

200

Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame BE5C
Redirect Chain

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB&gdpr_consent=&us_privacy=&gdpr=
https://pr-bh.ybp.yahoo.com/sync/casale/Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB

43 B
601 B

243ms
241ms

Image
image/gif

52.74.143.166
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Server

52.74.143.166 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

Redirect headers

location: https://pr-bh.ybp.yahoo.com/sync/casale/Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB
date: Tue, 22 Nov 2022 08:20:02 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame BE5C 43 B
601 B 245ms
243ms Image
image/gif 52.74.143.166
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/Y3yGK6bazl1kHW8nUishuQAAEsQAAAAB?gdpr_consent=&us_privacy=&gdpr=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.74.143.166 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-74-143-166.ap-southeast-1.compute.amazonaws.com

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:01 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame BE5C 43 B
353 B 572ms
124ms Image
image/gif 172.64.151.162

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?Y3yGK6bazl1kHW8nUishuQAA%264804
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bg3.co%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.162 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
cf-cache-status: HIT
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
age: 72184
etag: "761e21-2b-546dc3a097100"
vary: Accept-Encoding
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 76e03e5acc071c59-AKL
content-length: 43
expires: Wed, 23 Nov 2022 08:20:02 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 77FB 0
743 B 465ms
464ms Script
text/html 68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.182 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 22 Nov 2022 08:20:01 GMT
AN-X-Request-Uuid: f6f91fb0-048c-4a11-8740-56f380b6670c
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 116.90.74.202; 116.90.74.202; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame DD4A 5 KB
2 KB 879ms
243ms Document
text/html 18.176.135.241

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.176.135.241 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 9128028af26f3c01517436962e47eb87f427fceaa639768a6566d431ea0f0cdd

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 22 Nov 2022 08:20:02 GMT
etag: W/"0279f9ffdb882652754d38f122d84c5d9"
server: nginx
timing-allow-origin: *

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame BB5F 4 KB
2 KB 405ms
391ms Document
text/html 51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

7c59e0d22e181124029f1db56de037646f98da9163c0e19b2a02761e0df99545

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1398
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame DFD0 863 B
1 KB 862ms
236ms Document
text/html 23.106.127.164

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.106.127.164 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8bc96a3c502ab568a2eae34e7df5e502e2a1a65c5e7075380eb1adc1adc23d14

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

content-length: 863
content-type: text/html
date: Tue, 22 Nov 2022 08:20:01 GMT

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame A227 2 KB
1 KB 598ms
443ms Document
text/html 104.18.33.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.33.19 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9145e5f9e8d690632c1f1dae625002eac95fb3afedcbadbc2f4c1e63850391f0

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 76e03e57ea3ba831-SYD
content-encoding: br
content-type: text/html
date: Tue, 22 Nov 2022 08:20:02 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YyJ7Obeg9SswUZWfitat7OeQDOjyNNopxMVrRl0bb5B%2FjKu4aKlLxldGv%2BCB0ltCgbYD%2B8%2F2VnnG%2BGIOFqu0EB3bZhyXzlgtssuCkBZ8%2FICrNfrkb%2Brp35qT9m2N%2FRHXup88Dp%2FA4V%2Bxfw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 080C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=duration_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east

281 B
554 B

271ms
269ms

Document
text/html

23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 22 Nov 2022 08:20:02 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 22 Nov 2022 08:20:02 GMT
location: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
server: AkamaiGHost

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 67B7 15 KB
6 KB 532ms
270ms Document
text/html 184.51.240.213

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=162412&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&us_privacy=1YN-&&predirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D316%26uid%3DPM_UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.240.213 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=168988
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 08:20:02 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 24 Nov 2022 07:16:30 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
unused62: 8096267
vary: Accept-Encoding

GET
H2 200 sync-iframe Show response
cs-rtb.minutemedia-prebid.com/ Frame 9E3A 5 KB
5 KB 1080ms
456ms Document
text/html 13.33.88.40

General

Check archive.org

Show headers Download Go to

Full URL: https://cs-rtb.minutemedia-prebid.com/sync-iframe?gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D348%26uid%3D%7BpartnerId%7D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.88.40 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fbaea8a698221b90c59c6328c5d27d89ae30773e2bf9f9da02a99938c6d816a6

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://public.servenobid.com/
content-type: text/html
date: Tue, 22 Nov 2022 08:20:02 GMT
via: 1.1 519f4b1ac97b08b10023540bb9e7e006.cloudfront.net (CloudFront)
x-amz-cf-id: MLkaSC4WLJQWQGRByzKsZFiaotGQ5q1dauM4ldlXd9rp0ix66IhCjQ==
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront

GET

sync
ads.servenobid.com/ Frame A2EB
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=5541281037779136794

0
0

GET

sync
ads.servenobid.com/ Frame A2EB
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=FsV0DLZHqVQy_vYDRySqyYxv

0
0

GET

sync
ads.servenobid.com/ Frame A2EB
Redirect Chain

https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID&sovrn_retry=true
https://ads.servenobid.com/sync?pid=310&uid=FsV0DLZHqVQy_vYDRySqyYxv

0
0

GET

generic
match.adsrvr.org/track/cmf/ Frame A2EB
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1669105202416
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2152809859

0
0

GET cm
p.rfihub.com/ Frame A2EB 0
0

GET usa
sync.go.sonobi.com/ Frame A2EB 0
0

GET

13395
prebid.a-mo.net/cchain/0/ Frame A2EB
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=1&gdpr_consent=&us_privacy=1YN-&cb=https%3A%2F%2Fprebid.a-mo.net%2Fcchain%2F0%2F13395%3Fgdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26A%...
https://prebid.a-mo.net/cchain/0/13395?gdpr=0&gdpr_consent=&us_privacy=1YN-&A=8a978860-c84e-41f9-9cfd-0da0d294dafa&bidder=index_rtb&cbx=aHR0cHM6Ly9hZHMuc2VydmVub2JpZC5jb20vc3luYz9waWQ9MzI3JnVpZD0%3...

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame A2EB
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-_w6pNU9E2uE18yxleTc7xaQgTxRuU4fTN.oCTh4-~A

0
366 B

411ms
409ms

Image
image/avif

54.75.88.22
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-_w6pNU9E2uE18yxleTc7xaQgTxRuU4fTN.oCTh4-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.75.88.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-88-22.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-_w6pNU9E2uE18yxleTc7xaQgTxRuU4fTN.oCTh4-~A
date: Tue, 22 Nov 2022 08:20:02 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET redirectuser
ssp.disqus.com/ Frame A2EB 0
0

GET occ
ups.analytics.yahoo.com/ups/58632/ Frame A2EB 0
0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A021 0
0 285ms
279ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=2781778878858997&bg=!QEOlQwfNAAbvMpMzzzI7ACkAdvg8WnDtDmgKcI_pvhdrQEmzjoqBCdZ1QoWValsL1E2wZFMqayd0wQIAAABMUgAAAANoAQcKAFl4HcfxPwN8JFAUzicOhY80MlERy8QnDFCMgUSrtdbjV0E07y_XlbnVzxcRYkG2tE2bHnRyOGSsrZzJgqwBWklldkaZ1rD4Q2eb8h-r0NZDv4I-F3qXgugpDZkCvIt74LqtHV5XK4I73jVn_E05EjF5VVwV_JxoCNwS9N_exjycOOclcWiv_VftNIEdZl6bb3xqTKh5oM3W1Pk5OQT3HhPOVKimZXVTDxsuAtG01EjcGT9gQwf8EbwpeuLxdptL_goSizVVISZHCp12yGxm7N5apdCujuzMkkzlAeOp8TV94Tn3bksTd4HqTFSzdCX3RnFPg7PSkN7uSj_kWvQObYrJ5gf36afYvILJ2uOZN0Mx4K21Hiz2amQNBPJnP8Tm2k0o_CjtGY6Y5bRKPbLADlZQSCLx1QLu6TFAI-3RLM8FCI7msnFVIwnuFyOKyN-BhZ8QQXqJvUPF8X0B_e1nIuOMJtucquxdWBkkFGAdbwgWwFhmfHHQv9WV_j-J4kAj9OIxXnCWbsk_7YOVQ1gZn1qFOvz7ZW2RxSNpsUcsI1dSWVl2MNeCiEXmF6sAfW__B8Sfvii6WXqO_weysPU_g8X1t-FAgAXuv8W2MHUOxOfPAzLM1xTD1hzWzNZEDUEqt5NFHsJKfPTaI7d5rxj_GuxxVZsRLzSk5tpKKx-m58S1mpXw2Alk73JClZVNxX2TgZu_MuLkAUP8QB29okX3BALzuDu9jw7YPoM1A2JScrZeqGVU3WvquVZIi8kCw3EuqtNh8sMerRE_DxT2Verg5SnFHNkdrU_iZxiWCKFEh6BG1v1CppC6WxZRO_k0JrE4UPAfnbTPPUvPXW1Gpm4bvF9dM9uVuAImiXBFaT3CDju3RCwcLTPcFToUIC7vtf_FFmuDLkIve8mGH468Lf3M9iYUQ4HziLJ9mEyUggE_1qMMfpbG4l5dJuBmKW-NEgO1uZtk96TZ-7RxyrmrrSEjGxOqUdQg0DzgHxMzFUx19D3vawj9M-0DbYZeHoyN9WMCWNu-91x4KT8BdxBGdzKdcvLZ9-PzaCUgMNc
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C5DA 0
0 577ms
276ms Fetch
image/gif 142.250.4.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstidZ2_-Lx77MCUC373O24XH-GHK0ZcAL2XB-X8YjXe4_XEZp6iyhz-MFi9ck07v9OvY3yUHCvhNtdXS8ZHadjaeNTcYl00AZnjg8C_96TJHhf5u6KtJn8vSWrdPjYhXgIW5ZizO_Dsow25skwQMQrrsqeWmKCVREbSEcDuNs7cFh__RcnMwpThEyX5rkXo2Y_Obsa2WIG_66Y061rFNXr7IosJguSv6HLyPB_jSQV5pxFFGzZIvppJVDPYV0HQmwyyxTXlB12dsGDmT4S6aZoUelHZFhGpXFZ2AKiihjfWV5u9nJQ2Pomic6v4T8eaznqO-Y2Rppg5_ew0BVr-GsRGKNkib-FvBf6PSdYz_RzKBTg1fVYtQuPOqeIYMM6bB9bPqySAl_6qOybKSIdTRKDymTYUSJYqhqiJq8uDjZQCxwNoH35M6wblHDpUZEdwW4KsDN4uIQOw3jMaRM0CIDGCaFEjVpzrejr3XuAbAy2mYozg2qfW8J6VmchdHaxHlDpLfKmT5wX1rNW7D08gl0OrfI_jodB--iWdDq93BD91C5WTvxht7XTelUGsKz3gvVJwR5iWh2eNv4STkBjLWpx4Y_Rt0vRvynGRBmjVhpHSJIyPu5Ct0zivQtlLJuq86NODugE00lYRg8JJUW55SeR5QCxFMkBHfl07rIdBcwuKWe80Bh7bQ7VP3afJxpmnWZc_X4YXHMc7GeDYcNVTqE46Db56YoJErS9zFffGc3R_nkZjq4lhha8WrE0_z3J9TtqaQQqfzjBj_plskwL2mbqm47eUA_W4kRjlUTVxPhey9Y6ceaGAC065PKfgxlDDRWa6XOIOR2c1ItJ8_c_aE2bNbMhkGlchTacSsvRyg-04XWj6pWrlAwmPfnqJdIe67rVwFxlEkAjIEA3RphZnk8OmDl8GKBH-_yBKXM0WwVjfjPcwVCL6VWgSNFXpxgspIwzwswr90ualXy2vOStUDb1m0pgFPD-SN4l97d9aPMGo3kX7HKAXJl3wQxVCdFGJrLJ5gXuUlzyi7J4-R50RNcI8KDHKkPbBQnrFHv6RZKX1gSW05wCVKDaTrz4MUuq0fwLzzVghQWnDf8cfImiKOFYOzBVBfEhAzPacrdbqW5sjtveUEOLzCq5DVJ-0FG6L-IAvre4AhlSmcH4RjntWxi5NHyYqHhbHWJ2QFqxew7zdlZkofZflZGx6yD_3vHaZxqFRBOrCD9Cq2XTzg16P2mBQ9n6v-IXGzsNFm5vjaPp91YrB_RdlqBEn62E4ctFJVqzLpBgj274ezz895gNvVK8speNIQFgSU7xyVGU&sai=AMfl-YQfl5Z6yA94qqki10bJRKJtTILi58nj4J0S65N06Gv3wDPdNe5crfKSKCwp-fiH_0dJMN0Eeid1RvMPIp76oRN4uXGvrmKkkaVYaeR6d5kKfs9wQmMT1NPrbzVDOOMBsNpKjYHVIRjDK5epG9pbxZcJPRlWnkH3vd1AEgdi4m7qBTHfSKbVgLvw-zF3uWEpxBic78nBzbVgJ0HFc6W5urQDsrazP5MvUC4qBMFmLQxodIjijx8lrRL4F6vqsphBQyXncSAEqoVnnQ&sig=Cg0ArKJSzBrIreRTtaX2EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2090&vt=11&dtpt=1041&dett=3&cstd=1045&cisv=r20221110.24729&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 22 Nov 2022 08:20:02 GMT

GET

setuid
px.ads.linkedin.com/ Frame E904
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LARY4Z9E-H-L3WZ

0
0

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame E904 0
0

GET

3fs9fmNyJhVHrNHLPUJ4ag
pr-bh.ybp.yahoo.com/sync/rubicon/ Frame E904
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/3fs9fmNyJhVHrNHLPUJ4ag?csrc=

0
0

GET dcm
s.amazon-adsystem.com/ Frame E904 0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame E904
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=54263d8c-323e-4ce9-8362-325b87be81e0&gdpr=0&gdpr_consent=&expires=30

42 B
678 B

616ms
237ms

Image
image/gif

69.173.158.64

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=54263d8c-323e-4ce9-8362-325b87be81e0&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Server: 69.173.158.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=54263d8c-323e-4ce9-8362-325b87be81e0&gdpr=0&gdpr_consent=&expires=30
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 289

GET

pixel
cm.g.doubleclick.net/ Frame E904
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEFSWTRaOUUtSC1MM1da

0
0

GET

pixel
cm.g.doubleclick.net/ Frame E904
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NzE5N2VlODA3MDFjMmFlMWU2Yzc3Nzk4YmMxMzBjZDk2NWI0MjBjYw

0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame E904
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEALFp4ytsdjsqAvnzhBNCjY&google_cver=1

42 B
678 B

641ms
237ms

Image
image/gif

69.173.158.64

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEALFp4ytsdjsqAvnzhBNCjY&google_cver=1
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Server: 69.173.158.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: d264e84c9dc1a645a3048554992c5d82
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEALFp4ytsdjsqAvnzhBNCjY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 CTA.png
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 10 KB
10 KB 279ms
278ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/CTA.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6531166c736ddb3cc04dac75a03a17b2d50583a422954d32ccd7367c085a312b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 08:29:57 GMT
x-content-type-options: nosniff
age: 85804
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10480
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 08:29:57 GMT

GET
H3 200 tg3.png
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 6 KB
6 KB 282ms
278ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/tg3.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad475a8c7025838d8a58d823d46d058fc5f6087c2a48a738ee03fc456cdb8b0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 08:29:58 GMT
x-content-type-options: nosniff
age: 85803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5807
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 08:29:58 GMT

GET
H3 200 phone.png
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 38 KB
38 KB 628ms
625ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/phone.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e77471aaae4af8f530bfce16fa6c05deb14f5fee3ca062fb79943c9036ec184d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 08:29:58 GMT
x-content-type-options: nosniff
age: 85803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38898
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 08:29:58 GMT

GET
H3 200 tg2.png
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 14 KB
14 KB 415ms
412ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/tg2.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2156ace275d25f176f984a1e40dd7390f865b11a3757043aadeaa6706131503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 02:56:02 GMT
x-content-type-options: nosniff
age: 19439
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13930
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 22 Nov 2023 02:56:02 GMT

GET
H3 200 tg1.png
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 10 KB
10 KB 569ms
567ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/tg1.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

079eba4ae7f82f5f41e51c09f2568b702e0f7ad48d40b9603268f3e2eb0fb438

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 08:29:58 GMT
x-content-type-options: nosniff
age: 85803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10431
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 08:29:58 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 12 KB
12 KB 495ms
493ms Image
image/png 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/logo.png

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8c91c402df140e28fe7097218d6e327517219e7a903807a596b544013879683

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 20:27:39 GMT
x-content-type-options: nosniff
age: 42742
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11964
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 20:27:39 GMT

GET
H3 200 image.jpg
s0.2mdn.net/sadbundle/14230181117062333496/ Frame 75E3 41 KB
41 KB 310ms
308ms Image
image/jpeg 142.250.4.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/14230181117062333496/image.jpg

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.4.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d653da5dd273c7364d148eb142012cfd61c6eebce1040d59f420020388fbc85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14230181117062333496/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 08:29:58 GMT
x-content-type-options: nosniff
age: 85803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42134
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 14:53:53 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 08:29:58 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F51E 0
20 B 286ms
284ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B1bopMIZ8Y_z8JM7cogO5347oAQAAAAA4AeAEAg&bg=!f3ylfDjNAAbvMpMzzzI7ACkAdvg8WqI6eqB3xNxybVkHFByC4QLa4opaq3PvKg_PRwY7uktA1h6fmQIAAACjUgAAAAJoAQcKADoK1PxQA_NvgM4IGI8AOnMZQdwDHmXO8v2EAAx5DVqWL3vpIjCMzPKQ70qlZ6keVDUB3h4Z7sLEP3thmQLn_lAff3Jh5Xra7nRIpfZuC1AgYhDhz2OznVf-PS94LRNsGGc3L7NIortII4VMH4YZX41qfcqJgAqlWCDxcdu1lxHV7dd165Fxwhvm9TSxO57OmDyzcpXksZgXMrYtoVRk6WnTL-EU3ci4aiIxOmtsccIjSUsKPN1uGgpw_dHx78ji00J0fTjQ37rBQU80h8rCGr6f24KDg7BxucJfbtf3gyAgHZR7-ZO_lK_mUaU-P7-Qcx4Sd_ubH-frEWqDV9KDx1rsBlpvR7NaFXQXz0bnoqodla3yujitd307aqfOAT-WsAPgfERJcS52_uIPFYKoWrYHAj2MbVMEFq8fllAq6XPl3bq79XPVOX5Z87xYXpFyzZcZ31FStmfc1C9hq_DcyOK3rdrgcSXwQ5_Rh89FNgp2_mIjF216--YsapfNX2dl0W0NFHHW2YKt6LzCVKmNQ60q27OgFdD4oa-c34t85khsYmdroqTqh_Oy7G_hAiT0M4o3i16-jxRMfakNkp4lCBQ-Un_opKRgqAbQdjkCFofWc61F6Lt_LSB0noB7qZik6IrNu3JD3UHUwP7qiPX9wAjb_Ygdofl3s1rcPjPKE1xpSGsSKuHCaT0QgonXaYku7oysw-i0EDcLydVVeCqBe7Dd6pop2Iia2mZreZ6EyeJPvSTNzuiRuG4TD-bT92WkoWUo-P0dOSKU8yQ3a7XdroMTzR5ecQtJoPnAUv8OOVkjpo6Fikp4IezF7-k9zGSfGZHhpaf07ptKV059f2TSdudcSwtf5zlLcRDKafsCjqbPApn-4gqi_W1mPUqHSleptr8nNo2jSXyS6--Or57ylcITPwAd9Alm655SGHprqGURVHXY0TnSmbooP5gAtexsmmJsWb70ZvanfyFVq7FPjvYBSPZ2J2wVqtrJj2hhtXwCd3nLeXfpUai6GqcpJ_rvrs_uT5Btb5bZTedizK379Vladzk-uceJzTZBCgVbdA6IlbbdgTw

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 206 file.mp4
r2---sn-ntq7ynle.c.2mdn.net/videoplayback/id/11f49df0cdbf9228/itag/59/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1700641200/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame 098F 623 KB
0 287ms
142ms Media
video/mp4 74.125.109.231

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.109.231 -, , ASN (),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: en-NZ,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

expires: Tue, 22 Nov 2022 08:20:02 GMT
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-1760819/1760820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1760820
last-modified: Thu, 07 Jul 2022 21:23:55 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com
client-protocol: quic

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B786 0
0 280ms
279ms Image
text/html 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221110&jk=2129156495938702&bg=!DA-lD0vNAAbvMpMzzzI7ACkAdvg8WtVfxLWvPmzM2khojOJsEd2l5vJGTU6rbko-gtV4-ijoVY6VYQIAAABgUgAAAAJoAQeZAsG7dKC0lq7UKE9FrXJLEVJXX2-Ia9DQDqT1odlIywpRXIo8ZXHelfiA6mSU7L0aZCy-Lj9W3xo_TrW5SPUQ0x2wL1va4HHndysBV7_FeAB0-SZN7hTpEgjvbatGJsNqz48Mi4hyYKjhcV2KRlZ-b5RcGGhJ-gmxsniXfHSg5pPC-K6OyE9l-Ygl_4TPCgYdTLq56s6OY6P2dSAh8t1exSEnEI1mWTfyG3FHx8j7qVw5cvyZE6GtrVg_WgjVlEq4T22lAdvON5Ejr63CVVKz6ORUgP0f7BvPWk17WuxRNZ6h8S1W-sZ6hWyAnW9vw3-JFzAr3b1NDhBmuQofX7m2IgoGbpyCZYnO7JBg9wsk0tPo4K5pzlrHQKoeD80FnCaH6UzlvV2D1vEUrKHOEoTuIik9_FbRW97Au4eMDita005xJMnkp7MBSrrH0PvN-2TmccC6xIbbNBlSJvLtn4lhTJyGTN_Kvc_JlNA0ZuzzqG0UtXmjfRXqriWqBZQtEtcHKuX04SVBbgBxoOMC38WSodrq1G0b3U1K00PQsObyiwnfkbSK9mLIrGWpyxKn6s_PXqwpEwZ56ehpwp5TFD8tpbPN19e21Grx-PZEPSTztS8dL1SzBudQw0VsmV5DpQ1gL_FaVSU3XRFy5jUUasQDlvedd_Zwrlhl8pM15ghJvwxjxiQHA0VS4b_pX-CCMDfpk7AHNEB3igIWejf7zEk3BYu1TGklnh7izFkvViZ3OZnApQC7Nz8B1O49qirguJb_j1MajsIw3AG8Q_JM7YEQEzxifyn2b8wKcnEiU4VD1PfaDqfo_zYRTlmQrx2GlU39993Hc8Vtab2YRz7LeGDwQuvGMsSof3953Lqd0bBtJnJPs0oZEwsXbn1jWtqxDCGnVmaBXMguR_-G_FUj_QFeldVteJ6kKSPyA8JaCJj45TdR9n0
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 74.125.130.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: sb-in-f155.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://www.bg3.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB5F
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhJ5sNU3mOF6YRtmDpSFZj0udZPmh-4etPQ

170 B
188 B

275ms
275ms

Image
image/png

142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhJ5sNU3mOF6YRtmDpSFZj0udZPmh-4etPQ

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABhJ5sNU3mOF6YRtmDpSFZj0udZPmh-4etPQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 200 711916.gif
id.rlcdn.com/ Frame BB5F 42 B
60 B 327ms
323ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

200

/
onetag-sys.com/match/ Frame BB5F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEBBaTERzBvYSYXufiyzEDOU&google_cver=1

0
340 B

397ms
392ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEBBaTERzBvYSYXufiyzEDOU&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEBBaTERzBvYSYXufiyzEDOU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame BB5F
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D0%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=32ff637c-8632-4000-9be6-feb0dba95266&gdpr=0&gdpr_consent=

0
340 B

406ms
393ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=32ff637c-8632-4000-9be6-feb0dba95266&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Tue, 22 Nov 2022 08:20:02 GMT
Server: MT3 169 32252b7 master hkg-pixel-x24 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=32ff637c-8632-4000-9be6-feb0dba95266&gdpr=0&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 22 Nov 2022 08:20:01 GMT

GET sync.php
pixel-eu.rubiconproject.com/exchange/ Frame BB5F 0
0

GET

/
onetag-sys.com/match/ Frame BB5F
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=5541281037779136794

0
0

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame BB5F 42 B
678 B 529ms
236ms Image
image/gif 69.173.158.64

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=pgJ7otcx4llsqX9IZf0Kv2h-KkStwOWHO-I0XJ5LNas
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame BB5F
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=7466185648118297708

0
340 B

393ms
392ms

Image
text/plain

51.79.234.100
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=7466185648118297708

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.79.234.100 Singapore, Singapore, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=7466185648118297708
date: Tue, 22 Nov 2022 08:20:01 GMT
content-length: 0

GET

ecm3
s.amazon-adsystem.com/ Frame BB5F
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=pgJ7otcx4llsqX9IZf0Kv2h-KkStwOWHO-I0XJ5LNas

0
0

GET

ImgSync
image8.pubmatic.com/AdServer/ Frame BB5F
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID&rdf=1

0
0

GET occ
ups.analytics.yahoo.com/ups/58488/ Frame BB5F 0
0

GET generic
match.adsrvr.org/track/cmf/ Frame BB5F 0
0

GET sync
x.bidswitch.net/ Frame BB5F 0
0

GET sync
ads.servenobid.com/ Frame BB5F 0
0

GET

rum
dsum-sec.casalemedia.com/ Frame A227
Redirect Chain

https://ad.turn.com/r/cs?pid=21
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=4453138422428063496

0
0

GET

crum
dsum-sec.casalemedia.com/ Frame A227
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=32ff637c-8632-4000-9be6-feb0dba95266

0
0

GET ie
match.prod.bidr.io/cookie-sync/ Frame A227 0
0

GET

rum
dsum-sec.casalemedia.com/ Frame A227
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=nSvLYJMuzmGGKcg1znnRNp99zjWGIM8znimChc3C

0
0

GET

crum
dsum.casalemedia.com/ Frame A227
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=d497a07c-2fe1-3e50-97d89082

0
0

GET

crum
dsum.casalemedia.com/ Frame A227
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=5541281037779136794

0
0

GET dcm
s.amazon-adsystem.com/ Frame A227 0
0

GET getuid
secure.adnxs.com/ Frame A227 0
0

GET sync
ads.servenobid.com/ Frame A227 0
0

GET
H2 200 PugMaster
image6.pubmatic.com/AdServer/ Frame A0F4 5 KB
6 KB 717ms
237ms Script
text/html 103.231.98.196

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=1374630&p=159463&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159463&userIdMacro=PM_UID&predirect=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3121068017444213000V10%26type%3Dpba%26refUrl%3D%26vid%3D91052013673121068017444213000V10%26ovsid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.231.98.196 -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 08:20:02 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 sync
ads.servenobid.com/ Frame DFD0 0
344 B 474ms
471ms Image
image/avif 54.75.88.22
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=1266141674757027051&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.75.88.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-75-88-22.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 08:20:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET

/
rtb-csync.smartadserver.com/redir/ Frame DFD0
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=32ff637c-8632-4000-9be6-feb0dba95266&gdpr=0&gdpr_consent=

0
0

GET /
dsp.adfarm1.adition.com/cookie/ Frame DFD0 0
0

GET /
rtb-csync.smartadserver.com/redir/ Frame DFD0 0
0

GET /
csync.loopme.me/ Frame DFD0 0
0

GET getuid
secure.adnxs.com/ Frame DD4A 0
0

GET

sync
a.sportradarserving.com/ Frame DD4A
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_c2f6e19b-d2ab-424e-a211-3fdd4c76c619&gdpr=0&gdpr_consent=&us_privacy=1---
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2

0
0

GET

usersync
usersync.gumgum.com/ Frame DD4A
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-0929ebc6-80f1-4a94-576a-7bb671d15cdd$ip$116.90.74.202

0
0

GET

23178
stags.bluekai.com/site/ Frame DD4A
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_c2f6e19b-d2ab-424e-a211-3fdd4c76c619&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=zJwkjmZuZ3OW2CBCIUg7&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...

0
0

GET

floor6
sync.1rx.io/usersync2/ Frame DD4A
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/floor6?zcc=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D&cb=1669105202721

0
0

GET rtset
bh.contextweb.com/bh/ Frame DD4A 0
0

GET redirectObuid
sync.outbrain.com/ Frame DD4A 0
0

GET

usersync
usersync.gumgum.com/ Frame DD4A
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=1267d016-3128-4c47-817a-ea5ea8a6e71a

0
0

GET gumgum
pr-bh.ybp.yahoo.com/sync/ Frame DD4A 0
0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame DD4A 0
0

GET services
sync.technoratimedia.com/ Frame DD4A 0
0

GET 142
match.deepintent.com/usersync/ Frame DD4A 0
0

GET server_match
ad.360yield.com/ Frame DD4A 0
0

GET sync
ssbsync.smartadserver.com/api/ Frame DD4A 0
0

GET sync
ads.servenobid.com/ Frame DD4A 0
0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 4EB9 34 KB
10 KB 269ms
269ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 59775916c5dc568fd4d2ea64b09d0b2d9def879f13d1a7382636cf70fe716c03

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 21 Nov 2022 20:11:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=42700
Connection: keep-alive
Content-Length: 10066
Expires: Tue, 22 Nov 2022 20:11:42 GMT

GET
H/1.1 200
OK usync.js
eus.rubiconproject.com/ Frame 080C 34 KB
10 KB 328ms
310ms Script
text/html 23.75.85.227
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.85.227 Central, Hong Kong, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-85-227.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=duration_media&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:02 GMT
Content-Encoding: gzip
Last-Modified: Mon, 21 Nov 2022 20:11:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=42700
Connection: keep-alive
Content-Length: 10066
Expires: Tue, 22 Nov 2022 20:11:42 GMT

GET oRTB
sync.inmobi.com/ Frame 59A4 0
0

GET
H2 200 user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 903B 15 KB
6 KB 304ms
278ms Document
text/html 184.51.240.213

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.240.213 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=168988
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 08:20:02 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 24 Nov 2022 07:16:30 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
unused62: 8096267
vary: Accept-Encoding

GET

usersync
usersync.gumgum.com/ Frame D99F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=54263d8c-323e-4ce9-8362-325b87be81e0

0
0

GET

usersync
usersync.gumgum.com/ Frame 25D9
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=32ff637c-8632-4000-9be6-feb0dba95266&gdpr=0&gdpr_consent=

0
0

GET

usersync
usersync.gumgum.com/ Frame 6970
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=atm&i=Y3yGMgAAAOjD2gAT&gdpr=0&gdpr_consent=

0
0

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame E84C 170 B
188 B 291ms
275ms Document
image/png 142.251.12.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV9jMmY2ZTE5Yi1kMmFiLTQyNGUtYTIxMS0zZmRkNGM3NmM2MTk=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.12.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: en-NZ,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Tue, 22 Nov 2022 08:20:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET um
cs.emxdgt.com/ Frame 2061 0
0

GET

usersync
usersync.gumgum.com/ Frame 1571
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=Y3yGMsCo8YQAAAwqKdUAAAAA

0
0

GET gumgum
cs.admanmedia.com/sync/ Frame BF0A 0
0

GET

usersync
usersync.gumgum.com/ Frame BC1E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
https://usersync.gumgum.com/usersync?b=iex&i=Y3yGK6bazl1kHW8nUishuQAA%264804

0
0

GET cm-notify
creativecdn.com/ Frame 6E6E 0
0

GET

usync.html
eus.rubiconproject.com/ Frame 986C
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

0
0

GET async_usersync
ib.adnxs.com/ Frame 77FB 0
0

GET
H2 200 dc_oe=ChMI_NTMtK3B-wIVTq5oCh25rwMdEAAYACD3659WOhoIsZDq7QIQyP7l1Z0EGNqurOEDIMLysJbeEEITCJ_tmLOtwfsCFZHgcwEdipEMiw;dc_rmcid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1m...
ade.googlesyndication.com/ddm/activity/ Frame 098F 42 B
269 B 281ms
274ms Image
image/gif 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_NTMtK3B-wIVTq5oCh25rwMdEAAYACD3659WOhoIsZDq7QIQyP7l1Z0EGNqurOEDIMLysJbeEEITCJ_tmLOtwfsCFZHgcwEdipEMiw;dc_rmcid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM;eps=CIBhEAEYHTICigI6AoBA;met=1;acvw=sv%3D941%26v%3D20221114%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D15061%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D463469255%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669105202651;dc_rfl=[URL_SIGNALS];ecn1=1;etm1=0;eid1=11;

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 098F 42 B
64 B 292ms
288ms Image
image/gif 74.125.200.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CvxzxLYZ8Y9-iKJHBz7sPiqOy2AjhqpCSbcLysJbeEJrZ4PvCLRABILqEwDNgq-yxheAYoAGwgquTAcgBBakC-v9Gyx-KpD6oAwHIA5sEqgScAk_Q4yODAGCpiPvgzSRgx9rKXR5L883toHc0d1DpRqpqXUuHSSPX7uoRGgP-j2T820BGOkvYWh_txvWio-kONveq3KqExvq-W3qbh3SJ93KqDIstZvNP89BLDRX5JHMYULYmDTyrGlrRybpp49z2T4c6YqwGdUnXuA7grl0bsGjPGHmDb0DRHvnGYqjPK4_OXOaXlZyAE3Hns8iMoPc75iwB_dFw0ePZjD7eJ_qtAtDk_FKIBtm55ePv1iIJeEEK35LN0lPzEZEIKw2CahbjTEuQ3T4iWZ3OjUukqmUVlEvzQQIJ8igQtFLETXiCdfF6muP7uNLSeAWGGarZ5lovXDHTrYLN2p72jcXLjN-MU9JREHU3fXcVXRnIeDdpwATI_uXVnQTgBAOQBgGgBnaAB7j91OwCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgH_56xAqgH35-xAtgHANIIDwiAYRABGB0yAooCOgKAQPIIG2FkeC1zdWJzeW4tNTIzOTkzODIxMzg3MDM4MIAKA8gLAeALAYAMAbAT9N6XEcgT2q6s4QPQEwDYEwqIFAPYFAHQFQH4FgGAFwE&sigh=XhZLJR7D1SA&label=part2viewed&ad_mt=7&acvw=sv%3D941%26v%3D20221114%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D15061%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D463469255%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669105202651

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.200.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET view
googleads4.g.doubleclick.net/pcs/ Frame 098F 0
0

GET
H/1.1 200
OK imp
www.adtrek.co/adserver/ Frame 098F 43 B
399 B 150ms
146ms Image
image/gif 3.104.150.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adtrek.co/adserver/imp?cc=d3807f8e-4148-43f4-8db8-7bed2a4989b9
Requested by: Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.104.150.39 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-104-150-39.ap-southeast-2.compute.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 22 Nov 2022 08:20:01 GMT
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43

GET

pixel
cm.g.doubleclick.net/ Frame 098F
Redirect Chain

https://googleads.g.doubleclick.net/xbbe/pixel?d=COXuopICELGQ6u0CGNTmtdcBIAEwAQ&v=APEucNXGtlBJ8atIX6-YHqXrdB_LYuhLWECbTAJdw5nAiIVIcG5Xk8GuLMTzCkOPIxhH4aK6RrU5jB7lVb6Ixdp81A1-E0WYcgKlSUjUAO25ISAZl6d...
https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm

0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 098F 0
20 B 282ms
278ms Image
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI_NTMtK3B-wIVTq5oCh25rwMdEAAYACD3659WOhoIsZDq7QIQyP7l1Z0EGNqurOEDIMLysJbeEEITCJ_tmLOtwfsCFZHgcwEdipEMiw;dc_rmcid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1m...
ade.googlesyndication.com/ddm/activity/ Frame 098F 42 B
107 B 279ms
275ms Image
image/gif 142.251.10.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_NTMtK3B-wIVTq5oCh25rwMdEAAYACD3659WOhoIsZDq7QIQyP7l1Z0EGNqurOEDIMLysJbeEEITCJ_tmLOtwfsCFZHgcwEdipEMiw;dc_rmcid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM;eps=CIBhEAEYHTICigI6AoBA;met=1;acvw=sv%3D941%26v%3D20221114%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D15061%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D463469255%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1669105202651;ecn1=1;etm1=0;eid1=200101;

Requested by

Host: www.bg3.co
URL: https://www.bg3.co/a/han-xing-liu-shi-yuan-ou-qi-jian-chi-wu-zui-kang-su-dao-di-wang-you-chao-bu-man.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 098F 0
0

GET /
googleads.g.doubleclick.net/pagead/interaction/ Frame 098F 0
0

POST csi
csi.gstatic.com/ Frame 098F 0
0

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C5DA 42 B
64 B 282ms
281ms Fetch
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvgz2tbkZ0n2rcd2OB8zZfyTyByvlyYoWyoZzim71d_Ay_lmbDY59PKjWY-dOZuSnaGnr21vAWz7jiSHaD4bilskAM_pEqqA4VNzXJ7JGmJGZk2d4dRVS0QAQ&sai=AMfl-YT5WVJ49gBcmwSVc3CaHlXDDUE2KVM0wKPyoFP2qZXJ-ToK8kH48NX6VYvZx-l4HrQZmffiy2vK7wnv7zFlQcUHMlFwQMxIZkLqVjn0GTq-XPzzPdbJBOpFDEFEYWo&sig=Cg0ArKJSzAIxVydsjKqfEAE&cid=CAQSPADq26N9CoSxXQM9w0XbT2zGurWZuzrkbD4l6vh48yLQOceqnLsxV9sy8wgWkcw4uT7oi1mSKeLG6qYvSxgBIBM&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2857874404&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669105198254&rpt=3473&isd=0&lsd=0&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-NZ,en;q=0.9
Referer: https://963be172e9da0a4e058c7c28797d4031.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 22 Nov 2022 08:20:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

cs
cs.minutemedia-prebid.com/ Frame 9E3A
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&redir=https%3A%2F%2Fcs.minutemedia-prebid.com%2Fcs%3Faid%3D21480%26id%3D$UID
https://cs.minutemedia-prebid.com/cs?aid=21480&id=3083974027286721561528

0
0

GET /
ssc-cms.33across.com/ps/ Frame 9E3A 0
0

GET 0
prebid.a-mo.net/cchain/ Frame 9E3A 0
0

GET minute_media
cs.admanmedia.com/sync/ Frame 9E3A 0
0

GET rmpssp
sync.1rx.io/usersync2/ Frame 9E3A 0
0

GET bsync
visitor.omnitagjs.com/visitor/ Frame 9E3A 0
0

GET 6185b9cf4d72f7e454746134b8c78716.gif
cs.krushmedia.com/ Frame 9E3A 0
0

GET services
sync.technoratimedia.com/ Frame 9E3A 0
0

GET server_match
ad.360yield.com/ Frame 9E3A 0
0

GET getuid
secure.adnxs.com/ Frame 9E3A 0
0

GET syncb
sync.bfmio.com/ Frame 9E3A 0
0

GET sync
rtb.mfadsrvr.com/ Frame 9E3A 0
0

GET redirectuser
ssp.disqus.com/ Frame 9E3A 0
0

GET pixel
ap.lijit.com/ Frame 9E3A 0
0

GET cm
u.openx.net/w/1.0/ Frame 9E3A 0
0

GET match
ads.betweendigital.com/ Frame 9E3A 0
0

GET occ
ups.analytics.yahoo.com/ups/58611/ Frame 9E3A 0
0

GET sync
ssbsync.smartadserver.com/api/ Frame 9E3A 0
0

GET rtset
bh.contextweb.com/bh/ Frame 9E3A 0
0

GET v1
match.sharethrough.com/universal/ Frame 9E3A 0
0

GET 3e1ed898b08f9e935ca99407796b46c0.gif
cs.iqzone.com/ Frame 9E3A 0
0

GET pbsync
ads.yieldmo.com/ Frame 9E3A 0
0

GET sync
x.bidswitch.net/ Frame 9E3A 0
0

GET usermatchredir
ssum-sec.casalemedia.com/ Frame 9E3A 0
0

GET ImgSync
image8.pubmatic.com/AdServer/ Frame 9E3A 0
0

GET us
sync.go.sonobi.com/ Frame 9E3A 0
0

GET sync
ads.servenobid.com/ Frame 9E3A 0
0

GET /
onetag-sys.com/usync/ Frame B563 0
0

GET 19fc6daa3a926256
ads.us.e-planning.net/uspd/1/ Frame A13B 0
0

GET

usync.html
eus.rubiconproject.com/ Frame 4D54
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=minute_media&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=minute_media&endpoint=us-east

0
0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C5DA 0
20 B 289ms
288ms Ping
image/gif 74.125.130.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4165528153484&version=m202209210101&ct=119&x=1&cor=4707248713885878000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

74.125.130.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS