www.thetrainline.com Open in urlscan Pro
92.123.22.177 Public Scan

Software

sffe /

Resource Hash

227fff75c4236d888dd7f5b7bdb52a1f7128ce90ca02e6e2b4c33a501ea4c89d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 14:21:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13355
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134395
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 08:39:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 14:21:34 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 173 B
753 B 156ms
53ms XHR
application/json 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.thetrainline.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-65-9-71-118.fra56.r.cloudfront.net

Software

cafe /

Resource Hash

4fb0178465c5f859c219255ef357c222cd43ca1086c907121c4938cceb7a8324

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117
x-xss-protection: 0
expires: Thu, 11 Aug 2022 18:04:09 GMT

GET
H2 200 6ba9830b2678.js Show response
w.usabilla.com/ 35 KB
11 KB 59ms
59ms Script
text/javascript 54.154.165.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://w.usabilla.com/6ba9830b2678.js
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.165.60 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-154-165-60.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3d3279475d7e8078b67ff97b445748175590a897f810ead18ef28438d4bf2a9a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
x-widget-server: 2.1
etag: "cab4cfc35bb208522afbcaac41fe752b"
content-type: text/javascript
cache-control: public,max-age=0
content-length: 10789

GET
H2 200 rvn-1.7.0.min.js Show response
cdn.ravelin.net/js/ 22 KB
9 KB 67ms
67ms Script
application/javascript 2a06:98c1:3120::c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ravelin.net/js/rvn-1.7.0.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e80d0b6fc2ed0d042de8d088bd1c5c3d616bdcb33c6135b3b91028e58c4afb7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash: crc32c=Boa1+A==, md5=iks21FbebZQCGBXutNi/rA==
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3164
x-guploader-uploadid: ADPycdszBEk1LKWOsVFyPlSwzyg2VaFxFh2exxCF_wMcRwPcXlBquQjMaPR574jre1JSyu5kxP4-6KShoh8kOCuclWE3izKJNSxT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 11 May 2022 10:53:23 GMT
server: cloudflare
etag: W/"8a4b36d456de6d94021815eeb4d8bfac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XGjWHcYbx5AI7PH1QHJ5adUdl4fdKIgdyhJkZVKYqByhufxgxJMo7bFNnBbO2O40ncG7n1pC3ftKtz36AykTpcn3NaXEeg94%2Fe3BjCcDO8uldKNwu%2Bygp5q7j1L8dGZmaIZ6iaoBLFiyMxNpsU8%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1652266403036817
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=14400
x-goog-stored-content-length: 22408
cf-ray: 7392e45eec5c3749-MXP
expires: Thu, 11 Aug 2022 18:07:14 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
314 B 39ms
39ms XHR
text/plain 65.9.71.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.thetrainline.com&pubid=e317e3cd-e152-432f-a52a-e77a2393a50c
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-118.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 16:58:18 GMT
via: 1.1 e39402e2cf62b31f7774452c905f38f2.cloudfront.net (CloudFront)
server: Server
age: 3951
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.thetrainline.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: T8FvEHrnUz_IzyZrCH2DprtSUWP_K-QzkdE5LDM5ZcS-uPz0fAuptw==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
496 B 81ms
80ms XHR
text/javascript 65.9.71.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.thetrainline.com%2Fbook%2Fresults%3FjourneySearchType%3Dsingle%26origin%3D1f06fc66ccd7ea92ae4b0a550e4ddfd1%26destination%3D6e0eedfa11eb5634e2b92630c6dd5400%26outwardDate%3D2022-08-14T13%253A03%253A00%26outwardDateType%3DdepartAfter%26passengers%255B%255D%3D1992-08-11%26utm_medium%3Demail%26utm_source%3DService%26utm_campaign%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26utm_content%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26selectExactTime%3Dtrue&pid=Vfxsz62RYmK7L&cb=0&ws=1600x1200&v=22.8.42053&t=2000&slots=%5B%7B%22sd%22%3A%22google_ads_iframe%2F8125220%2F300x250_mtf%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%228125220%2F300x250_mtf%22%7D%2C%7B%22sd%22%3A%22google_ads_iframe%2F8125220%2Fsearch_result_uk_lb_728x90_atf%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%228125220%2Fsearch_result_uk_lb_728x90_atf%22%7D%2C%7B%22sd%22%3A%22google_ads_iframe%2F8125220%2Fsearch_result_uk_lb_728x90_btf%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%228125220%2Fsearch_result_uk_lb_728x90_btf%22%7D%2C%7B%22sd%22%3A%22google_ads_iframe%2F8125220%2Fsearch_result_uk_lb_728x90_top%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%228125220%2Fsearch_result_uk_lb_728x90_top%22%7D%5D&pubid=e317e3cd-e152-432f-a52a-e77a2393a50c&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.71.118 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
via: 1.1 e39402e2cf62b31f7774452c905f38f2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C1
x-amz-rid: H801JMAFJ2T33J1T562X
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.thetrainline.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: wYGUQFCP-CAQrXGjcULL89jTa-Pu-WxOAQu_n7VCqqsJjjREjK9Lxg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 118ms
39ms XHR
application/javascript 65.9.71.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.71.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-71-118.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: JXufo2ctue2uysHllG2MRpKE8F0E4.a0
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 71436
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 03 Aug 2022 22:19:11 GMT
server: AmazonS3
date: Wed, 10 Aug 2022 22:13:34 GMT
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: bUkX4fDFTFid0F_H9UBVX2smKKm9lAOsese2NiAAtgvUyKIiNVf3rQ==

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 177 B
461 B 161ms
66ms XHR
application/json 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97551120a31b768832ec633d33187a4273e9f4073386de563b0df8ec285a052c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.thetrainline.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 7392e45fba6723f7-ZRH
access-control-allow-headers: Content-Type

GET
H2 200 branch-latest.min.js Show response
cdn.branch.io/ 76 KB
23 KB 143ms
46ms Script
text/javascript 108.138.17.80
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.17.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-17-80.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4da44a477817e0f69202f906a2f2c7b6f20a61dd6219f60d1a84143d8a9c5916

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: 3fanVx1GT8N8VPdFpaVetfknl_yorJlH
content-encoding: gzip
last-modified: Thu, 14 Jul 2022 21:43:50 GMT
server: AmazonS3
age: 37
etag: "8957cb48dc20586931302bb54fbaa61a"
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 fde85e7daa13f95cf6b8f5fa09c62ef6.cloudfront.net (CloudFront)
cache-control: max-age=300
date: Thu, 11 Aug 2022 18:03:32 GMT
x-amz-cf-pop: FRA56-P7
content-length: 23099
x-amz-cf-id: FFcbQ6GlKSt1mFcmzhtBAgO7idm1BDptxM92jTqhn1rO6aGXkVYrrQ==

GET
H2 200 Modals-homeResults.d65ee0fe9319c0286338.mjs Show response
www.thetrainline.com/public/js/ 45 KB
11 KB 61ms
60ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/Modals-homeResults.d65ee0fe9319c0286338.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

1c2eb71dd2456e0fb24e0f81d41f026f1588e5e409cd41a4289db1e864ef71fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Aug 2022 10:16:57 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31251193
accept-ranges: bytes
content-length: 11288
x-xss-protection: 1; mode=block
expires: Tue, 08 Aug 2023 10:57:22 GMT

GET
H2 200 Modals-options-Modals-optionsC-1413619420.ab32c614649ce3d674e4.mjs Show response
www.thetrainline.com/public/js/ 39 KB
12 KB 70ms
68ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/Modals-options-Modals-optionsC-1413619420.ab32c614649ce3d674e4.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

06f0919fd45a459fdebb19f7383b3cb188cc0974bda809bc638dde9eed57744f

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 13 Jun 2022 10:44:13 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=26412410
accept-ranges: bytes
content-length: 11585
x-xss-protection: 1; mode=block
expires: Tue, 13 Jun 2023 10:50:59 GMT

GET
H2 200 Modals-optionsCheckoutConfirma-2735905966.4cb984c9a0dbda83b84c.mjs Show response
www.thetrainline.com/public/js/ 15 KB
5 KB 93ms
91ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/Modals-optionsCheckoutConfirma-2735905966.4cb984c9a0dbda83b84c.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

aa3c06aaf947f0f5251a2e50b2f1219543eaa911c34ec953f657fd7519e7bf05

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Fri, 29 Jul 2022 13:33:20 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=30396725
accept-ranges: bytes
content-length: 4933
x-xss-protection: 1; mode=block
expires: Sat, 29 Jul 2023 13:36:14 GMT

GET
H2 200 Modals-results.d26c47e66bf1c777c8f2.css
www.thetrainline.com/public/public/css/ 4 KB
1 KB 80ms
79ms Stylesheet
text/css 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/public/css/Modals-results.d26c47e66bf1c777c8f2.css

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

6a1c80c626593bb2924f3eae6075747763a7ac295b07dd3cb0d98defff2e0ee3

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 25 May 2022 15:19:52 GMT
server: Akamai Resource Optimizer
strict-transport-security: max-age=600
content-type: text/css; charset=utf-8
cache-control: public, max-age=24786878
server-timing: cdn-cache; desc=HIT, edge; dur=1
accept-ranges: bytes
content-length: 876
x-xss-protection: 1; mode=block
expires: Thu, 25 May 2023 15:18:47 GMT

GET
H2 200 Modals-results.22019faa9a06f9cd2495.mjs Show response
www.thetrainline.com/public/js/ 71 KB
18 KB 101ms
100ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/Modals-results.22019faa9a06f9cd2495.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

126059645db316459ef15bb34c648cf8ff843d4be8cee2c9c7e287cf5e772c84

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 08 Aug 2022 10:16:57 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31251245
accept-ranges: bytes
content-length: 18421
x-xss-protection: 1; mode=block
expires: Tue, 08 Aug 2023 10:58:14 GMT

GET
H2 200 Modals-resultsOptions-Home.f763cec8d1a98ddbda79.mjs Show response
www.thetrainline.com/public/js/ 49 KB
13 KB 117ms
116ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/Modals-resultsOptions-Home.f763cec8d1a98ddbda79.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

bfc5a67fc4fa0eed69038415b4119ded5d55ab79720ae240011fc5ed5439735b

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Tue, 09 Aug 2022 10:04:19 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31336467
accept-ranges: bytes
content-length: 12959
x-xss-protection: 1; mode=block
expires: Wed, 09 Aug 2023 10:38:36 GMT

GET
H2 200 Modals-resultsOptions.90bf1aea1157d2f7f0b5.mjs Show response
www.thetrainline.com/public/js/ 8 KB
2 KB 141ms
140ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/Modals-resultsOptions.90bf1aea1157d2f7f0b5.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

c07cdb96b1004782d3ba1c3208818fa54a7fb13d5421af2dc186f615f393045d

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Fri, 29 Jul 2022 13:33:20 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=30396682
accept-ranges: bytes
content-length: 2299
x-xss-protection: 1; mode=block
expires: Sat, 29 Jul 2023 13:35:31 GMT

GET
H2 200 SmartContentBanner.57464a07c53c0fe88513.mjs Show response
www.thetrainline.com/public/js/ 9 KB
4 KB 60ms
59ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/SmartContentBanner.57464a07c53c0fe88513.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

2006175b1fed6974b9021d1ed30b819774b8a8b9f1550360ae4255031cb22bf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Fri, 29 Jul 2022 09:42:03 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=30382861
accept-ranges: bytes
content-length: 3359
x-xss-protection: 1; mode=block
expires: Sat, 29 Jul 2023 09:45:10 GMT

POST
H2 200 best-fare-finder-summary Show response
www.thetrainline.com/api/ 11 B
708 B 243ms
241ms Fetch
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/api/best-fare-finder-summary

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

7fb9d166d1a15bce0b9f085f3818946fd9297e4513a4a034a0ceb749292b4c0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
x-version: 4.7.22343
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-download-options: noopen
strict-transport-security: max-age=600
content-type: application/json; charset=utf-8
x-conversationid: dweb-377d8c78-4bcb-4732-aa19-2f28daaab994
cache-control: must-revalidate, private, max-age=0
server-timing: cdn-cache; desc=MISS, edge; dur=35, origin; dur=146
x-dns-prefetch-control: off
content-length: 11
x-xss-protection: 1; mode=block
expires: -1

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.32.0/ 335 KB
79 KB 56ms
56ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.32.0/otBannerSdk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8bd28fee94c800df636a486d42ed91d2df89db1fd3e223d5e89ce3d9dd107fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ryfZhYsqLisJEnBsOqgVsQ==
age: 3471
vary: Accept-Encoding
content-length: 81095
x-ms-lease-status: unlocked
last-modified: Fri, 18 Mar 2022 16:29:23 GMT
server: cloudflare
etag: 0x8DA08FC76466F7A
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 73661b59-d01e-0010-31f1-3aee00000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7392e460ea1dcc4a-ZRH

GET
H2 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
792 B 170ms
49ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.thetrainline.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 151ms
50ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thetrainline.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 116 KB
22 KB 439ms
437ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=586050460552526&correlator=1495889771141023&eid=44768682%2C44764002%2C31064018%2C31068919&output=ldjh&gdfp_req=1&vrg=2022080801&ptt=17&impl=fifs&iu_parts=8125220%2Csearch_result_uk_lb_728x90_top%2Csearch_result_uk_lb_728x90_atf&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=320x50%7C728x90%2C320x50%7C728x90&fluid=height%2Cheight&ifi=1&adks=2424477673%2C4093137006&sfv=1-0-38&fsfs=1%2C1&fsbs=1%2C1&fsapi=false&prev_scp=IsProdEnv%3Dtrue%26DestStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253ABWT3449gb%26OrigStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253APAD3087gb%26TransportMode%3DTrain%26OutboundHour%3D13%26OutboundDayWeek%3Dsun%26UserType%3Dguest%26NoOfAdults%3D1%7CIsProdEnv%3Dtrue%26DestStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253ABWT3449gb%26OrigStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253APAD3087gb%26TransportMode%3DTrain%26OutboundHour%3D13%26OutboundDayWeek%3Dsun%26UserType%3Dguest%26NoOfAdults%3D1&sc=1&cookie_enabled=1&abxe=1&dt=1660241049819&lmt=1660241049&dlt=1660241048369&idt=1369&adxs=239%2C239&adys=72%2C1085&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=1%7C2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.thetrainline.com%2Fbook%2Fresults%3FjourneySearchType%3Dsingle%26origin%3D1f06fc66ccd7ea92ae4b0a550e4ddfd1%26destination%3D6e0eedfa11eb5634e2b92630c6dd5400%26outwardDate%3D2022-08-14T13%253A03%253A00%26outwardDateType%3DdepartAfter%26passengers%255B%255D%3D1992-08-11%26utm_medium%3Demail%26utm_source%3DService%26utm_campaign%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26utm_content%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26selectExactTime%3Dtrue&frm=20&vis=1&psz=1121x0%7C827x0&msz=1121x0%7C827x0&fws=0%2C0&ohw=0%2C0&ga_vid=34019690.1660241050&ga_sid=1660241050&ga_hid=1189225630&ga_fc=false

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

aeaba1e173107e03dbae343f0b7169c298fb9a34ecca8652a122a917e8484b69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22178
x-xss-protection: 0
google-lineitem-id: 5802262024,5800970793
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138349291022,138349283333
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.thetrainline.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7784 6 KB
4 KB 202ms
48ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:10 GMT
expires: Fri, 11 Aug 2023 18:04:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 _r Show response
app.link/ 91 B
589 B 299ms
194ms Script
text/javascript 2600:9000:2057:3200:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.63.0&branch_key=key_live_fjJbpMuwlDMb5WbJwJDXoggcsxepngxM&callback=branch_callback__0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:3200:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty /

Resource Hash

71741a9aee8b40f35e7441374f3d4d3951038bcc129e2af4c7299593cdbfe90f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
via: 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
x-content-type-options: nosniff
server: openresty
x-amz-cf-pop: FRA6-C1
etag: W/"5b-rcqtJ26aZvKtN6L3Vysy0kWbXL0"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
content-length: 91
x-amz-cf-id: E6CO2Ix30GV7p66dSpYIEUMdaq650qJR7sj8bSngy3PlVymujwSV7Q==

POST
H2 201 oGfV1NVVY Show response
www.thetrainline.com/aYT_2/Ke/m-U/-3/8AGTe6eT/3z1ufwmz/IzwKAQ/d1/ 18 B
804 B 165ms
164ms XHR
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/aYT_2/Ke/m-U/-3/8AGTe6eT/3z1ufwmz/IzwKAQ/d1/oGfV1NVVY

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

bef9393fcdfc7a7299c058ba2a69253c32e0964dd3e97834e17a8cdb5dce7cf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-NewRelic-ID: UAcAUVNUGwcGUldRDwcO
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 11 Aug 2022 18:04:09 GMT
x-content-type-options: nosniff
access-control-allow-headers: Content-Type
strict-transport-security: max-age=600
content-type: application/json
access-control-allow-origin: https://www.thetrainline.com
access-control-allow-credentials: true
x_req_id: c9cbe8c7-2060-473f-b8a1-86a425c94a3e
server-timing: edge; dur=7, origin; dur=76, cdn-cache; desc=MISS
vary: Origin
content-length: 18
x-xss-protection: 1; mode=block

GET
H2 200 1660241049673 Show response
www.thetrainline.com/api/coaches/search/ 14 KB
4 KB 1188ms
1187ms Fetch
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/api/coaches/search/1660241049673

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

dc11e2e6db56fa56763c3e44c84cb12e4c86291573e303eb2822dbf786425468

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
x-version: 4.7.22343
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
x-conversationid: dweb-05112ad5-9e41-4e96-a195-975a71d51692
cache-control: must-revalidate, private, max-age=0
server-timing: cdn-cache; desc=MISS, edge; dur=31, origin; dur=1097
strict-transport-security: max-age=600
x-dns-prefetch-control: off
vary: Accept-Encoding
content-length: 2887
x-xss-protection: 1; mode=block
expires: -1

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/af9905cb-5054-4f35-8eac-90611a62f404/f87260e2-b193-4634-9c63-1e5657b61bf9/ 103 KB
21 KB 56ms
56ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/af9905cb-5054-4f35-8eac-90611a62f404/f87260e2-b193-4634-9c63-1e5657b61bf9/en.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9037a799ff3b0ffbfaab413f4281e143385b688a366ac4b9e90c56e2e724beed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 11 Aug 2022 18:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: OW3mu/uyCmzJPbIUS+/JxQ==
age: 891
vary: Accept-Encoding
content-length: 21427
x-ms-lease-status: unlocked
last-modified: Tue, 05 Apr 2022 14:05:34 GMT
server: cloudflare
etag: 0x8DA170D5A55CD7D
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f41ce220-c01e-0062-6f00-499f3e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7392e4622e6401db-ZRH
expires: Thu, 11 Aug 2022 22:04:09 GMT

GET
H2 200 otCenterRounded.json Show response
cdn.cookielaw.org/scripttemplates/6.32.0/assets/ 9 KB
3 KB 54ms
54ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.32.0/assets/otCenterRounded.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1da25cf82f065474aadce40a8c7369f6df48e1847cb95c21bd9083488eff7390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 1/jyRD3NFPea58Neu+wVyA==
age: 2787
vary: Accept-Encoding
content-length: 2585
x-ms-lease-status: unlocked
last-modified: Fri, 18 Mar 2022 16:29:15 GMT
server: cloudflare
etag: 0x8DA08FC7156585E
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 143d8539-201e-016c-2004-493560000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7392e4629f2801db-ZRH

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/6.32.0/assets/v2/ 48 KB
12 KB 60ms
54ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.32.0/assets/v2/otPcCenter.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25f5cc4a39b2d6a0d908fe93f98f6f4e9b9a821a35547dd7b19504150db76f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: uYlRueaFtS5mhOymjGWFow==
age: 1979
vary: Accept-Encoding
content-length: 11627
x-ms-lease-status: unlocked
last-modified: Fri, 18 Mar 2022 16:29:16 GMT
server: cloudflare
etag: 0x8DA08FC723EC22F
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 548c418f-c01e-00c8-6504-4949d1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 7392e462af3f01db-ZRH

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.32.0/assets/ 21 KB
4 KB 55ms
54ms Fetch
text/css 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.32.0/assets/otCommonStyles.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8edbd08b9bb87f815ad871e44aae03af609fc44b1961d608e94eff3f4e010375

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SHFDtZO2nDZuiPDW83p1IQ==
age: 2787
vary: Accept-Encoding
x-ms-lease-status: unlocked
last-modified: Fri, 18 Mar 2022 16:29:27 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 520b5739-f01e-00a6-1c04-49e0f8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 7392e462af4101db-ZRH

GET
H2 200 poweredBy_ot_logo.svg
cdn.cookielaw.org/logos/static/ 3 KB
2 KB 56ms
56ms Image
image/svg+xml 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: LpuayL42jB78xRllx0vkOw==
age: 8231
vary: Accept-Encoding
x-ms-lease-status: unlocked
last-modified: Thu, 11 Aug 2022 06:42:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6f89121c-401e-0051-5951-adc613000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 7392e4634d1fcc4a-ZRH

POST
H2 200 open Show response
api2.branch.io/v1/ 270 B
629 B 297ms
202ms XHR
application/json 2600:9000:206f:7c00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/open

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:7c00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

f44af189480e99a6ce395adf20b855f69ad1d8ec780d8b5c5f142ceeb182f4a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.thetrainline.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
x-branch-request-id: 52cae68f1b5e4826aac2dd5a23f1aaab-2022081118
content-length: 270
x-amz-cf-id: rPfi5iKncCw5OmNfxGec-tY3G1VQ37znk73eu1D0a_KcKXBl5NlUVQ==

GET
H2 200 nr-spa-1216.min.js Show response
js-agent.newrelic.com/ 49 KB
18 KB 93ms
34ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa-1216.min.js
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: UU.F5jvoumAjQChriwTQHbisCFw_OInU
content-encoding: gzip
etag: "63e2df852d15ab21d7ff8fc4363222e8"
x-amz-request-id: TPYXDQQSCRM2VG9H
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 18216
x-amz-id-2: ivqskMwgEm/G2RwaiFwO829LtO22JGV+t2hplRAwNe6bC71RVMO6fxAE7AUqtRMfxK6pZ70+XYA=
x-served-by: cache-lcy19263-LCY
last-modified: Thu, 14 Apr 2022 16:45:57 GMT
server: AmazonS3
x-timer: S1660241050.239385,VS0,VE0
date: Thu, 11 Aug 2022 18:04:10 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 4574

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 194ms
90ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022080801&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

620bd2a84f100a4df071f4c5493b5a577b33ce6ffbb49b4b72fa86be5ae3aadc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11134
x-xss-protection: 0

GET
H/1.1 200
OK 80752ce357 Show response
bam.nr-data.net/1/ 49 B
720 B 215ms
160ms Script
text/javascript 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/80752ce357?a=46663869&v=1216.487a282&to=YVxWMhRZW0JYBhVYXFgWcR4WSlBCSg8SHnRzbRtJTA%3D%3D&rst=2733&ck=1&ref=https://www.thetrainline.com/book/results&ap=94.044937&be=852&fe=2627&dc=1782&tt=75adc32d686db360&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1660241047535,%22n%22:0,%22r%22:0,%22re%22:522,%22f%22:522,%22dn%22:522,%22dne%22:522,%22c%22:522,%22ce%22:522,%22rq%22:523,%22rp%22:831,%22rpe%22:953,%22dl%22:834,%22di%22:1781,%22ds%22:1781,%22de%22:1782,%22dc%22:2625,%22l%22:2627,%22le%22:2639%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=1111&fcp=1111&at=TRtBRFxDF0l9ABdYUFNtTRYDGg8TXQASWkdZSRZKRHtaX00AGUV6UhsORAULAQddUlQDHldcUQRLDAMGDEgAAABSFFZeX14CCFhTUVNWUBtJGw%3D%3D&ja=%7B%22experimentsExperienced%22:%22OPTI-1068-0$1%22,%22experience%22:%22UK_TRAIN%22,%22buildVersion%22:%224.7.22343%22,%22ContextAliasId%22:%226ffc8ec1-af77-44fa-aff9-08f165f6fcd1%22,%22ConversationId%22:%22dweb-377d8c78-4bcb-4732-aa19-2f28daaab994%22%7D&jsonp=NREUM.setToken
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 18:04:10 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 7392e464996454ca-MAN

GET
H3 200 container.html Show response
77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B179 6 KB
3 KB 123ms
41ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:10 GMT
expires: Fri, 11 Aug 2023 18:04:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7735 6 KB
3 KB 115ms
43ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:10 GMT
expires: Fri, 11 Aug 2023 18:04:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 163ms
58ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 18:04:10 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame B179 22 KB
7 KB 90ms
41ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 17:20:51 GMT

GET rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame B179 0
0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 7735 22 KB
7 KB 90ms
44ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 17:20:51 GMT

GET rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7735 0
0

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
434 B 355ms
355ms XHR
application/json 2600:9000:206f:7c00:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:206f:7c00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Express

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.thetrainline.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
via: 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-branch-request-id: 3efceee1aea6443bb75d2f090d859fcc-2022081118
content-length: 28
x-amz-cf-id: 0Y883KUU6EE6V-eUoqx6d8Xpp8R1xX9mwTFgIVOyc4-ekOLzUT3y7A==

POST
H/1.1 204
No Content 80752ce357 Show response
bam.nr-data.net/ins/1/ 0
447 B 162ms
161ms XHR
text/plain 162.247.241.14
NEWRELIC-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/ins/1/80752ce357?a=46663869&v=1216.487a282&to=YVxWMhRZW0JYBhVYXFgWcR4WSlBCSg8SHnRzbRtJTA%3D%3D&rst=2963&ck=1&ref=https://www.thetrainline.com/book/results&at=TRtBRFxDF0l9ABdYUFNtTRYDGg8TXQASWkdZSRZKRHtaX00AGUV6UhsORAULAQddUlQDHldcUQRLDAMGDEgAAABSFFZeX14CCFhTUVNWUBtJGw%3D%3D
Requested by: Host: www.thetrainline.com
URL: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.thetrainline.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
content-type: text/plain

Response headers

Date: Thu, 11 Aug 2022 18:04:10 GMT
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Access-Control-Allow-Origin: https://www.thetrainline.com
access-control-allow-credentials: true
Connection: keep-alive
CF-Ray: 7392e465ac1b54ca-MAN

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B179 0
0 78ms
78ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvOSrRJ98xeyBt_Yxx8epXGGQCFNZIoDNxkM3CpXfaxkrPZqcPrIDrsTc3AR3sHrhdSMLF-jeCjI3wIuXofHxVErRA4-9sT9ABajZ75omWHa_I4KpHNxH2zxMRbUKDR7YnqyDod-Z3IU7uQtb7-sz9_iikHDDh8y6GvlhAdsG0gcOOK6pnz3QYG5BWxDNPxKQVZb0aeRVLaiRk83WvXK0wlJSsLV0A5oC3wJDap2WoRvcPOEZJaPzvPkttFeKjfSX_v2mfRl9OMV3N9756-OuqxIie2vG0tRzN1fS9iCx9cdqE4Nyq9N_0XulZbwF90YCJ0WPOIvjUksc7pPjFjHog2opfKFaOajvNAcg&sai=AMfl-YT5d34TTZfhM47LCZRE9DEQzf4YBol7oHDbbmMrwkEHatMmPWaEK81pVumZPfc72AAWpipK6PbyGmD6aJLhCDe6JD1V_Q4Ty76pmXavZ7s&sig=Cg0ArKJSzMTIqUrz_ECvEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 18:04:10 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame B179 83 KB
28 KB 55ms
55ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f95f7ad3aacb4b1873a3163b38330288e64a807d46eb7a051a6bf7761e36ebe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28667
x-xss-protection: 0
server: sffe
etag: "1300 / 214 of 1000 / last-modified: 1660215907"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 11 Aug 2022 18:04:10 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7735 0
0 79ms
79ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv_AUwZYW034Wo_QONycdvISgNMhwlUmj52sR_sQVtNXnrnAvKaA_r5eOSnFcXkBNWpjOOyy3zulFKQNQfbt7V9gvYA24RDIZVJru4PMLNdexwCSa91yGtpB6WPtemyHXMnPeoROHG2bKvJilgldged82LC2AAswEq_wHxSpPB40tFt5-xrskBmGBfN8AXZXNPNzklmM-TL4p33J3EcBFozfwQGkGb9_szdJdAwo-7Qx86Co7e44xj8IxmqCRlxWIh0YBUA_D1PV23KjaE_bkLb_cF-Ij4FjqeUmN0Pk-a0cVGZGCtGA6_A6tbvNowELqE6u-92E6IfiPChjAWK4cfaDJ3gzweG0pDI1Q&sai=AMfl-YTrG9PqxrELUUCbUGHSzVzDIIHE1Z3hN85MDB6FlWgq0HPUtDPTgnbKNQExKZeZLxuoKd0AhAh6rdCQTID9OTibZQ0eM2dLPHRaB2vZG1M&sig=Cg0ArKJSzB6AveZaeqA6EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 18:04:10 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 7735 83 KB
28 KB 71ms
71ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dbf6da1f8bc04465e37a2b995c06ba6c0aa869cfb3f0f31ac82e7625c2f07fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28665
x-xss-protection: 0
server: sffe
etag: "1300 / 977 of 1000 / last-modified: 1660215855"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 11 Aug 2022 18:04:10 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 841D 13 KB
5 KB 127ms
41ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 2451
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 17:23:19 GMT
expires: Fri, 11 Aug 2023 17:23:19 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A4B2 783 B
1 KB 140ms
51ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3b5fc57607321f12f4b2e03492f058a2ed38f04c76898fb7444a087a76738805

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h2x3sI-wMkKvsV6AZ-_1Bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-h2x3sI-wMkKvsV6AZ-_1Bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:10 GMT
expires: Thu, 11 Aug 2022 18:04:10 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl_2022080801.js Show response
securepubads.g.doubleclick.net/gpt/ Frame B179 385 KB
131 KB 40ms
40ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js?cb=31068869

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

227fff75c4236d888dd7f5b7bdb52a1f7128ce90ca02e6e2b4c33a501ea4c89d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 08:01:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36131
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134395
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 08:39:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 08:01:59 GMT

GET
H2 200 shareable-carbon-calculation-en-gb-translations.17c9e543c8dbcab53367.mjs Show response
www.thetrainline.com/public/js/ 948 B
497 B 61ms
60ms Script
application/javascript 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/public/js/shareable-carbon-calculation-en-gb-translations.17c9e543c8dbcab53367.mjs

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

218919fe59395db877635ccaadbb359f37e381962e27cdf0e613c93f509e21b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true&selectedOutward=3SiDUGnAe9E%3D%3AHD14vN1cFc0%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:10 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Fri, 13 May 2022 13:51:04 GMT
strict-transport-security: max-age=600
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=23748122
accept-ranges: bytes
content-length: 263
x-xss-protection: 1; mode=block
expires: Sat, 13 May 2023 14:46:12 GMT

GET
H2 200 8b4c6b81-d437-4b83-a274-c7ece10e1e75 Show response
www.thetrainline.com/api/alternative-details/348e56ba-92d0-4ff9-9909-70796f04985d/ 253 B
951 B 307ms
307ms Fetch
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/api/alternative-details/348e56ba-92d0-4ff9-9909-70796f04985d/8b4c6b81-d437-4b83-a274-c7ece10e1e75

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

9ada45da767396536dfd24102cba53c0f378590f80ca9b02095c3e0764389f4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true&selectedOutward=3SiDUGnAe9E%3D%3AHD14vN1cFc0%3D
x-version: 4.7.22343
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-download-options: noopen
strict-transport-security: max-age=600
content-type: application/json; charset=utf-8
x-conversationid: dweb-2dd6c522-db13-4b67-8720-ad653e2030a9
cache-control: must-revalidate, private, max-age=0
server-timing: cdn-cache; desc=MISS, edge; dur=29, origin; dur=216
x-dns-prefetch-control: off
content-length: 253
x-xss-protection: 1; mode=block
expires: -1

POST
H2 200 price-search-selection Show response
www.thetrainline.com/api/basket/ 1 KB
1 KB 470ms
470ms Fetch
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/api/basket/price-search-selection

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

01be9b2ec5c3538e87db92766ed99d318cebf897e9b2b20445f8f011a1df29d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true&selectedOutward=3SiDUGnAe9E%3D%3AHD14vN1cFc0%3D
x-version: 4.7.22343
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
x-conversationid: dweb-53b347d7-7c23-4ca7-8d63-df86aaaa6f2a
cache-control: must-revalidate, private, max-age=0
server-timing: cdn-cache; desc=MISS, edge; dur=47, origin; dur=349
strict-transport-security: max-age=600
x-dns-prefetch-control: off
vary: Accept-Encoding
content-length: 538
x-xss-protection: 1; mode=block
expires: -1

GET
H2 200 8b4c6b81-d437-4b83-a274-c7ece10e1e75 Show response
www.thetrainline.com/api/alternative-details/348e56ba-92d0-4ff9-9909-70796f04985d/ 253 B
942 B 279ms
277ms Fetch
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/api/alternative-details/348e56ba-92d0-4ff9-9909-70796f04985d/8b4c6b81-d437-4b83-a274-c7ece10e1e75

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

9ada45da767396536dfd24102cba53c0f378590f80ca9b02095c3e0764389f4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true&selectedOutward=3SiDUGnAe9E%3D%3AHD14vN1cFc0%3D
x-version: 4.7.22343
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-download-options: noopen
strict-transport-security: max-age=600
content-type: application/json; charset=utf-8
x-conversationid: dweb-0e828445-b7f2-40b8-97da-bc5c8819e54b
cache-control: must-revalidate, private, max-age=0
server-timing: cdn-cache; desc=MISS, edge; dur=84, origin; dur=123
x-dns-prefetch-control: off
content-length: 253
x-xss-protection: 1; mode=block
expires: -1

POST
H2 200 price-search-selection Show response
www.thetrainline.com/api/basket/ 1 KB
1 KB 551ms
550ms Fetch
application/json 92.123.22.177
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thetrainline.com/api/basket/price-search-selection

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.123.22.177 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-22-177.deploy.static.akamaitechnologies.com

Software

Resource Hash

7ce4a63003ad66432193e3cf3ae6d4d1234264e9240f4ed6bbc73b2097ce4f48

Security Headers

Name	Value
Strict-Transport-Security	max-age=600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://www.thetrainline.com/book/results?journeySearchType=single&origin=1f06fc66ccd7ea92ae4b0a550e4ddfd1&destination=6e0eedfa11eb5634e2b92630c6dd5400&outwardDate=2022-08-14T13%3A03%3A00&outwardDateType=departAfter&passengers%5B%5D=1992-08-11&utm_medium=email&utm_source=Service&utm_campaign=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&utm_content=TL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi&selectExactTime=true&selectedOutward=3SiDUGnAe9E%3D%3AHD14vN1cFc0%3D
x-version: 4.7.22343
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
x-conversationid: dweb-d1e2f550-4a14-4430-8692-10e28aae1ea5
cache-control: must-revalidate, private, max-age=0
server-timing: cdn-cache; desc=MISS, edge; dur=106, origin; dur=386
strict-transport-security: max-age=600
x-dns-prefetch-control: off
vary: Accept-Encoding
content-length: 538
x-xss-protection: 1; mode=block
expires: -1

POST
H2 200 fingerprint Show response
api.ravelin.net/v2/ 0
677 B 223ms
89ms XHR
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.ravelin.net/v2/fingerprint?source=browser&key=pk_live_2t8w8n2JnXLYrwkx51sgdriy7r2dfRHE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.thetrainline.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=2592000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 598
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P3RBT9SLpDa0mABloqZpHuUlVdP9jZsk%2FyMKIqgldjDI1cEGkU61uqaQ9wL4XoMxMOmZXhhAnVqEW3XUd3kYxur8bHZozNcTfVNzH2uUaUa%2Bndry8paQz%2FmNHDw8cQKY33Ad8lGOOodT3P2FfqQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
x-ratelimit-reset: 1660241111
x-ratelimit-limit: 600
trace-id: 7fffffff9d0abb640270b6bdd-0e2ce25c-d47a-48dc-41e7-c986cc9bf965
cf-ray: 7392e46acc47bb1a-MXP

POST
H2 200 fingerprint Show response
api.ravelin.net/v2/ 0
320 B 224ms
90ms XHR
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.ravelin.net/v2/fingerprint?source=browser&key=pk_live_2t8w8n2JnXLYrwkx51sgdriy7r2dfRHE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.thetrainline.com/
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=2592000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 599
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Kr9QI4SYnQw7FLY0ASWn6owt3L0HMQAyhTJiNRV8LzTwpv948HvG%2BzFoJBHEIKZUx02Sqp1wv4ofIuT42%2Bv8xxoHIZ0%2BlL1ErqrMWb4UD%2FUrq5uv9eNydIEBk0ZRiv90AC3om8TlAkc2HNDuLc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
x-ratelimit-reset: 1660241111
x-ratelimit-limit: 600
trace-id: 7fffffff9d0abb6402716c2a9-04d2cf6f-08c6-4032-4e52-78e90ddc4d3f
cf-ray: 7392e46acc49bb1a-MXP

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ 107 B
122 B 131ms
49ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=www.thetrainline.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 132ms
50ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thetrainline.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 57 KB
20 KB 506ms
506ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=586050460552526&correlator=2595588835863792&eid=44768682%2C44764002%2C31064018%2C31068919&output=ldjh&gdfp_req=1&vrg=2022080801&ptt=17&impl=fifs&iu_parts=8125220%2Csearch_result_uk_lb_728x90_top&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90&fluid=height&ifi=3&adks=2424477673&sfv=1-0-38&fsfs=1&fsbs=1&ris=1&rcs=1&fsapi=false&prev_scp=IsProdEnv%3Dtrue%26DestStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253ABWT3449gb%26OrigStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253APAD3087gb%26TransportMode%3DTrain%26OutboundHour%3D13%26OutboundDayWeek%3Dsun%26UserType%3Dguest%26NoOfAdults%3D1&eri=1&sc=1&cookie=ID%3D7d66c1e1bc863542%3AT%3D1660241049%3AS%3DALNI_MZEgZV4C0MxSQ6k9lGBU8heph_2HQ&abxe=1&dt=1660241051216&lmt=1660241051&dlt=1660241048369&idt=1369&adxs=436&adys=92&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.thetrainline.com%2Fbook%2Fresults%3FjourneySearchType%3Dsingle%26origin%3D1f06fc66ccd7ea92ae4b0a550e4ddfd1%26destination%3D6e0eedfa11eb5634e2b92630c6dd5400%26outwardDate%3D2022-08-14T13%253A03%253A00%26outwardDateType%3DdepartAfter%26passengers%255B%255D%3D1992-08-11%26utm_medium%3Demail%26utm_source%3DService%26utm_campaign%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26utm_content%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26selectExactTime%3Dtrue%26selectedOutward%3D3SiDUGnAe9E%253D%253AHD14vN1cFc0%253D&frm=20&vis=1&psz=1121x90&msz=1121x90&fws=4&ohw=1600&psts=AEC3cPJafmb5VqcIdN7McxFj0OKcDXsMjiHYAek6UBu_GPgkRDn6gv1mJeS_KFzVZLrCRu_vtTEAEbirW2q_J44DdI3qVr9k&ga_vid=34019690.1660241050&ga_sid=1660241050&ga_hid=1189225630&ga_fc=false

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b86b4e0bc07c7c9790ff7185e27802797859e95066bdd1f78741f504d2ebf423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20140
x-xss-protection: 0
google-lineitem-id: 5802262024
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138349291019
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.thetrainline.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 779ms
778ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=586050460552526&correlator=1546944901008986&eid=44768682%2C44764002%2C31064018%2C31068919&output=ldjh&gdfp_req=1&vrg=2022080801&ptt=17&impl=fifs&iu_parts=8125220%2Csearch_result_uk_lb_728x90_atf&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90&fluid=height&ifi=4&adks=4093137006&sfv=1-0-38&fsfs=1&fsbs=1&ris=1&rcs=1&fsapi=false&prev_scp=IsProdEnv%3Dtrue%26DestStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253ABWT3449gb%26OrigStatCd%3Durn%253Atrainline%253Ageneric%253Aloc%253APAD3087gb%26TransportMode%3DTrain%26OutboundHour%3D13%26OutboundDayWeek%3Dsun%26UserType%3Dguest%26NoOfAdults%3D1&eri=1&sc=1&cookie=ID%3D7d66c1e1bc863542%3AT%3D1660241049%3AS%3DALNI_MZEgZV4C0MxSQ6k9lGBU8heph_2HQ&abxe=1&dt=1660241051226&lmt=1660241051&dlt=1660241048369&idt=1369&adxs=289&adys=1233&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.thetrainline.com%2Fbook%2Fresults%3FjourneySearchType%3Dsingle%26origin%3D1f06fc66ccd7ea92ae4b0a550e4ddfd1%26destination%3D6e0eedfa11eb5634e2b92630c6dd5400%26outwardDate%3D2022-08-14T13%253A03%253A00%26outwardDateType%3DdepartAfter%26passengers%255B%255D%3D1992-08-11%26utm_medium%3Demail%26utm_source%3DService%26utm_campaign%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26utm_content%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26selectExactTime%3Dtrue%26selectedOutward%3D3SiDUGnAe9E%253D%253AHD14vN1cFc0%253D&frm=20&vis=1&psz=827x90&msz=827x90&fws=4&ohw=1600&psts=AEC3cPJwHwJwMUIDdtKw_HW7tdS2cPbiAwhO1hUxBWSG_3Cw_H10FfleNVK1cKiLuB7Nu6Go9E78togQhtwyytO_77K6swus&ga_vid=34019690.1660241050&ga_sid=1660241050&ga_hid=1189225630&ga_fc=false

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

388c4640467638bc14a3846d2e96cf4fc9bb2137ddf3ad0d288385d98c7dd86a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9688
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.thetrainline.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_2022080801.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 7735 385 KB
131 KB 40ms
40ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

227fff75c4236d888dd7f5b7bdb52a1f7128ce90ca02e6e2b4c33a501ea4c89d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 14:21:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13357
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134395
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 08:39:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 14:21:34 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ Frame B179 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js?cb=31068869

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame B179 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js?cb=31068869

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A4B2 0
0 156ms
74ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022080801&jk=586050460552526&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET ads
securepubads.g.doubleclick.net/gampad/ Frame B179 0
0

GET
H2 200 container.html Show response
d435c4f3c3e9bd20d05362b70d4b3627.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 83CE 6 KB
3 KB 64ms
49ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d435c4f3c3e9bd20d05362b70d4b3627.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js?cb=31068869

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:11 GMT
expires: Fri, 11 Aug 2023 18:04:11 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js Show response
pagead2.googlesyndication.com/bg/ Frame 841D 36 KB
14 KB 82ms
40ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

749b6261f109108d21cb0e7043f83ff0d94a46c1dd8dad8965e6794fd345d238

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:22:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2529
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14301
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Aug 2023 17:22:02 GMT

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ Frame 7735 107 B
122 B 51ms
50ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 7735 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 7735 17 KB
9 KB 582ms
581ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=769034728045538&correlator=1105238740903503&eid=31068458%2C31068854&output=ldjh&gdfp_req=1&vrg=2022080801&ptt=17&impl=fifs&tfcd=0&iu_parts=8125220%2Csearch_result_uk_lb_728x90_atf&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90&fluid=height&ifi=1&adks=185592814&sfv=1-0-38&fsapi=false&prev_scp=in2w_key9001%3D1%26deststatcd%3Durn%253Atrainline%253Ageneric%253Aloc%253ABWT3449gb%26isprodenv%3Dtrue%26noofadults%3D1%26origstatcd%3Durn%253Atrainline%253Ageneric%253Aloc%253APAD3087gb%26outbounddayweek%3Dsun%26outboundhour%3D13%26transportmode%3DTrain%26usertype%3Dguest%26in2w_key%3D258%26in2w_key2%3Dnope%2Cbenchmark%26in2w_key3%3Dnop%26in2w_key4%3Dnop%26in2w_key5%3Dbenchmark%26in2w_key6%3D--1---%26in2w_key7%3D661%26in2w_key8%3D258%26in2w_key9%3Dbenchmark_request%26in2w_key12%3Dbenchmark%26in2w_key15%3Db0%26in2w_key16%3D1&eri=4&sc=1&cdm=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com&abxe=1&dt=1660241051385&dlt=1660241050426&idt=943&adxs=0&adys=0&biw=728&bih=180&isw=728&ish=90&scr_x=0&scr_y=0&ucis=kjput5yyro0o&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fwww.thetrainline.com%2Fbook%2Fresults%3FjourneySearchType%3Dsingle%26origin%3D1f06fc66ccd7ea92ae4b0a550e4ddfd1%26destination%3D6e0eedfa11eb5634e2b92630c6dd5400%26outwardDate%3D2022-08-14T13%253A03%253A00%26outwardDateType%3DdepartAfter%26passengers%255B%255D%3D1992-08-11%26utm_medium%3Demail%26utm_source%3DService%26utm_campaign%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26utm_content%3DTL_L_EMAIL_Trg_en_GB_20Q3_S_T_RealtimeDisruptionsAdv_AdvancedCancel_Multi%26selectExactTime%3Dtrue&loc=https%3A%2F%2F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&top=www.thetrainline.com&etu=AF19uuV_9W5l_3DY1OSTxqY6GATbgyqEd9w3YKcIX5nH8Hz5pzaT6zk2ZskWRz4LQE8CF-c9LKUKLlA_8rL6QaUnkSn-XaLjn-62OlB5mYXqS0LBjsp2Fxqvv8cxq_809c_yGUzlSZliYJ565GpVZpkcNVQic1Nyt5LLzeqzPDeQXQlCwV5vA_xLYcIOD_2mIzHeUMTQRJ0QZr7FX0i971UJDNVNUVFLZnZW9XByeST6zfe-YL2DfOiSqywWkb2yxTUQd4ioaa3mp8Rzk20qfNZJdsJSIgydXSwZnQgwAvKxbDTv5B_8ByM6EAxqqDReD9zxJ70-_DuQy-vWMXxpP0XYg0Oi0Y78bCxJBPops_b867HP7xnbeUkUf7LqMMFQaJLqrt9OXfOB2jR204txLQBJPZOXeWJbtiQhjBxjWgAah4KGBiukoEppdz_hctYXohqlmE1LjcDc0IkWzdmnIlL9_jX7UIrYljfqF-MqhpojuZKKfO6x7sGbSTM-L-_NHyIFMt6IH7adsyGVdv2A0WF-utQnTWmARzQMU9Sfmt1ISqv_LLVDoSOpd1JHoo62UEXb96bG6j22uXHgELJLtyJaUsM5ZdkRmUV9PJfPMOpRsRhJgk63oa1gOsvGMYGRTaGfOeZhS_jy7yG5F1e-J1htzZyIb78tzuA2XU5s&frm=24&vis=1&psz=728x0&msz=728x0&fws=256&ohw=0&ea=0&ga_vid=2079803721.1660241051&ga_sid=1660241051&ga_hid=614868665&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e290f03633a8af8a0a8df6004f4a35a6a229448990b612e9b7d97f3d5958536a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9648
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
380d142c458c0f4c6629324107595dd5.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 46BF 6 KB
3 KB 111ms
49ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://380d142c458c0f4c6629324107595dd5.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:11 GMT
expires: Fri, 11 Aug 2023 18:04:11 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 841D 0
10 B 40ms
40ms Image
text/plain 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?7WECOA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 container.html Show response
77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4CC7 6 KB
3 KB 41ms
40ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:10 GMT
expires: Fri, 11 Aug 2023 18:04:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 4CC7 22 KB
7 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:20:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2600
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 17:20:51 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4CC7 140 KB
43 KB 1552ms
1552ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75bf5c0112a41f871dc47c5e98deef6dc7db8e94178bf0c853f3a09415f6d338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44015
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660137096112928"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4CC7 0
0 77ms
76ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssqGkLZZvz5ZpznLVM2rVCQ5z-9Df0Dpp_uNlisp17nrsLhEuquoEmf48wS-jdc219ymgl8cOb1T5Z0Sj044eDAk6W1BpbGIgF27iWAEUTZpn-v1dtVTT_E8pTh9090bvG4Q8EaJ777Do14w5XouGWQQjx-Gjog8vqggDrhRZnPczFiZtx0CbAZ0SM9m3X69RjU5SU46T1mFT0clbQmxEfMzTQb1jlrLWPasOZUBCD0XaVPVuE1BoDUuyiy3jr80hfCMfaWrDtB4-nqPEuH3lI033D9G7tGVv5RcMxrxCQDUKbZeocjQvs9kVhrAYVODXwZ4-BoarTIVXRPoN3GOmWP5NxMfkrFOUODMQ&sai=AMfl-YQm_su6vaz6LxB65P4wEJxgIT33XFPdRQO_9n8Mvp6aJqJYoAt4fVdBx19eNTtuzc-zJkW73Are7RtB1b8SLBZDJ9ka4rOM7TjM65Lf9BBT2GwcfH0CjIJKLPfqpw&sig=Cg0ArKJSzNnycamqd_qJEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:11 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 4CC7 83 KB
28 KB 63ms
63ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dbf6da1f8bc04465e37a2b995c06ba6c0aa869cfb3f0f31ac82e7625c2f07fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28665
x-xss-protection: 0
server: sffe
etag: "1300 / 666 of 1000 / last-modified: 1660215855"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 11 Aug 2022 18:04:11 GMT

GET
H3 200 pubads_impl_2022080801.js Show response
securepubads.g.doubleclick.net/gpt/ Frame 4CC7 385 KB
131 KB 40ms
40ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

227fff75c4236d888dd7f5b7bdb52a1f7128ce90ca02e6e2b4c33a501ea4c89d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 14:21:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13357
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134395
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 08:39:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 11 Aug 2023 14:21:34 GMT

GET container.html
380d142c458c0f4c6629324107595dd5.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CD6A 0
0

GET
H3 200 container.html Show response
77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 915D 6 KB
3 KB 40ms
40ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thetrainline.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:10 GMT
expires: Fri, 11 Aug 2023 18:04:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.co.uk/adsid/ Frame 4CC7 107 B
122 B 52ms
52ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.uk/adsid/integrator.js?domain=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 4CC7 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 4CC7 29 KB
12 KB 544ms
544ms XHR
text/plain 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3854577614264952&correlator=4344651110677185&eid=31068520&output=ldjh&gdfp_req=1&vrg=2022080801&ptt=17&impl=fifs&tfcd=0&iu_parts=8125220%2Csearch_result_uk_lb_728x90_top&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90&fluid=height&ifi=1&adks=2979707800&sfv=1-0-38&fsapi=false&prev_scp=in2w_key9001%3D1%26deststatcd%3Durn%253Atrainline%253Ageneric%253Aloc%253ABWT3449gb%26isprodenv%3Dtrue%26noofadults%3D1%26origstatcd%3Durn%253Atrainline%253Ageneric%253Aloc%253APAD3087gb%26outbounddayweek%3Dsun%26outboundhour%3D13%26transportmode%3DTrain%26usertype%3Dguest%26in2w_key%3D314%26in2w_key2%3Dnope%2Coptimization%26in2w_key4%3D--1---%2C--1---%26in2w_key5%3Doptimization%26in2w_key6%3D--1h--qgz%26in2w_key7%3D661%26in2w_key8%3D314%252C315%26in2w_key9%3Doptimization_request%26in2w_key15%3Do0%26in2w_key16%3D10&eri=4&sc=1&cdm=77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com&abxe=1&dt=1660241052063&dlt=1660241051791&idt=261&adxs=0&adys=0&biw=728&bih=180&isw=728&ish=90&scr_x=0&scr_y=0&ucis=8p7b2u24dolj&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&nhd=1&url=https%3A%2F%2Fwww.thetrainline.com&loc=https%3A%2F%2F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&top=www.thetrainline.com&etu=AF19uuV_9W5l_3DY1OSTxqY6GATbgyqEd9w3YKcIX5nH8Hz5pzaT6zk2ZskWRz4LQE8CF-c9LKUKLlA_8rL6QaUnkSn-XaLjn-62OlB5mYXqS0LBjsp2Fxqvv8cxq_809c_yGUzlSZliYJ565GpVZpkcNVQic1Nyt5LLzeqzPDeQXQlCwV5vA_xLYcIOD_2mIzHeUMTQRJ0QZr7FX0i971UJDNVNUVFLZnZW9XByeST6zfe-YL2DfOiSqywWkb2yxTUQd4ioaa3mp8Rzk20qfNZJdsJSIgydXSwZnQgwAvKxbDTv5B_8ByM6EAxqqDReD9zxJ70-_DuQy-vWMXxpP0XYg0Oi0Y78bCxJBPops_b867HP7xnbeUkUf7LqMMFQaJLqrt9OXfOB2jR204txLQBJPZOXeWJbtiQhjBxjWgAah4KGBiukoEppdz_hctYXohqlmE1LjcDc0IkWzdmnIlL9_jX7UIrYljfqF-MqhpojuZKKfO6x7sGbSTM-L-_NHyIFMt6IH7adsyGVdv2A0WF-utQnTWmARzQMU9Sfmt1ISqv_LLVDoSOpd1JHoo62UEXb96bG6j22uXHgELJLtyJaUsM5ZdkRmUV9PJfPMOpRsRhJgk63oa1gOsvGMYGRTaGfOeZhS_jy7yG5F1e-J1htzZyIb78tzuA2XU5s&frm=24&vis=1&psz=728x0&msz=728x0&fws=256&ohw=0&ea=0&ga_vid=711169715.1660241052&ga_sid=1660241052&ga_hid=1593000477&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

87ee8ef829e98dec1a5a03a715d7e3f7a8af4d14079a5f37c734d4e7a57a65cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12457
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0AD7 6 KB
3 KB 63ms
48ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:12 GMT
expires: Fri, 11 Aug 2023 18:04:12 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 76BD 624 B
733 B 316ms
51ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMaVugIQrKi69wIYm-jTzwEwAQ&v=APEucNXIrFJxiMtkMU9_0EL8H6Ce5bhuQJs5faF-pASpD7-WB54CcrTRJyknTP-52bSw56nKgDojhL-K3f-h4JluPeQOrXORxvwl9BaNukjG4s1HVhi1WY1iTZuW26pOv5eJAAtZQsOA

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 915D 80 KB
34 KB 372ms
108ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B7EUspJPWB7nmEbSXljhWNgkDnxXZAtTWJUYQPDp4kHpZP0INY6lEOGmI8Lq0rn9_O_aU_0wwicN4N8ukv1ZnTQsQWmw&cry=1&dbm_d=AKAmf-BwPHgUT5K86ULfDElHD0uqzGuB24AIewTY3gc3P-MTaXnj8jzRueaoqQgwX69C_F4Q7bxpJl2Vdj7iv5-Ip978b7h731KZZsrxokzhd_x0AFZtKUbpC4s-thX2lFrndsfE2h8HFHL5Ksma38ZEI1Khy5HXAA9yuBKsb-PGhcfI34-Sxh7rP52DZCH1YOSVZJx_jrxBB_jMHp2CwQTOXU8Cs1Xu7sYUZ29vISfuRv-zsyaER879RFyNCWXE5oZj7hyWO-0mYfz5h-Jftx7DEygsnxtHqcY1TjyXXZ8MULWjrPEKmVr8buL_XeiX1D8Aj_3u2pAJEyWaf_5vq2Z3VUbtO2vg_xPKyvN_6_VuznCbWJ_dcGwdo8Io6uPJGTFpzKO2KrNeLStITxiK-vEGLCr0ySzUkzt6JDYqaoKEuWlmu9dqwYuRv2aXnEyYiL5tpvnAfNtNpsqeVn87306dxykJVbpSrxn2eGisfRAeYA4Yz6gt4SKndWJYghkPguGQDOG1oNdAl1k27mWzOTLPCkB6hvx8d2c4UR1UJrRMQ-NIricR4yGX6BOxu3wZPIFo8RQ7FA2IW4UliGNAbLypgm7FevM5bIiulvvJU4f22BEZFRV4hJRisa5vOkuhWdhiqDyFjVlRYYNAoGCN8l4GFjIZnMB9lbHAVuo4ndpmSmwjUD56nS4Ly5ZihfHFb7wm2fGtY_BEmwGtUxO6gSJpYotgzmZBadXAu-fU9PH75xm_U4HsB1nj6kbzW8JRhBfAq9bkMR60sUpoHljlexOd4Bg8-bibdBkoH_ubY6JCcGF2RkXaRKyuFgc-mluL7oPxssowPGQw8Qv8unh0gGJly792u7Rl-ITW6ovrA_3TWWJxuI0_0QiSHVbivEsAj8sZhaap0dtYMRJeoUtclqoH46xnfrHE-IM3XwoLNzibopqN55FCxLrUoNQ64WaUv0g_gUoyGgcKOXwK79al9G2cpy1D3rsCROc_8AeNVjFMBMz3ocmNmW_cEAU5KzP-ODZ34rfn0o_pqgP6wOnLX4JniEsP-2bOTsGgMOFUP4yf84vJohIh7LQ3qP-6c8pVaeT4QfbFfrUWjcW-2YgqqTq_7mdm1-NRo6zyt4OqiucQsrVcJ39iwwWWKoQ6jvmj86zGhO7LLxL5E37d3_dWHViNXDRd12V8iSK6gj9RBKdolWCsxduFQbOHzOxhvp7i5NqDKpoXyiNHfiWO251MeHceasoWctQBXdBGMlDPTE8in2_iEbZSCWuH8MlRSHZlKTeubk4k-BakCJZaOQhv9ih6w8Pvb35ZSlQvUdgDNisnXoURjb61HhctVtfCPnEI8N8F0-PNbDI5OnESG12qrv4WPpViUM8895s0ZX0duJo5MgrD9Lpow4w3kDJmO3YOCt6sorYehwYe5UsC9_nmW7e3Tork_YxYE8orCqmzOat66kZWevsIcZmJm4MRG9h3uYjPZsVZj7K0I9ueQ2wKaXygncGqqPu4PvrVoPmv49OapW4CsiM2V8mJhjoA2cnHgGRAHkOjoV9EENGXzDRTQML_G-yxsIJ4Cy3nIQXKwBXKM21qqDKgVuof_yqz33vdtkJpH6Qq1eysbWL52X4yrHZAdsXtxRjHsv_kFt_ESFtB0_aoWk3OyIK_gE0g8l0gmq7s_x1lYUkRpDDguamAB8yaOa70FlKXadq_S00mKyOcoVVQ50jPEHM5kdTqGAx4LGB_Fn0R_HyhAJMhhpT4klh63GMAxAp-30dCEK_IXxIJwO_kT0y0q-uHi4-okSuXQv8Bk4B_1BuGwSoyzfRsMje4eK9prEDbQkFrOPDycTJ9MlDK6Ep5DVwIlZUcTck8a3Vghy_RI59rvc5cK82TnBDEihbL6WzR2bZ-Jvjt2fJ17_xzqP6oboIcFjNwiOqtqrQ-iXUe0L8znEqsC2bxaC1kEtoCZJeGpPU9nBPSvKm9rS9d8oAoRbOMOa7WhzQ5eu_9sUxQIDhvXR1jXgcUniwo9sjUFjAoUb8kjBlm7SqmjhbPSE9qi-lsZR0C96GcsVDtZFLVm-MJ3KahkK3AamaaL94Snea8ykSwM4glqaTXxXG4GNFQ-_QFRN3ewGV1VUZQhUT8N0MyfitRhKaxNrn6UIuDRm9dhxJizKOmrrS18CSy-zDl_6WKnCmk5WNqw7BnBJZHnA5t8TL0ftSYbwbbbMCK12x76O_TdsKUvyu7uUoNzmJ3pC-ZoXn2i-d89EkualOm9fkfk3xFH3KMDwhj0L-aJweQsOLRmIOYq0I1eF3my3WLXB_kr28uri3G4PYJhote3Svspd2hXBHxhHrFpe4VSnKZGao3ez0kGEiFS9yxvhJ4CZBp35qXChMoW6zaTlZBqbzmPvw0wRDjNnUkzKvaGyQ3GHszKD4zLWfVjmL_m6bEWnJq9BCaD8g0aI_LIHHMD0Ayo_oWFi09vqaFB8Pj0o_U5bfEotc-LpoD861Y_U8mPAFloF-Xxc7bMhZkS2TjX5l1mfreHGLqinda098u-NutsYydjPVOW568mpqnJHXEJr6QmE0grTJwB5zRn9CZbEuqC3lb2Hcq_bFANwIOVX4_JeFua0kqEFOZvf-oDj9KeAJQSi38Zpr--HF_W5KJHhr7i4ToiJseApvPuxbqBNhSPT9O1REggEyjQ6ucXsNL8cNoZPshVA6BQ6jSD8sJixBf9Mt4fEyVW5rtxeD4-0LXoKGJaRsgvr2alZvMf6TUL_XFP2nv7PeDibetQy-kKZW6u_DDWHJngBPFr_1GlfnabmmC5w8aJ_lcSAF9rGmabJ2VA1N746rv73JbuRgYELJpoC-XiBG_LM3ke9ukIVXSJ9S9GVu-kSZBksJQwzeWoRG64gmtefhUzC-H7cLlxh2x0SYcC7Uq-lruMuxToeBEMr6biSoQoeJtpRn1-xFqSv8sH5BaWiuS0SsaSXD3kpe2gnzHxCBaqZ0XSBzTIJPxUv-Jql69Fg3kgBFJIU3mOXK5w8mxFtKPAedMPGf1rSRq81ysu4suskjzOAziI_geAx8EdLYT5llfNGZmjHd9UYo6PJ2z0n4uH69wIbfTwjBB_NylKcPvk1ImXAroDxdNEvh0Pph1fvPk3WwasePVN1tXc79azHroeHkvJTePu1rHqcPmRA1EZqq1KhHBesL3nJEgvV5JoWEhG3O1OyYj8VkA4-FqPPc4x1Jy-lLOgqNd9DyIAZLtLU-ngHwFRbNSqj6duD4ezGKsu02q5h0ckbcygSxqiX7pmT8KMrbZNcXHUhyEoMom-fABWQWFwWaXVwEgrupPMHWwL5T1EcEEohVtWiJmJ3o_V8s-iCD178bVG4afvQcAfzLS7dqu2aTwnQh1hseVBO0-FIF2mEdBHYijelDWizMe7JTq7N6swLuhA9AoTDgvCLAkmvL9dXfRfjhfQJ5q_E2z8U1aluuhBKdrUdqyhDRGdBzlR7jWWPVGKSPujiBevmFWjfAIH6woy9RKUJjjLJr5Sx0KSWj_zVTrbtlxP1J1UccSOpZla4ehIWYhoTsjWCeEnNPHOewpU_7oFTOBgYSP_VSj1f6huCHnfPG3ymNsDyj9VsUtHYRlGIKcquOB0mMugh_VFa-vpw&cid=CAASJORoqs7vN3Ki78P3VMqXtVp4L6GpSXWFu2FTn7ITnRn_uRBMGQ&rfl=1%2Chttps%253A%252F%252Fwww.thetrainline.com%252F%240

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46db7a2db7b8d9bc6078190a3e19c3696a2f3ebdd66fa450000eb446853d930c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34174
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 915D 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CZ9oCm-X-rd4pklDsp2V7oOuu3SlW459b7QWJs26z3KIUoF-TuZTlmzFhxkGbnmwJhsXmPW9hJO4b2U9dO9YE2DRv0St6bsxtkI3tnr60UI9iWlEo

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 915D 3 KB
1 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/window_focus_fy2021.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 458
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 17:56:34 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 915D 18 KB
8 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6dee0ce11364c6f11ae1bd42d99b8589a2196ab64931045a6f9bd7f80b0c0b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:03:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7695
x-xss-protection: 0
server: cafe
etag: 15631871522064371328
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 18:03:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 915D 140 KB
43 KB 1285ms
1285ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75bf5c0112a41f871dc47c5e98deef6dc7db8e94178bf0c853f3a09415f6d338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44015
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660137096112928"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 76ms
76ms Image
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022080801&jk=586050460552526&bg=!urmluf3NAAa4hXTbmIU7ACkAdvg8Wn6QBaq7slnIDWSubJgZPVS9bgdthGvPpKM6eIT8LrPPXZf8-gIAAAB5UgAAAAFoAQeZAuQg-BXMQhob7sJLesheAlpLOo759lF4dP7an7SKs-ddcibVpgo8OJyh08jE7dUZZtOvW1QDDIy0Z732yrdFFM_2RkmrpUJJf0YufUvfY-KaHvo-KuCoMZ2hDqjzLsZiSwoMMck_MHzsugBgWwr0NrlEho2vusgCOZJrlwExTbdfOaFxmROp9c1arNnFaNNqsPr0eg4iTRBVT97C8wo_cZ2hDVjWRw6CzMBV43dit0l9YO8weZzquJoMRYibCaDTCzihvqjBXLZ9pVa_tvMGfyT0zwqB2yxTnR-Q01FrQ2Vr8G7fFe2BlQf9PYMEfj2bWZzRA_ZB0nzAde-3yKDCy0sYJ6eujFJDuqyhVpKqEazojrxHYodnETDPUH5zGTDIJ_rdP4HyQz5gZoAmm696bMs5W7I9125zuoRN3IWhyPXwmgZJFcGjtJY2LcocTMR2JguvOte5LAzLFHN51CFixlfxDMDlVH02nuc7T118Qy_5CDVRMLtRt_LuEthsqlmcd2ngTqO1fo2zHHJesqXoDxw_UhoulqeOZDKRG2FqAlL3uz8DNB_YWAZpMSNz8q5dMF-SPys6MWr4T1xO-r3aK_3yTyeGIBZWckiRCVNWEfWYtyc_OLEYKOYXrrRB8tfQPn7HJOllVMXFUhzvbzsCWGm9yaNs2_BcwpczFyZWvBY20jRTylqRSG5tsuKu5lcYjLKTjGQC93b6qFUQ7cr5QovWuL7D6EyD3_dH-X_Ae9BSXN5zqSvvymIxYuaIhCt6LgWNIpwAoHzpDAoELCvVxwRGS3LEFcOMWznm4Bnr0GaDTrWpXPRCe79NZWA2OZbFr6NRlV8UqNWat9s7DIvFLjV2rvDB0nE61YvB20a0COW06iZbq6lF-qlw4L16dkJC0TQVyTnW036R1xbjuJrQ--3NEzAwyvTU1wS7cE1fGQYVjDBAeYsXVIl5A4CNJANLmF2kFBQ07dtTUQhNhLOZkErrfgWxMw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.thetrainline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 76BD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBkZ9qRAFLMAan2LFsCSakY&google_cver=1

43 B
942 B

100ms
72ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBkZ9qRAFLMAan2LFsCSakY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMaVugIQrKi69wIYm-jTzwEwAQ&v=APEucNXIrFJxiMtkMU9_0EL8H6Ce5bhuQJs5faF-pASpD7-WB54CcrTRJyknTP-52bSw56nKgDojhL-K3f-h4JluPeQOrXORxvwl9BaNukjG4s1HVhi1WY1iTZuW26pOv5eJAAtZQsOA
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7392e472ddf306b6-LHR
pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NwVmmEp8dh1Iro8ExI4Jr78aIzGKoihVbd6vSg3u%2Bky3mHromMORqljqxVa55Pdj6XPE0k0bvHC5joemPK6y0teqXF1h%2FvtsBZbFbAayAjlCGiEw6KKTgka0uYNjRBOGbgfS4yrOzg90vg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBkZ9qRAFLMAan2LFsCSakY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 76BD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YvVEnLnMTPUOF45LZ7cM1AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBkZ9qRAFLMAan2LFsCSakY&google_cver=1

43 B
913 B

74ms
73ms

Image
image/gif

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBkZ9qRAFLMAan2LFsCSakY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMaVugIQrKi69wIYm-jTzwEwAQ&v=APEucNXIrFJxiMtkMU9_0EL8H6Ce5bhuQJs5faF-pASpD7-WB54CcrTRJyknTP-52bSw56nKgDojhL-K3f-h4JluPeQOrXORxvwl9BaNukjG4s1HVhi1WY1iTZuW26pOv5eJAAtZQsOA
Protocol: H3
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7392e473cf4a06b6-LHR
pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9C12Fsqdccsr37D%2BhVLpSGdi5MCmo1VPn%2F7KuRZrn26krDdOIYBwRs%2B%2FEoQ2GAG4xuA6UjOWTO69e1Ii1%2Fpll0yU1eLVZ0%2FjKGhjnZ%2BBdL687x7n7wye9DDx1tbcRzQ8LbsT5HvjtrMHRA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBkZ9qRAFLMAan2LFsCSakY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 76BD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBalzyMjGu5Su4QLK4Exg5M&google_cver=1

43 B
1020 B

120ms
64ms

Image
image/gif

37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEBalzyMjGu5Su4QLK4Exg5M&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMaVugIQrKi69wIYm-jTzwEwAQ&v=APEucNXIrFJxiMtkMU9_0EL8H6Ce5bhuQJs5faF-pASpD7-WB54CcrTRJyknTP-52bSw56nKgDojhL-K3f-h4JluPeQOrXORxvwl9BaNukjG4s1HVhi1WY1iTZuW26pOv5eJAAtZQsOA

Protocol

HTTP/1.1

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 18:04:12 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: aea5c2e1-9f93-4d1a-960c-09531540a95b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEBalzyMjGu5Su4QLK4Exg5M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 76BD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjUyODU1MTkyNDY4NDgzMzE0NA%3D%3D

170 B
188 B

114ms
51ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjUyODU1MTkyNDY4NDgzMzE0NA%3D%3D

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 18:04:12 GMT
X-Proxy-Origin: 217.138.196.107; 217.138.196.107; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: fb142c83-d6b0-4d14-8d13-eb2b2a727497
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjUyODU1MTkyNDY4NDgzMzE0NA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 915D 106 KB
38 KB 157ms
40ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Origin: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 16:26:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5887
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 Aug 2022 16:26:05 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/elements/html/ Frame 915D 8 KB
3 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B7EUspJPWB7nmEbSXljhWNgkDnxXZAtTWJUYQPDp4kHpZP0INY6lEOGmI8Lq0rn9_O_aU_0wwicN4N8ukv1ZnTQsQWmw&cry=1&dbm_d=AKAmf-BwPHgUT5K86ULfDElHD0uqzGuB24AIewTY3gc3P-MTaXnj8jzRueaoqQgwX69C_F4Q7bxpJl2Vdj7iv5-Ip978b7h731KZZsrxokzhd_x0AFZtKUbpC4s-thX2lFrndsfE2h8HFHL5Ksma38ZEI1Khy5HXAA9yuBKsb-PGhcfI34-Sxh7rP52DZCH1YOSVZJx_jrxBB_jMHp2CwQTOXU8Cs1Xu7sYUZ29vISfuRv-zsyaER879RFyNCWXE5oZj7hyWO-0mYfz5h-Jftx7DEygsnxtHqcY1TjyXXZ8MULWjrPEKmVr8buL_XeiX1D8Aj_3u2pAJEyWaf_5vq2Z3VUbtO2vg_xPKyvN_6_VuznCbWJ_dcGwdo8Io6uPJGTFpzKO2KrNeLStITxiK-vEGLCr0ySzUkzt6JDYqaoKEuWlmu9dqwYuRv2aXnEyYiL5tpvnAfNtNpsqeVn87306dxykJVbpSrxn2eGisfRAeYA4Yz6gt4SKndWJYghkPguGQDOG1oNdAl1k27mWzOTLPCkB6hvx8d2c4UR1UJrRMQ-NIricR4yGX6BOxu3wZPIFo8RQ7FA2IW4UliGNAbLypgm7FevM5bIiulvvJU4f22BEZFRV4hJRisa5vOkuhWdhiqDyFjVlRYYNAoGCN8l4GFjIZnMB9lbHAVuo4ndpmSmwjUD56nS4Ly5ZihfHFb7wm2fGtY_BEmwGtUxO6gSJpYotgzmZBadXAu-fU9PH75xm_U4HsB1nj6kbzW8JRhBfAq9bkMR60sUpoHljlexOd4Bg8-bibdBkoH_ubY6JCcGF2RkXaRKyuFgc-mluL7oPxssowPGQw8Qv8unh0gGJly792u7Rl-ITW6ovrA_3TWWJxuI0_0QiSHVbivEsAj8sZhaap0dtYMRJeoUtclqoH46xnfrHE-IM3XwoLNzibopqN55FCxLrUoNQ64WaUv0g_gUoyGgcKOXwK79al9G2cpy1D3rsCROc_8AeNVjFMBMz3ocmNmW_cEAU5KzP-ODZ34rfn0o_pqgP6wOnLX4JniEsP-2bOTsGgMOFUP4yf84vJohIh7LQ3qP-6c8pVaeT4QfbFfrUWjcW-2YgqqTq_7mdm1-NRo6zyt4OqiucQsrVcJ39iwwWWKoQ6jvmj86zGhO7LLxL5E37d3_dWHViNXDRd12V8iSK6gj9RBKdolWCsxduFQbOHzOxhvp7i5NqDKpoXyiNHfiWO251MeHceasoWctQBXdBGMlDPTE8in2_iEbZSCWuH8MlRSHZlKTeubk4k-BakCJZaOQhv9ih6w8Pvb35ZSlQvUdgDNisnXoURjb61HhctVtfCPnEI8N8F0-PNbDI5OnESG12qrv4WPpViUM8895s0ZX0duJo5MgrD9Lpow4w3kDJmO3YOCt6sorYehwYe5UsC9_nmW7e3Tork_YxYE8orCqmzOat66kZWevsIcZmJm4MRG9h3uYjPZsVZj7K0I9ueQ2wKaXygncGqqPu4PvrVoPmv49OapW4CsiM2V8mJhjoA2cnHgGRAHkOjoV9EENGXzDRTQML_G-yxsIJ4Cy3nIQXKwBXKM21qqDKgVuof_yqz33vdtkJpH6Qq1eysbWL52X4yrHZAdsXtxRjHsv_kFt_ESFtB0_aoWk3OyIK_gE0g8l0gmq7s_x1lYUkRpDDguamAB8yaOa70FlKXadq_S00mKyOcoVVQ50jPEHM5kdTqGAx4LGB_Fn0R_HyhAJMhhpT4klh63GMAxAp-30dCEK_IXxIJwO_kT0y0q-uHi4-okSuXQv8Bk4B_1BuGwSoyzfRsMje4eK9prEDbQkFrOPDycTJ9MlDK6Ep5DVwIlZUcTck8a3Vghy_RI59rvc5cK82TnBDEihbL6WzR2bZ-Jvjt2fJ17_xzqP6oboIcFjNwiOqtqrQ-iXUe0L8znEqsC2bxaC1kEtoCZJeGpPU9nBPSvKm9rS9d8oAoRbOMOa7WhzQ5eu_9sUxQIDhvXR1jXgcUniwo9sjUFjAoUb8kjBlm7SqmjhbPSE9qi-lsZR0C96GcsVDtZFLVm-MJ3KahkK3AamaaL94Snea8ykSwM4glqaTXxXG4GNFQ-_QFRN3ewGV1VUZQhUT8N0MyfitRhKaxNrn6UIuDRm9dhxJizKOmrrS18CSy-zDl_6WKnCmk5WNqw7BnBJZHnA5t8TL0ftSYbwbbbMCK12x76O_TdsKUvyu7uUoNzmJ3pC-ZoXn2i-d89EkualOm9fkfk3xFH3KMDwhj0L-aJweQsOLRmIOYq0I1eF3my3WLXB_kr28uri3G4PYJhote3Svspd2hXBHxhHrFpe4VSnKZGao3ez0kGEiFS9yxvhJ4CZBp35qXChMoW6zaTlZBqbzmPvw0wRDjNnUkzKvaGyQ3GHszKD4zLWfVjmL_m6bEWnJq9BCaD8g0aI_LIHHMD0Ayo_oWFi09vqaFB8Pj0o_U5bfEotc-LpoD861Y_U8mPAFloF-Xxc7bMhZkS2TjX5l1mfreHGLqinda098u-NutsYydjPVOW568mpqnJHXEJr6QmE0grTJwB5zRn9CZbEuqC3lb2Hcq_bFANwIOVX4_JeFua0kqEFOZvf-oDj9KeAJQSi38Zpr--HF_W5KJHhr7i4ToiJseApvPuxbqBNhSPT9O1REggEyjQ6ucXsNL8cNoZPshVA6BQ6jSD8sJixBf9Mt4fEyVW5rtxeD4-0LXoKGJaRsgvr2alZvMf6TUL_XFP2nv7PeDibetQy-kKZW6u_DDWHJngBPFr_1GlfnabmmC5w8aJ_lcSAF9rGmabJ2VA1N746rv73JbuRgYELJpoC-XiBG_LM3ke9ukIVXSJ9S9GVu-kSZBksJQwzeWoRG64gmtefhUzC-H7cLlxh2x0SYcC7Uq-lruMuxToeBEMr6biSoQoeJtpRn1-xFqSv8sH5BaWiuS0SsaSXD3kpe2gnzHxCBaqZ0XSBzTIJPxUv-Jql69Fg3kgBFJIU3mOXK5w8mxFtKPAedMPGf1rSRq81ysu4suskjzOAziI_geAx8EdLYT5llfNGZmjHd9UYo6PJ2z0n4uH69wIbfTwjBB_NylKcPvk1ImXAroDxdNEvh0Pph1fvPk3WwasePVN1tXc79azHroeHkvJTePu1rHqcPmRA1EZqq1KhHBesL3nJEgvV5JoWEhG3O1OyYj8VkA4-FqPPc4x1Jy-lLOgqNd9DyIAZLtLU-ngHwFRbNSqj6duD4ezGKsu02q5h0ckbcygSxqiX7pmT8KMrbZNcXHUhyEoMom-fABWQWFwWaXVwEgrupPMHWwL5T1EcEEohVtWiJmJ3o_V8s-iCD178bVG4afvQcAfzLS7dqu2aTwnQh1hseVBO0-FIF2mEdBHYijelDWizMe7JTq7N6swLuhA9AoTDgvCLAkmvL9dXfRfjhfQJ5q_E2z8U1aluuhBKdrUdqyhDRGdBzlR7jWWPVGKSPujiBevmFWjfAIH6woy9RKUJjjLJr5Sx0KSWj_zVTrbtlxP1J1UccSOpZla4ehIWYhoTsjWCeEnNPHOewpU_7oFTOBgYSP_VSj1f6huCHnfPG3ymNsDyj9VsUtHYRlGIKcquOB0mMugh_VFa-vpw&cid=CAASJORoqs7vN3Ki78P3VMqXtVp4L6GpSXWFu2FTn7ITnRn_uRBMGQ&rfl=1%2Chttps%253A%252F%252Fwww.thetrainline.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:00:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 230
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 18:00:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/ Frame 915D 31 KB
12 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73a8c4643090bc508a479abca9b19393744e21ab711641ee147c2495dfd3d8b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11917
x-xss-protection: 0
server: cafe
etag: 3600686600815956419
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 18:02:34 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 915D 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:19:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Aug 2023 17:19:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A0E4 1 KB
749 B 40ms
40ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 5815
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 16:27:17 GMT
etag: 48472445140208031
expires: Fri, 12 Aug 2022 16:27:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 915D 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2ced974ac77b1f2d9ad4f1d44f009ed58d19482b8925d2f00bfd9cd346bb06de

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C168 22 KB
8 KB 40ms
40ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 2706
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 17:19:06 GMT
expires: Fri, 11 Aug 2023 17:19:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0E4
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELL-gUAd4RLOTmMI3uQ7RJQ&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELL-gUAd4RLOTmMI3uQ7RJQ&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bE45NTl6V1gxT21jeHU1&google_gid=CAESELL-gUAd4RLOTmMI3uQ7RJQ&google_cver=1&google_push=AehlK4CGIeE5-rfZabqxdES2uqbFObEq8SVqaD8wdhroe4k...

170 B
188 B

52ms
51ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bE45NTl6V1gxT21jeHU1&google_gid=CAESELL-gUAd4RLOTmMI3uQ7RJQ&google_cver=1&google_push=AehlK4CGIeE5-rfZabqxdES2uqbFObEq8SVqaD8wdhroe4kiTCpXF-Z7x3A2ywK5qjtZC2EQc61vTX7leaDYDygMfaAH9MyQS4QF

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 18:04:12 GMT
Server: PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-0e0b7d4089fc3e73e@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bE45NTl6V1gxT21jeHU1&google_gid=CAESELL-gUAd4RLOTmMI3uQ7RJQ&google_cver=1&google_push=AehlK4CGIeE5-rfZabqxdES2uqbFObEq8SVqaD8wdhroe4kiTCpXF-Z7x3A2ywK5qjtZC2EQc61vTX7leaDYDygMfaAH9MyQS4QF
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0E4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECBmX-ohfqLtS-4s-5sAX8o&google_push=AehlK4CIUDoZwxIC-DckqdrtlK1keai7XMHfCTkJ5LLln_kwPHWY3xLiZb...

170 B
188 B

51ms
50ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECBmX-ohfqLtS-4s-5sAX8o&google_push=AehlK4CIUDoZwxIC-DckqdrtlK1keai7XMHfCTkJ5LLln_kwPHWY3xLiZbb-GQV1Uh_3swbp__ljWf-951_TJTF3Ow8MLmm4Oxs

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1660241053.715452,VS0,VE77
x-served-by: cache-lcy19238-LCY
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECBmX-ohfqLtS-4s-5sAX8o&google_push=AehlK4CIUDoZwxIC-DckqdrtlK1keai7XMHfCTkJ5LLln_kwPHWY3xLiZbb-GQV1Uh_3swbp__ljWf-951_TJTF3Ow8MLmm4Oxs
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame A0E4 0
191 B 112ms
36ms Image
text/plain 66.155.71.150
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQ5V2jJvJNl7kxe7rK30sE&google_cver=1&google_push=AehlK4CZUZjLvdGbQjihqVKga7tPiNm7Oo8Hc0qh87F9F0mzWgB0pQ6lJ3zJ4gzqQn5p8RSKPIDPvBFe-6dYjyMXALjEVFgJZY8p
Requested by: Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0E4
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESECJ3wY1ac_OFkWbda6EOQDE&google_cver=1&google_push=AehlK4BCSDQPqshtai79UZYnqRGIkUsuDkL-SC_hoH2-HAk7mRcNvxUdSall3gLCiDTFf6RypaoY0H4s_R1y4j6r...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=gZwaJ-JeSTugUxTasu7eyg2&google_push=AehlK4BCSDQPqshtai79UZYnqRGIkUsuDkL-SC_hoH2-HAk7mRcNvxUdSall3gLCiDTFf6RypaoY0H4s_R1y4j6ryqQA9O5a7j1U

170 B
188 B

50ms
50ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=gZwaJ-JeSTugUxTasu7eyg2&google_push=AehlK4BCSDQPqshtai79UZYnqRGIkUsuDkL-SC_hoH2-HAk7mRcNvxUdSall3gLCiDTFf6RypaoY0H4s_R1y4j6ryqQA9O5a7j1U

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 11 Aug 2022 18:04:12 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=gZwaJ-JeSTugUxTasu7eyg2&google_push=AehlK4BCSDQPqshtai79UZYnqRGIkUsuDkL-SC_hoH2-HAk7mRcNvxUdSall3gLCiDTFf6RypaoY0H4s_R1y4j6ryqQA9O5a7j1U
x-host: tde-deliveryengine-production-7b45b4797c-t2rzm
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A0E4
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEOOxMRy6XyQhB9VNxw9hfQw&google_cver=1&google_push=AehlK4CI9RyiQpdM2JYR8FX6rsj3WOx61GduWnN8f4gU9xSDdPmO4TcElOggft59k4AQnzJDu3GAGHd0rsycgYh5kr_H...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEOOxMRy6XyQhB9VNxw9hfQw&google_cver=1&google_push=AehlK4CI9RyiQpdM2JYR8FX6rsj3WOx61GduWnN8f4gU9xSDdPmO4TcElOggft59k4AQnzJDu3GAGHd0rsycgY...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AehlK4CI9RyiQpdM2JYR8FX6rsj3WOx61GduWnN8f4gU9xSDdPmO4TcElOggft59k4AQnzJDu3GAGHd0rsycgYh5kr_HbeI27xxj&google_hm=lgGhO0aaTYecFcx-lGVrEw==

170 B
188 B

51ms
51ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AehlK4CI9RyiQpdM2JYR8FX6rsj3WOx61GduWnN8f4gU9xSDdPmO4TcElOggft59k4AQnzJDu3GAGHd0rsycgYh5kr_HbeI27xxj&google_hm=lgGhO0aaTYecFcx-lGVrEw==

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216537.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AehlK4CI9RyiQpdM2JYR8FX6rsj3WOx61GduWnN8f4gU9xSDdPmO4TcElOggft59k4AQnzJDu3GAGHd0rsycgYh5kr_HbeI27xxj&google_hm=lgGhO0aaTYecFcx-lGVrEw==
Date: Thu, 11 Aug 2022 18:04:12 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 204 v1
match.sharethrough.com/E4rooAtA/ Frame A0E4 0
35 B 187ms
41ms Image
text/plain 35.159.6.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESELB1bdqgQMTThBFmuOPM3xk&google_cver=1&google_push=AehlK4CZalDaDxj4tCGc7YQOlEo38rEP2JtFK0XAk3SX5Al2Jy8u2nX7bxvfUj4uLUYjqlo7y8Ts_IRqhLuatUVSQUsteij8eWSCBg
Requested by: Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.159.6.67 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-159-6-67.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:12 GMT

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame A0E4
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEPK8LsqCDQEKzHMgNR8MtNk&google_cver=1&google_push=AehlK4Dgwg4R1QCOCUSMm8xhpP73ZgJJAPgNJeAwe826DgQ9tV3Y4YBEZUh0kvLztBDR3kT26mq1JePvpq4R5p0QwWHZC6c616cTxw
https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAehlK4Dgwg4R1QCOCUSMm8xhpP73ZgJJAPgNJeAwe826DgQ9tV3Y4YBEZUh0kvLztBDR...

43 B
1 KB

138ms
41ms

Image
image/gif

141.95.98.66
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAehlK4Dgwg4R1QCOCUSMm8xhpP73ZgJJAPgNJeAwe826DgQ9tV3Y4YBEZUh0kvLztBDR3kT26mq1JePvpq4R5p0QwWHZC6c616cTxw&gdpr_consent=&gdpr=

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

141.95.98.66 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:12 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

Redirect headers

content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
date: Thu, 11 Aug 2022 18:04:12 GMT
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
x-download-options: noopen
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAehlK4Dgwg4R1QCOCUSMm8xhpP73ZgJJAPgNJeAwe826DgQ9tV3Y4YBEZUh0kvLztBDR3kT26mq1JePvpq4R5p0QwWHZC6c616cTxw&gdpr_consent=&gdpr=
x-xss-protection: 0
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
vary: Accept
content-length: 273
x-content-type-options: nosniff

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A0E4 0
12 B 130ms
48ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LWakEjVacdJ_ymNXAFEFSvDwmzrg3Xtn0Dg1Ynl4PJ7LhiYZv3tty3t6OlkMYL7K0XH6M6654

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 container.html Show response
eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7897 6 KB
3 KB 41ms
40ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:12 GMT
expires: Fri, 11 Aug 2023 18:04:12 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js Show response
pagead2.googlesyndication.com/bg/ Frame C168 36 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

749b6261f109108d21cb0e7043f83ff0d94a46c1dd8dad8965e6794fd345d238

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:22:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14301
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Aug 2023 17:22:02 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9A80 681 B
343 B 133ms
51ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJi-ZRDrxZABGJrtq84BMAE&v=APEucNWKlqEkPjcSIpfVxtWrjihNHqaFOKc6kNQbEOp7dD9O6FBAoOnQiz9pssRX2Wv0TCacLTWt0epguO414PupPH-tFAJ1mddwu_qgMcoGZYE4M4wtU4XqTeqLXFBQoOxO3z88Jwkm

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41dfad30ddd4d44e007bb4483a2e601e1ace97e132085e7443f301c1cba63144

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 322
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7897 15 KB
11 KB 157ms
75ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DltNW67KFsGWwephV1k6Vftc9goxT_xsxHUxgaDwRsKznD_Frt2I8GSIcpASuYSPp2k4S_7KRH41WjSPEqhUnGjtrj1ww-BpVz8PY6NqCc6HuKkZG80dU9Rn9vb-iOh36z35Pcde1UwJSADj7vn--eIvBLpw&cry=1&dbm_d=AKAmf-BLzw6xDpyUXovY-z-LZssq2tB8G6ZiExKkH2Fku3H-FIwTO-hqaRDvFJmCC5HIEJdLhjCAHhl3cSOMsF73bYSFFjNBdHnHRQF5b5PubYkD-OxBtHPjcDExFevS8CQfDk1B7Gbvwsc5foN2g0Iq_8K7K4m0rnEF3gBFOT5HQKa3IYqeB6gclTMemK1PXovl8e2QqrihhEPw1LLOOlJGBdQ37Bft7qBAnh0atmhKLhqboOZWhLxwy-q5MyDEqzcqb-Z1oU149pDsUGsyNjtqIly75mxskpNJlUiux2f-xAUGFkh-JZvGz2w21c9NzzcpFB5J3-xqzqq0wyOPq8Pjrzt04r5iKAwuA4lkKjZg14SF89iCtkPioAcU0BXPt_k3VupTDM7Dxc_QeBQe_pkfKobGAXUpKAB5YjlIvetKJtslgZaHqjYmYUXddV4Ym9ui9Y5Ks6li6sLqtmqIaKiIl1O3F10QbkggWwwdu9No2KJA-nXbGpP4kyNSsMYqBMXK5epXkEotK1N-4Wu0aJPlJnISAEZHlMrQRB3KtQLUGq65o8rhsUKYKwwRJDRa6jzPPCBl2oB9DRwGte2KHh7i5ZhYkL8KQV-J-6swgiYNsAwPMzx4JXlgFLswYk8C7InmRt_EHo5Rx5Z3t0n9dbDXmlEYZ0zF2hDS2XBsYdh3rrANUFYMy-NK5bMMzwc-gNn05KL3X4kXfJqlKSbc8h_OWcVT0Ni1Ih2k3beg_ZV3MZLwUQzy4AG7Pa14wXlkZoG2-lgEULNAClP9QF2j8IpquP-RbowFPBTIVNfzixoIQrsi-HEAnzxsS0KJucGKQR-SeS6gKhHTiGmOxtoaojYXrJSqNVfozcLjceKqu4oBIVJDVbZZQ-Dr1h_DflaZvlH2BJAQK1AVo-cmRQi16qVsS8IfDaYULu0365S8XO2uaKzdhPIO80f4TPPvui-zg4fc7T5t8RIIlvExejSl_BmkTzW-1g2UmMfF68Menx8ZCWg9PjHpreCVSboWmc6aALKVmireaBlUmrCVz9nOVYkklBwgo8_K-wXJlOcWzfJMloK5eRdk9_U8YMb_Xs-vhb407JqnQn0XuuwnPL1M4UpwgKIDO8IMtK1JdiTVJ1g6jkFtuhv4FQuI-VmgYwbaI2mIa5_n9y956SCjmJ9t2HAYCb7FW_7ingdM5ktXbH0gFEev0icDX0Vpu8sxw6ZLyOGcJ59j7O7bMF3bRyh-wo6AsfRgnaVjD5tX9tQWAPDxMGtfhLScFOXMjlC5UtSkoYtmdKpt1ASVTw7EdPqGOf-udCwUmLN99okl_kj29LvLk-nvXdex7Xudndwl6Q4I30PnVbiktoR0Wokt9PN6eCOB_rHHRmJsmJqeXlrA-Ntglfob0uNm9duir0DDCjEQX-4g0nRfXx8KYdLqz09yVS25it9W7PSDeSVJeErdbpNdITe22WG-RQmseDn8bkUo5VOTQww_d3J9aLUCiRNPgLuOprg3mDrrSHFK16U_c-5dZtaimyPAbI5tsroL9Y7Nfimb42nWuenjM_wyqA_zwd58kyFOZLcvPKBycVLIFJzvIoZWKx_z3WZW5TR6VdUqNdaCnSe11DHCx05vsRScASnEAnWu3Lai5tVepBRR1AfwOm9iUZAIHn2wfiNXFGisB_GjrTnVQgg2n6WjzC_Mlwm80wZkwl8efwEqY-mQcLFFzM2Wg2bLjNDVVHxdRi8MvMhomyqiv34WIrnaSX0te3x-vvXC_-scW6VX6PXb9jZ9Pu0iTVaxZIUjUo6iKnto9bzXqex5fZytEzoGJM2BhBhYIYtkMtmO5zGJGiBYI8lRzqi_QnRJxt-xmP2aF2WqIXA3-L40L-YySJ9u1jG1gAW7M7pXkGyQC-xo0lFPNjlGLVaaKTH4ezXctiF62mReMzxDKwYzYkY0-I8AQqJT0BLMM5OOpU06YS74hxowznNfx5Aaw2JG7CwQp4JMT857OrSSg7iaP8xiYTSI2IZ436yJqgVG_Wu6asLanQoIohaFIVFqpuNKgcSa0eSRZoBDDDv8TdlguQ1Tq8XQw87HAUkexljTWSNWsYmGnXeg1glrckYZFp76IP1QTWgle7cLWK583SFXH_H3lv6H0SIv0lP2955pIgJrYFhFp7pi74z6dDbxrdl2JsVZveqnuWWHlGNhyIjgJhjxvbdu0d4HFd7y0KEkX_RLAb93bL9cql44UYC9--cn7R7ZOp9t57DOJT-_kD5a7JA3hLiX6EuyKrHwY5JP4s9gnYcKzYc8WOLxG17FUbwbf1nq45MD6E9m0WTQqvrKQgMDv1W_3wbpMR5lg5K87k7PyeupRZVzIk7VdjCcO54hzg-dRmIp5CNTJyophM4-n4UVXAAIgtQOsMPMDhyuXzXUD1bohPCYW6rvLPGuDsklv8pwIwhfHp5Kd9al3ca13KBeOCZQO47UNjqc5S8qeqNdSnI0lmU28RajWxfGxJJOq2ZzfCNmBhlPMm8O9kmfyACRvJ-CxULX-kjNCb83mcwwWaGeB6qkfmTcoMyyIdbnXP0BjgKSXO5O-8XUzzjITKFqgrImND1CBHzfc1WcSjKRkJGF_UJDNI_hBU_DIFj7oTLTwZZof0e9VvoIvYOy9B-cQGPwsSoK5t71omajeeXl4dLmbSZwvj0B2G83CV3McbDlNB9fr3zft7dOF_9n9GEuNbacIBp1XoHDrRryYw2TpoJtFa5lTINqvGy_ZqcA_5bneFYlhkZOKMGNaYuxz_kplAEopFG_uD1PXogAoPBP5o6RQrI27dE24lh7QuCujaj7yHX3TNwvA6AMswiduoNCYZ4oF-yWu4nyI8fcGOU39auf5rW2CYroo1pgatF-DFw&cid=CAASEuRoP8c8IUWptzvzCVolsPdeUQ&rfl=2%2Chttps%253A%252F%252Fwww.thetrainline.com%242%2Chttps%253A%252F%252F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a333c5329f0c06cec0728917c1fc900f43926988f928cea6a2676c945922c24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11178
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7897 42 B
63 B 74ms
73ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Drzu4kvY1PreFG45QNAfoeoQxY2nGNjnN2MUfpQpbsvwyHcBu0DFB6-vhBXk3fDVW0_325hqqERchxlRrBiM5ORiMdGQSAmzT3xWqdmlLodb2BBwQ

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 7897 3 KB
1 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/window_focus_fy2021.js

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:56:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 458
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 17:56:34 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 7897 18 KB
8 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6dee0ce11364c6f11ae1bd42d99b8589a2196ab64931045a6f9bd7f80b0c0b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:03:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7695
x-xss-protection: 0
server: cafe
etag: 15631871522064371328
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 18:03:03 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7897 140 KB
43 KB 711ms
709ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75bf5c0112a41f871dc47c5e98deef6dc7db8e94178bf0c853f3a09415f6d338

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44015
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1660137096112928"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 200 GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html Show response
s0.2mdn.net/sadbundle/10973017770752807385/ Frame 5B95 7 KB
3 KB 126ms
42ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94e433956db6fbc46f190b1feefdaf89451189e96965b9bf913afbc2905f58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 89356
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2573
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 10 Aug 2022 17:14:56 GMT
expires: Thu, 10 Aug 2023 17:14:56 GMT
last-modified: Wed, 20 Jul 2022 09:09:46 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 915D 0
622 B 192ms
89ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuWB8ojk6PFdFZ-t78YyhtCjrgD0cGwI7vcGzIe6aGSO4j9jEHbaCRYUaVoekUEjQz-JglzqM66O4TioeMWudiu7nae-kB2vKPXDJOeA0wtGMcKuSWJdqzTCao9pUJ3QNajMmZdKWR8kWGvLPvEZo_4w9Qka7VubRys_sEQ5q9vFrvL3QvXu9-H7Wn4wiHCSkykywKRGl8zCVWab-HjWVQ5ihy6Is2wJPgrPirA7Jxq6Xpj22i-WDsUHmEMEDXqKGKXy94UuJlFxvTRolm4ZvmymU6sAt-nv5Cn3OjomFQmC2D7Qmainm_wN0axfBHECjwh0s4w03Ok-gnMzRw-abp6ldrUYXBzCrD0AmwPByS2ERPwKZ5K3nhsAqs0Rn6miqil1Tr3zgifEOw-VBaj2QEqwa_WxtNkj_ZkFkQR4EfBemOpcJUlrS2MNyvtO0drcrFBW6bcELx3wcXvAu3azZ3FXKu6stP1iz5N8wxHT_9hmQJG2y4IJQTtKebqoMFpudGPVdO3Vb90VQitQ2b2reFrwwx3ZF0Ox8_7cmNVXTydS4m2uo55xVhESUW55SVjWh4rUSPfnjm2Irxv0_rNSXHh3ojW3d4_9bIpwKQtAyk7xRtT9a0yP4JC2Z27fOPDsGr3xfVNFSCLU1qGVEOZ2Ej0enM96p4jMgHNrZAIZsu-POWW-_c-uGIlC9sFwhT6kc6Sp3K-QUiEHr5TDYQZ0J4v9b-VvNJnNRKRZmU5BDfuyibDkS8N4EHzIt0ml2g5os_A0ckroJnjEVJ6s5ftye_PhHroPhJ95WWuQ79Pa3JWZmOgMnrJ8iNQeNb7lkzfvdJv2z4sHKiGL3DvCzahBqEqM0jsm0fnuDCUqKI0XNTI_BRyT7jmKlPoblMJ7SpyV-Gycho9ZRc3522Q54hGfMhhSHdUIB1LUFrvAc-WU29Fob8IlM-X7gvcPQYFRjLqY4vzpKV3q8ikqN8lV_28InYkhAhoW_nYkGgKSa94pr05xznbLTVgjlx2xikZ8rEmAsf8NFNBTQ5gz1o97T3nqsF9hQY-1TNuGnZlJWXvVyKBIAzlc6OF9BlusZgwcCJBl3KgGla-_qa9IWZmzVza0CjRUhD2WiBbGb9DRenosC69DAm_slgAB3STpk2vc16t7olrVCIcP_ZXlkKgXMXED7VPwP2qaubxuN5LTIVB5BtkRZm5u0z4-cn4Y_m8VEhcD3mAJUyJif6K1CxyicXTDTQUsdP1O9gvNb4PmPZhsAZIKxlQiHmPidfxHL_N1-q-POYOWcphSgj0eOV0WjMJa8LmWmVN3WRkz6o&sai=AMfl-YTCxPgo3kVTGnKYWlj753VuHDwW0RPR6FPlD3kY9Bn-1vYQV5OAZTBVHm1l1p3ENWwqGsU2zT3yc4zgBpiaCLB6h5rQqpIX998X2ShPNMnIjrnKXuBqCVg3D6hdaoR5SXeR5iAlRUs4PkD6mOxC5Qbpw-IFByj3Zya3n_Hp96IWJS74czRdqGyA6-owGW1BkjV5QQO-8NszHww_FIkIHg&sig=Cg0ArKJSzDObA9LZud02EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=217&cbvp=1&cstd=213&cisv=r20220809.25085&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Thu, 11 Aug 2022 18:04:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 9A80
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENJyf9CcyOIjO9R87qqJXfw&google_cver=1

43 B
114 B

52ms
32ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENJyf9CcyOIjO9R87qqJXfw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJi-ZRDrxZABGJrtq84BMAE&v=APEucNWKlqEkPjcSIpfVxtWrjihNHqaFOKc6kNQbEOp7dD9O6FBAoOnQiz9pssRX2Wv0TCacLTWt0epguO414PupPH-tFAJ1mddwu_qgMcoGZYE4M4wtU4XqTeqLXFBQoOxO3z88Jwkm
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENJyf9CcyOIjO9R87qqJXfw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 9A80 43 B
304 B 103ms
31ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJi-ZRDrxZABGJrtq84BMAE&v=APEucNWKlqEkPjcSIpfVxtWrjihNHqaFOKc6kNQbEOp7dD9O6FBAoOnQiz9pssRX2Wv0TCacLTWt0epguO414PupPH-tFAJ1mddwu_qgMcoGZYE4M4wtU4XqTeqLXFBQoOxO3z88Jwkm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 9A80
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEEsj-xZmagWXoVJ3kRv3pxM&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEEsj-xZmagWXoVJ3kRv3pxM&google_cver=1&__user_check__=1&sync_id=0193bf9d-19a0-11ed-a735-192cb16e0506

43 B
549 B

42ms
42ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEEsj-xZmagWXoVJ3kRv3pxM&google_cver=1&__user_check__=1&sync_id=0193bf9d-19a0-11ed-a735-192cb16e0506
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJi-ZRDrxZABGJrtq84BMAE&v=APEucNWKlqEkPjcSIpfVxtWrjihNHqaFOKc6kNQbEOp7dD9O6FBAoOnQiz9pssRX2Wv0TCacLTWt0epguO414PupPH-tFAJ1mddwu_qgMcoGZYE4M4wtU4XqTeqLXFBQoOxO3z88Jwkm
Protocol: HTTP/1.1
Server: 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 18:04:13 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 118
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Thu, 11 Aug 2022 18:04:13 GMT
Server: nginx
Location: /partner?adv_id=7025&uid=CAESEEsj-xZmagWXoVJ3kRv3pxM&google_cver=1&__user_check__=1&sync_id=0193bf9d-19a0-11ed-a735-192cb16e0506
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 100
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9A80
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MDE5M2JmNjMtMTlhMC0xMWVkLWE3MzUtMTkyY2IxNmUwNTA2

170 B
188 B

52ms
52ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MDE5M2JmNjMtMTlhMC0xMWVkLWE3MzUtMTkyY2IxNmUwNTA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJi-ZRDrxZABGJrtq84BMAE&v=APEucNWKlqEkPjcSIpfVxtWrjihNHqaFOKc6kNQbEOp7dD9O6FBAoOnQiz9pssRX2Wv0TCacLTWt0epguO414PupPH-tFAJ1mddwu_qgMcoGZYE4M4wtU4XqTeqLXFBQoOxO3z88Jwkm

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 11 Aug 2022 18:04:13 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=MDE5M2JmNjMtMTlhMC0xMWVkLWE3MzUtMTkyY2IxNmUwNTA2
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 144
Connection: keep-alive
Content-Length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C168 0
20 B 76ms
76ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_XZKnET1YofFF5OZ3gOM1aKwAwAAAAA4AeAEAg&bg=!3N-l35vNAAa4hXTbmIU7ACkAdvg8WtzHS7da5y_bzYr58paPS_wqvky73oqkKOnB9l6KP0yJIdDPegIAAABNUgAAAAFoAQeZAyRpZA2QIqzMg0UPG5UREaileI9ZulJFPPN6VhLRH7NuH7XX6kWh35oUQiM_r6kutKBZrUYi36YbaV4tQAkoBjZsZ0aktosJJ4Mj1qK7PJ1rGtQ0_Yv-In9TGEBO88TiEVWkxiiX51FfnEkd95_zZN0pH-ut3CNjjhj5FzbzEE7hhJviJzDGVeTninYND0wO6vcADBwdgg5y7tq5fspRYn23tsrl64naOC5_pW7GolnK6OQlXBeZd_F1n4tHe_1dqniVI8Rlxvdya1rNoj9U5jzQlVGJLfJDLNmp8MBk5Zy0QdXaqpFdgvKrcvyvJSjj8wwjATIAKO1IuoBOh8hRDXzvYFSPa34wBD-TL11ILefK6jloDHWKWdNCvvnakHoQL52QBomSHLr05QY-FnS1JcHHNpmGOuRv9NybaGIW6QmKf_RMVO7HT6e_gY1jLUaxltfrWZL8A6t6HVLmphKIQl-SAhV22U5o5DieEwKKoO_oho0UFBh8Sw0MRv5HDVo9zqq58ApPI0tzHlkTJsEjdmHYiIukdZaKITTz1zbpEZXNM7YPlTGtOW_RUYPjhQCbfjXUaJUuG8n8KG3oDhNGJSQTRT7B5e7vkQ0b436EBFskY9RTxsJpzkxKhQCQzHuqESWFoeVEiGcjc-vNh0JWrfYC_BWpek6Eg49v0NPc68ng1iWTuzPFW1oy050poqAvC4glwvkxJth4dQDTHc9Wq-mdqo6SywUoKB51n9KQDyzAHl1f56_luSY1OKFut6mSzwSKIgHxWPG2HAfMGwgSGOwH01xvJ9sExD9G5LGORVm_FsECgbhJfH2pYOoKFuOjCkMi3DauTwEcWx2MAwWtB3VLImWsKEOKNfW4IRMx9Qv-5IF3FdIZssrqRtLhfejC4W8nEJ1ugzyyFMfuNiwJ4uTOfQfL03-Rzo_2JnswpCmLpVkFXTXzxTzrCnvjB7kMwupN-goVlOW6LVAbWzRBV024Qf3vZC1NcOlipG53-EG9taqBYk9ZvE9JEn2fR_zaCQ0AHe_jhe_XYt_byWjfn8igWVTYKVG2iYwzpQUZgxYPkqDTlu4

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7897 41 KB
15 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DltNW67KFsGWwephV1k6Vftc9goxT_xsxHUxgaDwRsKznD_Frt2I8GSIcpASuYSPp2k4S_7KRH41WjSPEqhUnGjtrj1ww-BpVz8PY6NqCc6HuKkZG80dU9Rn9vb-iOh36z35Pcde1UwJSADj7vn--eIvBLpw&cry=1&dbm_d=AKAmf-BLzw6xDpyUXovY-z-LZssq2tB8G6ZiExKkH2Fku3H-FIwTO-hqaRDvFJmCC5HIEJdLhjCAHhl3cSOMsF73bYSFFjNBdHnHRQF5b5PubYkD-OxBtHPjcDExFevS8CQfDk1B7Gbvwsc5foN2g0Iq_8K7K4m0rnEF3gBFOT5HQKa3IYqeB6gclTMemK1PXovl8e2QqrihhEPw1LLOOlJGBdQ37Bft7qBAnh0atmhKLhqboOZWhLxwy-q5MyDEqzcqb-Z1oU149pDsUGsyNjtqIly75mxskpNJlUiux2f-xAUGFkh-JZvGz2w21c9NzzcpFB5J3-xqzqq0wyOPq8Pjrzt04r5iKAwuA4lkKjZg14SF89iCtkPioAcU0BXPt_k3VupTDM7Dxc_QeBQe_pkfKobGAXUpKAB5YjlIvetKJtslgZaHqjYmYUXddV4Ym9ui9Y5Ks6li6sLqtmqIaKiIl1O3F10QbkggWwwdu9No2KJA-nXbGpP4kyNSsMYqBMXK5epXkEotK1N-4Wu0aJPlJnISAEZHlMrQRB3KtQLUGq65o8rhsUKYKwwRJDRa6jzPPCBl2oB9DRwGte2KHh7i5ZhYkL8KQV-J-6swgiYNsAwPMzx4JXlgFLswYk8C7InmRt_EHo5Rx5Z3t0n9dbDXmlEYZ0zF2hDS2XBsYdh3rrANUFYMy-NK5bMMzwc-gNn05KL3X4kXfJqlKSbc8h_OWcVT0Ni1Ih2k3beg_ZV3MZLwUQzy4AG7Pa14wXlkZoG2-lgEULNAClP9QF2j8IpquP-RbowFPBTIVNfzixoIQrsi-HEAnzxsS0KJucGKQR-SeS6gKhHTiGmOxtoaojYXrJSqNVfozcLjceKqu4oBIVJDVbZZQ-Dr1h_DflaZvlH2BJAQK1AVo-cmRQi16qVsS8IfDaYULu0365S8XO2uaKzdhPIO80f4TPPvui-zg4fc7T5t8RIIlvExejSl_BmkTzW-1g2UmMfF68Menx8ZCWg9PjHpreCVSboWmc6aALKVmireaBlUmrCVz9nOVYkklBwgo8_K-wXJlOcWzfJMloK5eRdk9_U8YMb_Xs-vhb407JqnQn0XuuwnPL1M4UpwgKIDO8IMtK1JdiTVJ1g6jkFtuhv4FQuI-VmgYwbaI2mIa5_n9y956SCjmJ9t2HAYCb7FW_7ingdM5ktXbH0gFEev0icDX0Vpu8sxw6ZLyOGcJ59j7O7bMF3bRyh-wo6AsfRgnaVjD5tX9tQWAPDxMGtfhLScFOXMjlC5UtSkoYtmdKpt1ASVTw7EdPqGOf-udCwUmLN99okl_kj29LvLk-nvXdex7Xudndwl6Q4I30PnVbiktoR0Wokt9PN6eCOB_rHHRmJsmJqeXlrA-Ntglfob0uNm9duir0DDCjEQX-4g0nRfXx8KYdLqz09yVS25it9W7PSDeSVJeErdbpNdITe22WG-RQmseDn8bkUo5VOTQww_d3J9aLUCiRNPgLuOprg3mDrrSHFK16U_c-5dZtaimyPAbI5tsroL9Y7Nfimb42nWuenjM_wyqA_zwd58kyFOZLcvPKBycVLIFJzvIoZWKx_z3WZW5TR6VdUqNdaCnSe11DHCx05vsRScASnEAnWu3Lai5tVepBRR1AfwOm9iUZAIHn2wfiNXFGisB_GjrTnVQgg2n6WjzC_Mlwm80wZkwl8efwEqY-mQcLFFzM2Wg2bLjNDVVHxdRi8MvMhomyqiv34WIrnaSX0te3x-vvXC_-scW6VX6PXb9jZ9Pu0iTVaxZIUjUo6iKnto9bzXqex5fZytEzoGJM2BhBhYIYtkMtmO5zGJGiBYI8lRzqi_QnRJxt-xmP2aF2WqIXA3-L40L-YySJ9u1jG1gAW7M7pXkGyQC-xo0lFPNjlGLVaaKTH4ezXctiF62mReMzxDKwYzYkY0-I8AQqJT0BLMM5OOpU06YS74hxowznNfx5Aaw2JG7CwQp4JMT857OrSSg7iaP8xiYTSI2IZ436yJqgVG_Wu6asLanQoIohaFIVFqpuNKgcSa0eSRZoBDDDv8TdlguQ1Tq8XQw87HAUkexljTWSNWsYmGnXeg1glrckYZFp76IP1QTWgle7cLWK583SFXH_H3lv6H0SIv0lP2955pIgJrYFhFp7pi74z6dDbxrdl2JsVZveqnuWWHlGNhyIjgJhjxvbdu0d4HFd7y0KEkX_RLAb93bL9cql44UYC9--cn7R7ZOp9t57DOJT-_kD5a7JA3hLiX6EuyKrHwY5JP4s9gnYcKzYc8WOLxG17FUbwbf1nq45MD6E9m0WTQqvrKQgMDv1W_3wbpMR5lg5K87k7PyeupRZVzIk7VdjCcO54hzg-dRmIp5CNTJyophM4-n4UVXAAIgtQOsMPMDhyuXzXUD1bohPCYW6rvLPGuDsklv8pwIwhfHp5Kd9al3ca13KBeOCZQO47UNjqc5S8qeqNdSnI0lmU28RajWxfGxJJOq2ZzfCNmBhlPMm8O9kmfyACRvJ-CxULX-kjNCb83mcwwWaGeB6qkfmTcoMyyIdbnXP0BjgKSXO5O-8XUzzjITKFqgrImND1CBHzfc1WcSjKRkJGF_UJDNI_hBU_DIFj7oTLTwZZof0e9VvoIvYOy9B-cQGPwsSoK5t71omajeeXl4dLmbSZwvj0B2G83CV3McbDlNB9fr3zft7dOF_9n9GEuNbacIBp1XoHDrRryYw2TpoJtFa5lTINqvGy_ZqcA_5bneFYlhkZOKMGNaYuxz_kplAEopFG_uD1PXogAoPBP5o6RQrI27dE24lh7QuCujaj7yHX3TNwvA6AMswiduoNCYZ4oF-yWu4nyI8fcGOU39auf5rW2CYroo1pgatF-DFw&cid=CAASEuRoP8c8IUWptzvzCVolsPdeUQ&rfl=2%2Chttps%253A%252F%252Fwww.thetrainline.com%242%2Chttps%253A%252F%252F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:19:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 11 Aug 2023 17:19:05 GMT

GET
H2 200 bsi.js Show response
z.moatads.com/pbb847483933/ Frame 7897 51 KB
23 KB 139ms
40ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/pbb847483933/bsi.js
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f1f875833ddb7ecdb962369413465f1a6fff8a887398966d2d248e5a4d34e817

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: gzip
last-modified: Thu, 10 Mar 2022 18:39:25 GMT
server: AmazonS3
x-amz-request-id: 66JCQTHFSEE3Q7T0
etag: "302acac31c108dadcd3aed706c8787a1"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=21262
accept-ranges: bytes
content-length: 22862
x-amz-id-2: PYJaKYERr9d1HnSqIFmUvzQy+I7yKsUrtZnCZ08zkCAt0Dna1YxzP2INzOMyd6ib84PLD9uLV8g=

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5B95 236 KB
63 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Aug 2022 18:04:12 GMT

GET
H3 200 GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.js Show response
s0.2mdn.net/sadbundle/10973017770752807385/ Frame 5B95 55 KB
8 KB 41ms
41ms Script
application/x-javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2d475f7194edc3be74152816116dce645332a803e46543f1810db3b59f4689a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 17:14:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89356
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8249
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 09:09:46 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Aug 2023 17:14:56 GMT

GET
H3 200 _preloader.gif
s0.2mdn.net/sadbundle/10973017770752807385/images/ Frame 5B95 33 KB
33 KB 61ms
61ms Image
image/gif 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10973017770752807385/images/_preloader.gif

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8c3f6dfa9ed091e8b7eaab981a5146ad28ecd8cb4aac78348cc0bad61876ef5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 17:14:56 GMT
x-content-type-options: nosniff
age: 89356
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34194
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 09:09:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Aug 2023 17:14:56 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 281A 22 KB
8 KB 40ms
40ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 2706
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 17:19:06 GMT
expires: Fri, 11 Aug 2023 17:19:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js Show response
pagead2.googlesyndication.com/bg/ Frame 281A 36 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

749b6261f109108d21cb0e7043f83ff0d94a46c1dd8dad8965e6794fd345d238

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:22:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14301
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Aug 2023 17:22:02 GMT

GET
H3 200 GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1_atlas_1.png
s0.2mdn.net/sadbundle/10973017770752807385/images/ Frame 5B95 263 KB
263 KB 45ms
43ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10973017770752807385/images/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1_atlas_1.png

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e98628f1fd8f46f6211a4a706b073e1620d84b8562bedafe97015aaca3f40501

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 17:14:56 GMT
x-content-type-options: nosniff
age: 89357
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 268802
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 09:09:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Aug 2023 17:14:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 915D 0
26 B 159ms
78ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuWB8ojk6PFdFZ-t78YyhtCjrgD0cGwI7vcGzIe6aGSO4j9jEHbaCRYUaVoekUEjQz-JglzqM66O4TioeMWudiu7nae-kB2vKPXDJOeA0wtGMcKuSWJdqzTCao9pUJ3QNajMmZdKWR8kWGvLPvEZo_4w9Qka7VubRys_sEQ5q9vFrvL3QvXu9-H7Wn4wiHCSkykywKRGl8zCVWab-HjWVQ5ihy6Is2wJPgrPirA7Jxq6Xpj22i-WDsUHmEMEDXqKGKXy94UuJlFxvTRolm4ZvmymU6sAt-nv5Cn3OjomFQmC2D7Qmainm_wN0axfBHECjwh0s4w03Ok-gnMzRw-abp6ldrUYXBzCrD0AmwPByS2ERPwKZ5K3nhsAqs0Rn6miqil1Tr3zgifEOw-VBaj2QEqwa_WxtNkj_ZkFkQR4EfBemOpcJUlrS2MNyvtO0drcrFBW6bcELx3wcXvAu3azZ3FXKu6stP1iz5N8wxHT_9hmQJG2y4IJQTtKebqoMFpudGPVdO3Vb90VQitQ2b2reFrwwx3ZF0Ox8_7cmNVXTydS4m2uo55xVhESUW55SVjWh4rUSPfnjm2Irxv0_rNSXHh3ojW3d4_9bIpwKQtAyk7xRtT9a0yP4JC2Z27fOPDsGr3xfVNFSCLU1qGVEOZ2Ej0enM96p4jMgHNrZAIZsu-POWW-_c-uGIlC9sFwhT6kc6Sp3K-QUiEHr5TDYQZ0J4v9b-VvNJnNRKRZmU5BDfuyibDkS8N4EHzIt0ml2g5os_A0ckroJnjEVJ6s5ftye_PhHroPhJ95WWuQ79Pa3JWZmOgMnrJ8iNQeNb7lkzfvdJv2z4sHKiGL3DvCzahBqEqM0jsm0fnuDCUqKI0XNTI_BRyT7jmKlPoblMJ7SpyV-Gycho9ZRc3522Q54hGfMhhSHdUIB1LUFrvAc-WU29Fob8IlM-X7gvcPQYFRjLqY4vzpKV3q8ikqN8lV_28InYkhAhoW_nYkGgKSa94pr05xznbLTVgjlx2xikZ8rEmAsf8NFNBTQ5gz1o97T3nqsF9hQY-1TNuGnZlJWXvVyKBIAzlc6OF9BlusZgwcCJBl3KgGla-_qa9IWZmzVza0CjRUhD2WiBbGb9DRenosC69DAm_slgAB3STpk2vc16t7olrVCIcP_ZXlkKgXMXED7VPwP2qaubxuN5LTIVB5BtkRZm5u0z4-cn4Y_m8VEhcD3mAJUyJif6K1CxyicXTDTQUsdP1O9gvNb4PmPZhsAZIKxlQiHmPidfxHL_N1-q-POYOWcphSgj0eOV0WjMJa8LmWmVN3WRkz6o&sai=AMfl-YTCxPgo3kVTGnKYWlj753VuHDwW0RPR6FPlD3kY9Bn-1vYQV5OAZTBVHm1l1p3ENWwqGsU2zT3yc4zgBpiaCLB6h5rQqpIX998X2ShPNMnIjrnKXuBqCVg3D6hdaoR5SXeR5iAlRUs4PkD6mOxC5Qbpw-IFByj3Zya3n_Hp96IWJS74czRdqGyA6-owGW1BkjV5QQO-8NszHww_FIkIHg&sig=Cg0ArKJSzDObA9LZud02EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=478&vt=11&dtpt=261&dett=3&cstd=213&cisv=r20220809.25085&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 a.js Show response
mb.moatads.com/ Frame 7897 259 B
433 B 187ms
34ms Script
text/html 3.9.57.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/a.js?callback=MoatHandleJsonpResponse_15121977&url=https%3A%2F%2Fwww.thetrainline.com&id=0&level1=28098374&level2=2318817&level3=340094502&level4=164924189&pcode=essenceukeedcmdisplaybs475485114131&tv=359f21c1e97-clean&ol=511372517&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-dYJF2iVmV38nsW5MfUWeGV63nryfnddNoipOGLOPg%2Fj24vrl5%2FmliBNlAlwWxmRnpyWz&rs=1-L5aj2Zz1Kg7M0g%3D%3D&sc=1&os=1-Ww%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=728&qe=90&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&slicer1=thetrainline.com&slicer2=www.thetrainline.com&zMoatENV=j&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatJS=3%3A-&zMoatADV=5488157
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/pbb847483933/bsi.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.9.57.182 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-9-57-182.eu-west-2.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: a3c9cd2b87743710db6966e960b932d5b43f53277f1039e58b1f317933e6ea2d

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "ca79e97c7626c83061bc28a347946ac01b55c145"
content-length: 259
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame 7897 43 B
274 B 58ms
50ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&i=PBB_HC&d=essenceukeedcmdisplaybs475485114131%3A28098374%3A3087879%3A340094502&gw=essenceukeedcmdisplaybs475485114131&bq=0&de=87332896&t=1660241053038&ac=1&ar=6337827-clean&version=2022.01&oi=4&ob=1&na=291247657&cs=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 11 Aug 2022 18:04:13 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0D40 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

age: 5816
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 16:27:17 GMT
etag: 48472445140208031
expires: Fri, 12 Aug 2022 16:27:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7897 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54c4a13accc3cfdd1446c911d40da36cdb07bce0d104bb83ca8ff50510050ade

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 281A 0
20 B 78ms
78ms Image
image/gif 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BPabNnET1YrH-L6yS7_UPto2C6AwAAAAAOAHgBAI&bg=!DA-lD0vNAAa4hXTbmIU7ACkAdvg8WhGhAt2zHy5BLNFYuly4g9_SnTykCN9RRMHSqfX9PCGuUD1VNwIAAABnUgAAAAFoAQeZA3IYOagiZCmTV1_iURnk2RyjXv0AllbppwTuzbhPvtJUKrjkXvB6olBsiOF1Gmdfo1WM70REdxw-7Zc_gdGA4EAv5UxZCVDVNzGGA2fwpDmTDWhnu_giav0jpKh_o88zvYUCMuucpWXhTO8V-T9uiDIyyFl8uPlKO-BFjGEtlhaVCu8uYcAvW7SMsp0tVVYDHEAdOvfsKde455_n8C4l5187qI4saYZH-D0RghMppV6wZDAthSgju-zPXebps-HAZ_54gzhOomAo8b8rQPMyFEqiOD3l9Icn67tJnX_3NsneV5E_cQBwlH_tn9ayYfQ4Yk_nq0D4laq6A1-ZhCfHZWC-LROlVK-Sl7sIuz7mflFJ2x4Bmspwb3DDL2L_C7Miz9hmC3bP05L80aUvQ_b_e_2sgRezATWOl4pRg--4oPe2Cit2-olMEYw9foLNSZVOsBIzniGBZVH3U4k7TNFh9tUJsqK-91DJaNIwUpJ1EsDz0VP1ZWC0ntdk7R-sjowYNyTEopCW_h5DcDAYWIXttvqM0ga3KHJnCavrigPpgt2ihsUzkhHITwwc4xBZunSYW4i1iZi5_1rCOIzse_oetM2OFKzkcxdcrBgGKmxMyf6XKRWZQZoDZbvtakB4kyZbT82nibiC61w0gjqomYVRla3iloRDDjG5pCii_IBqwssDnsgwZsa0iGtr0WYBMg1Xl_XWHlB5BvI3TFKcvcIRogPVRamaOn5K3YNECIRWGwDUjuAuxvjx6seqSJB0ryJcPJaH5TxOA0upHBxV4f-iJrdGHSBcN8zmHCXi7v8c728I5di8dv1s79YKgVSSpM2ojQYb76fq2S2BHwByGLU8071DE8KfR-i3YJIKB1erKGB9tyfEoCRFR959WNDdz_9iWPoahGW-tXbG7l53b9pudaG6AXe8G3_-1Qi7PnFDdq_C7OtPWkKMRMEzgZA0uT7-AoL8MwJwRiquxSoV0KqzZ55EWJX6zMBlSdwYQ3do5cRa7mSRyDrbdpYpF3QWqWZotfvF30o5aJrUOs1VWcRnYdKAE_jv_dBCVRSJnepfsJ9m0GHZVCu45wB7RfGo-PFFytAtl94WpPmjH3_2tpTZE4S7wkdglnbOi-y8JPpUr4ae6TDJwlQWmMX_WrIfBAVX9QWJBKWhNmYrB0jm_XTWz0d5-1g

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1_atlas_2.png
s0.2mdn.net/sadbundle/10973017770752807385/images/ Frame 5B95 399 KB
399 KB 42ms
42ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10973017770752807385/images/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1_atlas_2.png

Requested by

Host: 77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com
URL: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

198ebe7cf10b4cc5011a3adcde24267032b300bdcb832aef2b82dc4ddf9c666c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10973017770752807385/GUSU_Prospecting_ProgrammaticAds_July2022_728x90_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 17:14:57 GMT
x-content-type-options: nosniff
age: 89356
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 408912
x-xss-protection: 0
last-modified: Wed, 20 Jul 2022 09:09:46 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Aug 2023 17:14:57 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D40
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEMXqX5uqxP1E9VmYjCjkPmw&google_cver=1&google_push=AehlK4BrKaMs9CntSQkQNJ86_VY8dcZqNmCRtNcguPSMztShHd38lI2HQp10BFg0Mm9bASsvgL99fBwXXzn5rZ2W...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4BrKaMs9CntSQkQNJ86_VY8dcZqNmCRtNcguPSMztShHd38lI2HQp10BFg0Mm9bASsvgL99fBwXXzn5rZ2WTew9njPoMlBuIA

170 B
188 B

52ms
52ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4BrKaMs9CntSQkQNJ86_VY8dcZqNmCRtNcguPSMztShHd38lI2HQp10BFg0Mm9bASsvgL99fBwXXzn5rZ2WTew9njPoMlBuIA

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 11 Aug 2022 18:04:13 GMT
Server: MT3 4475 c1dc35a master cdg-pixel-x32 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AehlK4BrKaMs9CntSQkQNJ86_VY8dcZqNmCRtNcguPSMztShHd38lI2HQp10BFg0Mm9bASsvgL99fBwXXzn5rZ2WTew9njPoMlBuIA
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 11 Aug 2022 18:04:12 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D40
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESECjlr81lHyF6CSwfTkA52YM&google_cver=1&google_push=AehlK4D5L1YQ1T5E0Z7HgwU6YSpwQSZW_cUmls3qrhHp2O6KhY3GJHYZMomuOOJ2t9G0_zBdl3lfZSf_rQh...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AehlK4D5L1YQ1T5E0Z7HgwU6YSpwQSZW_cUmls3qrhHp2O6KhY3GJHYZMomuOOJ2t9G0_zBdl3lfZSf_rQh84COfz7B8rWVD8xS4Ww&google_hm=-PHw6LDIQwW5qdBtTf...

170 B
188 B

52ms
51ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AehlK4D5L1YQ1T5E0Z7HgwU6YSpwQSZW_cUmls3qrhHp2O6KhY3GJHYZMomuOOJ2t9G0_zBdl3lfZSf_rQh84COfz7B8rWVD8xS4Ww&google_hm=-PHw6LDIQwW5qdBtTfrGyWs

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AehlK4D5L1YQ1T5E0Z7HgwU6YSpwQSZW_cUmls3qrhHp2O6KhY3GJHYZMomuOOJ2t9G0_zBdl3lfZSf_rQh84COfz7B8rWVD8xS4Ww&google_hm=-PHw6LDIQwW5qdBtTfrGyWs
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 0D40 0
173 B 137ms
43ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEEfoXf5eDF_-PjES7blt098&google_cver=1&google_push=AehlK4AViC_x1W2KvCV_VpyK8GC2IMRtCXWZqMkFAMAEdWRXaHuH76JoXBwKptX5CQ4cbjs3NteZTbfGIHJ9qqLNvjF814ILLkTCBQ
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D40
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESENLnQnyajomW-6QXw1z9Eak&google_cver=1&google_push=AehlK4DnvyDfmPxYaOeVN81j1djbfTvPGHcViJvra78nbyA-rfUDpFeOa2Tl98s2PMjNMEH2s9uSqk1hKeWLeLAudGheycz...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESENLnQnyajomW-6QXw1z9Eak&google_cver=1&google_push=AehlK4DnvyDfmPxYaOeVN81j1djbfTvPGHcViJvra78nbyA-rfUDpFeOa2Tl98s2PMjNMEH2s9uSqk1hKeWLeLAudGhey...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AehlK4DnvyDfmPxYaOeVN81j1djbfTvPGHcViJvra78nbyA-rfUDpFeOa2Tl98s2PMjNMEH2s9uSqk1hKeWLeLAudGheyczYnWN8ww

170 B
188 B

50ms
50ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AehlK4DnvyDfmPxYaOeVN81j1djbfTvPGHcViJvra78nbyA-rfUDpFeOa2Tl98s2PMjNMEH2s9uSqk1hKeWLeLAudGheyczYnWN8ww

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AehlK4DnvyDfmPxYaOeVN81j1djbfTvPGHcViJvra78nbyA-rfUDpFeOa2Tl98s2PMjNMEH2s9uSqk1hKeWLeLAudGheyczYnWN8ww
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 dds
rtb.openx.net/sync/ Frame 0D40 43 B
350 B 103ms
32ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEO9qaWEN66TjoJic5bOvXCI&google_cver=1&google_push=AehlK4D5EDfbSrrrWLlK0iWeASuxk7EFMWTirh3fwLbTAC__cfT-M0D7Y2lrFvaKfnM8juFLyF_48x6hxQ-pWZkQScgw_QqJisPS9A
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:12 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ofti82a3b9mmrdach5eepelko8ob5dqg

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D40
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEEQUm8m0IEoS39xprBk7phc&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEQUm8m0IEoS39xprBk7phc&google_hm=YvVEnLnMTPUOF45LZ7cM1AAAETMAAAAB&google_nid=index&google_push=AehlK4BEwVjvYhbFUQiFsWyFHrZN7GrDdZbYN...

170 B
188 B

51ms
50ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEQUm8m0IEoS39xprBk7phc&google_hm=YvVEnLnMTPUOF45LZ7cM1AAAETMAAAAB&google_nid=index&google_push=AehlK4BEwVjvYhbFUQiFsWyFHrZN7GrDdZbYNII8b6jG13MR1_1csZIwW_vXJWFO_UO1-IQxYjAiBG4bQfR4SRPu81sZRSEk3Vux

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=35dgk9vMk896lDZrOWWUz3YNHxSRjO9%2Bd%2B1E9Z3TlvlWzZXIQyG5U52HVSEETDaIM2iiCY7hJGW0IMTVWlX2BiuLs1lO172qjqiaogwz2XsUJngDLGX94RI4Zdtblk3wX9v7AUP1bYvYgw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEEQUm8m0IEoS39xprBk7phc&google_hm=YvVEnLnMTPUOF45LZ7cM1AAAETMAAAAB&google_nid=index&google_push=AehlK4BEwVjvYhbFUQiFsWyFHrZN7GrDdZbYNII8b6jG13MR1_1csZIwW_vXJWFO_UO1-IQxYjAiBG4bQfR4SRPu81sZRSEk3Vux
cache-control: no-cache
cf-ray: 7392e476982788b6-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D40
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEEWht7z1maFYZzbZYOrekDo&google_cver=1&google_push=AehlK4CWTVXstytX7tqGRNDJZln-Iqb_XGyKKSQi-bMQR8cCxi-bvq__P86VG5QWy7PzXaPjE6fD5c9SrWDh3x1oF...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEEWht7z1maFYZzbZYOrekDo&google_cver=1&google_push=AehlK4CWTVXstytX7tqGRNDJZln-Iqb_XGyKKSQi-bMQR8cCxi-bvq__P86VG5QWy7PzXaPjE6fD5c9SrWDh3x1oF...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4CWTVXstytX7tqGRNDJZln-Iqb_XGyKKSQi-bMQR8cCxi-bvq__P86VG5QWy7PzXaPjE6fD5c9SrWDh3x1oF_wCj8TWzkJIQQ&google_hm=FIRctGZHrDAhQGS7TRKe...

170 B
188 B

52ms
52ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4CWTVXstytX7tqGRNDJZln-Iqb_XGyKKSQi-bMQR8cCxi-bvq__P86VG5QWy7PzXaPjE6fD5c9SrWDh3x1oF_wCj8TWzkJIQQ&google_hm=FIRctGZHrDAhQGS7TRKeI9g0

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 11 Aug 2022 18:04:13 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AehlK4CWTVXstytX7tqGRNDJZln-Iqb_XGyKKSQi-bMQR8cCxi-bvq__P86VG5QWy7PzXaPjE6fD5c9SrWDh3x1oF_wCj8TWzkJIQQ&google_hm=FIRctGZHrDAhQGS7TRKeI9g0
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0D40 0
12 B 49ms
49ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LBRkYfxJThiyLHCbZJX8mXlbLS0AtvXuScn2ga9rduaJaANbdvQyoMMnGmVkfcbrI698g6

Requested by

Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 04C6 74 KB
25 KB 170ms
86ms Script
text/javascript 108.177.15.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNVkMpAS0O3XM91GV7CLsORBhicb_05CVXxHqahmNvHfEa_mrdw&d=CnkAoCZ_4JnJ_JVM9MRObGdlig53oLYlGAbnSHDRT3pXXon5tzfb0mkJwNQsNOXiCRA_sD6XcpO_dJzErHVUewBpBPpSxwOk8XAdai1uIZ6_YPDEKwAG5Q0md9WAjZ0WriHrQeq2q06QUbEm6b-3z9yrfFslUlttHwRnEvkTAKAmf-B1Bzj6VcDEb_gCV-SfpxaVECuad4ffVemT-30W8iU6f5xdjr9zwG4MOaEJhuNBPrf5m6H1Yy1fVN9p5QBmHUrLENX3jY6sk-W3FFGYR0wnCQxAgZTX5zgsguYtoF6f2YKy8wNBdZgeuDONx-oJA9xumtdaXxEhIylw6BSdE5rwKDQFoEZyozJq0oJddTTKxpQUWlw6B2A3A_knmJljS_2dL-OJOHC15SI-hHmu7RJ3GphIJho7bfTT_O1EXeoASsQlYWQPKpzTf9_CS1ub5zNyafVVocBhwP6YH7Gvtei-BW07mr90HmocxKSGlvc6DRgjeDsGzMoVTntuYh4BQSFDeYqEennJZ2j7Dxp76DOQalk7rYdO2EDPNVgdNvyPRr-fEer9IQkYOsYixMC4IaHBmU9eeGrNfxPxLjJpPdT1EboA9Jwm6GEUtkbistNoNGIMTIUQWFE57oLjiK-rRdj0twwbVF6UBJfFR_iegkCCSB6YlMCzuQAkhgH_mfYbvi10AWeB2a1UDfpBpT7HI7rTr4jQPW47OBMGnSEeavDQbp9El0QV-lQLjGAp_LGQzFNLoHqRRXk0Fw6ud3iPcvUrjEk0wb1YjX2A8mv7Qj886ufoqiCIq5iYHnC_cwIVXefsxBHwc1K-QeeK1yRxSeF4JHxv5zjvW5USlgMcxcWBFc7jh6Qz2e-MQV8Uiaxm6le04B8A0wwlGC3K8O3Z2jHpKRseuGXObmHvbT6I_UJf7eP-jft-QOn5pzxK60JAzYbiqfsMQz7_5IZnuyQ6Mr5jzcU9YhZmA4Ei6tsuHIbV1eLQr0NRoGN7lDnSzYBS8Rl4y8ghMC_WJ8mxzLSzZhWUfuGK29SsDmIFd99uIz1sd-t8hlKohrZa7jer8QD87esU-piJB7AXwRBaYX4Q3an9TLfJbUjgHqlGXymoZA-uOp5z-d6guWsinTbCoFBkKTFHVpP9HQE0u6HNAJApqZApJdP_2OYqx311iXmmAYYzvL3G7qT1EQuEQ5JxHaw9fLuvanD506OmhhCESY4-Ry3VR3wybIzk23aIEW7NVm-4K0FJh_AkJWPbEG3lSWeqa1xTIysfuMfWpc9OeXkC1TyB1c56Eihyj-eo58NuEnyBF1B8G9shcaQIcR1mHbe7pS__vwW4pKUMEFECGbeP7LNPa6Ky81jkpWeer3jrMsqksIyhzJxTBJcPKFEGECFRPMHnOpaENeNJ9A0dcApOzrZEDvFE6VZiZlPRWjGb3GTkQVkfu_Him5ucpmHWIAy0-l0myeLytLdMTqUhu7ti0NIEbJ7m7tUp8KAJ_41Cwfa07YXCXQMbOPMxYwnEg6zON1LAa43xRh2LvGcPswmEW93ZpR2irsADMbg5APjOrbnQFeHd-nrPl66wPuyBj2F_9smSv-eNChsnCPNaf7APj8Z_ES6GhcahK2zDOQBgtnRJZJCyk5ddvUa7kxIrKP5DzUkJ52WYt1BtrsScLAEwJqkBSbtgaUN7Z-Fuuqj_df-zM8WqDqkRp7BEB7D56MRqP9HYA4azP-Qx-WDxunaNQT1e7jnSQufMpHbDzatiYhEBMT6LgJpzQCCMy9Oj4anPfLAoDPVbZjIx8Xs791Dx1sQxHa0U9y_rwZJ_Gv1QYrK9WzYQ6-SYCfHYEAbUMdNM84JFtb82Iznj62fzBB6NJ7iaUtWz7LYXBC3s06IxA_o-CXrMXbqUMtWmzR38E-_DmcKuNbS8okvqlMUAgu7SIDBmqCizht72ROW2yaRTO8NA151yD7fIw7muj4rQCgNoKT79s1aM6YwsNfTG9iHX9NEpigY83ifluN1H7a-DE_eiR3OFXw-LYyDwOhYhQyMFwP-bYQ5Dz_2csEbsvCbjcizwXngW7D-8VHmYjdB778JhBZP4SUV_38ZCh4J3tGtrZuw2KwkCKbydTSw-xEabONfM-J3zTLVfE0SzcnwgZwA7KBAos3imG0krGBRbwLktsoQwTqsOL0I0fnlviOdt_0hlRiAxpcOoTLYA-zv45a4kvpyGIXp19RnkiZ4-7Uhx5mgisIYoSNUI6XPyL4qCaP8zxzWRtsIcLcZRP_DrnyNgWctRK_4yib4uimJ0B0LqtC9OU2iV9HeK8LXfnx6ucG5oT-UVUac1eewnhF29yj8lBJw6bTgqxmx-drDsVFUWH58pdO3J3xDoevm6GVckrkJrMKPCv9GLL1yzXT9k_BFMK2ipMwAZALMT3GA8GgU5JJRvDAP1fmWPQ0BfSNj9Osuj-90bqoFt4AzsQfsAtxtz2EXVCFy9DiXPTlqKigL6wZOpfMOPlEryM9prnL3_LRjfVO4xg5y9_wTdSj_LIgwkrkc-33BjwhiCeBt8wdzV2USKdJGKKxdbv4JUSyhsu4b9jmqFBj5mAwGRI5S2lC7ej1Yw5XBHvpmecSpYnnLTFK9NJayQQ79kRx-A-jx6tT_cfAAg3gtUPYY2D6P6Wtm1Q1XtgJXS19ziyiiubP8hjE2JBy-3iBRj5mfajIycJgQ0BPu9E2iD1h5Q1YuVZjtKTb2vMsqWipb8pbYXYAj6lK2iBbeFRs4SQWvCJE1oMRdiXXghae4k3EiM6dxcsLn2q1FvYQmTEAbSMZWq1I_Keg1VEdIoL5vkjf-sseQk9pUhQt3F3ZbAGZ3NDSJnSlJzC4mvGq3K2p9N01hNKVZ5gOXQ4eGtIPsDDtDVOsTbjijeXla9znmyvVPguMbBVTitjSQ5Fy1LqGu4SrfEZ-oDPRjKzO_IFfM43LlpN5B0aOMbu-Ek7eUPsmqTAM6PF61lC_MCohaGX58EdNILrXil-FHq5ykbQtg1a9nDc7PKshh7oX8pGoUoNXo1MJootfRvuyIq_Bpwx4mFqv5Bh3Dad1d9zSjrZFCaGAXkYO0WqEURv40ONPgogpIpVDc0Ypp_hlGmRJ1AKUK0RzNDld1Ps-Q5mGOK9sJyrwCdYe9iTZfMgLQ8m_c3HJMYSe1h77KEKpsPxhAe1qqiN1SD2XezxirSsbNmVvk7EvsqXl3deWztku-caqBTOoU3wHIo2cDLR9jelonAe6f-1BIy5i6SMS1-e8ocrszy5B2JZzJnYlqf5zK9UeJKQuoVtV81w_y77PED5OhVLMtYSjxy_teJAks-2YJ6jsJGZROtevUruHYkeTez4QfN2cBtL9HR66VyxOSpzG251xBha_5iRV_s1FbxZ_dqhpfKX9ExevDHHc_ak3h8SH-Ak18CPWKetG_kjlUrr55cbtzvZeMTBwO4I_L5tjSzsSqP0xFrQzd5V8b8CQvUSpg5POr1MeKkOgu7YTqOCcKzpX8WRy8v4oaxmBx59f2VqdjqFUsdgqd6ncLopqDV4x6ke0O7PGhq2JIBm2434Y76yY0EHEtavfViw8zbmnHUGhYIABIS5Gg_xzwhRam3O_MJWiWw915RYAE

Requested by

Host: z.moatads.com
URL: https://z.moatads.com/pbb847483933/bsi.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f154.1e100.net

Software

cafe /

Resource Hash

7f536d6f4d5afe39dfbff3d64f345aa568d9821e2795e5b43362738c1cf80110

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24632
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 7897 43 B
274 B 42ms
42ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&i=ESSENCE_UK_EE_DCM_DISPLAY_BS2&d=28098374%3A3087879%3A340094502%3A-&gw=essenceukeedcmdisplaybs475485114131&bq=0&de=90573072&t=1660241053252&ac=1&ar=6337827-clean&gu=https%3A%2F%2Fwww.thetrainline.com&id=0&ii=2&ob=4&gq=5&zMoatDTYPE=4&hw=2&gv=gs_travel_type%2Cgs_travel%2Cdomain_safe%2Cgs_travel_type_rail%2Cmoat_unsure&zGSRC=1&zMoatGSTS=0&zMoatINS=3&tv=359f21c1e97-clean&oi=4&zMoatLT=%7B%22t0%22%3A1660241052840%2C%22ta%22%3A1660241053038%2C%22t1%22%3A1660241053060%2C%22t2%22%3A1660241053249%2C%22t3%22%3A1660241053249%7D&oj=189&zMoatENV=j&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatL1=28098374&zMoatL2=2318817&zMoatL3=340094502&zMoatL4=164924189&zMoatJS=3%3A-&zMoatADV=5488157&zMoatBo=thetrainline.com&zMoatBd=www.thetrainline.com&zMoatAISJS=1&na=126216215&cs=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 11 Aug 2022 18:04:13 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
DATA 200
OK truncated
/ Frame 4CC7 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5fc855ef615ded095b27b98345320f56b2dddf209eddd2dc66a4964ec59d4463

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 04C6 170 KB
59 KB 121ms
40ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
Origin: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 11:11:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24751
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 Aug 2022 11:11:42 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/elements/html/ Frame 04C6 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/elements/html/omrhp.js

Requested by

Host: bid.g.doubleclick.net
URL: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNVkMpAS0O3XM91GV7CLsORBhicb_05CVXxHqahmNvHfEa_mrdw&d=CnkAoCZ_4JnJ_JVM9MRObGdlig53oLYlGAbnSHDRT3pXXon5tzfb0mkJwNQsNOXiCRA_sD6XcpO_dJzErHVUewBpBPpSxwOk8XAdai1uIZ6_YPDEKwAG5Q0md9WAjZ0WriHrQeq2q06QUbEm6b-3z9yrfFslUlttHwRnEvkTAKAmf-B1Bzj6VcDEb_gCV-SfpxaVECuad4ffVemT-30W8iU6f5xdjr9zwG4MOaEJhuNBPrf5m6H1Yy1fVN9p5QBmHUrLENX3jY6sk-W3FFGYR0wnCQxAgZTX5zgsguYtoF6f2YKy8wNBdZgeuDONx-oJA9xumtdaXxEhIylw6BSdE5rwKDQFoEZyozJq0oJddTTKxpQUWlw6B2A3A_knmJljS_2dL-OJOHC15SI-hHmu7RJ3GphIJho7bfTT_O1EXeoASsQlYWQPKpzTf9_CS1ub5zNyafVVocBhwP6YH7Gvtei-BW07mr90HmocxKSGlvc6DRgjeDsGzMoVTntuYh4BQSFDeYqEennJZ2j7Dxp76DOQalk7rYdO2EDPNVgdNvyPRr-fEer9IQkYOsYixMC4IaHBmU9eeGrNfxPxLjJpPdT1EboA9Jwm6GEUtkbistNoNGIMTIUQWFE57oLjiK-rRdj0twwbVF6UBJfFR_iegkCCSB6YlMCzuQAkhgH_mfYbvi10AWeB2a1UDfpBpT7HI7rTr4jQPW47OBMGnSEeavDQbp9El0QV-lQLjGAp_LGQzFNLoHqRRXk0Fw6ud3iPcvUrjEk0wb1YjX2A8mv7Qj886ufoqiCIq5iYHnC_cwIVXefsxBHwc1K-QeeK1yRxSeF4JHxv5zjvW5USlgMcxcWBFc7jh6Qz2e-MQV8Uiaxm6le04B8A0wwlGC3K8O3Z2jHpKRseuGXObmHvbT6I_UJf7eP-jft-QOn5pzxK60JAzYbiqfsMQz7_5IZnuyQ6Mr5jzcU9YhZmA4Ei6tsuHIbV1eLQr0NRoGN7lDnSzYBS8Rl4y8ghMC_WJ8mxzLSzZhWUfuGK29SsDmIFd99uIz1sd-t8hlKohrZa7jer8QD87esU-piJB7AXwRBaYX4Q3an9TLfJbUjgHqlGXymoZA-uOp5z-d6guWsinTbCoFBkKTFHVpP9HQE0u6HNAJApqZApJdP_2OYqx311iXmmAYYzvL3G7qT1EQuEQ5JxHaw9fLuvanD506OmhhCESY4-Ry3VR3wybIzk23aIEW7NVm-4K0FJh_AkJWPbEG3lSWeqa1xTIysfuMfWpc9OeXkC1TyB1c56Eihyj-eo58NuEnyBF1B8G9shcaQIcR1mHbe7pS__vwW4pKUMEFECGbeP7LNPa6Ky81jkpWeer3jrMsqksIyhzJxTBJcPKFEGECFRPMHnOpaENeNJ9A0dcApOzrZEDvFE6VZiZlPRWjGb3GTkQVkfu_Him5ucpmHWIAy0-l0myeLytLdMTqUhu7ti0NIEbJ7m7tUp8KAJ_41Cwfa07YXCXQMbOPMxYwnEg6zON1LAa43xRh2LvGcPswmEW93ZpR2irsADMbg5APjOrbnQFeHd-nrPl66wPuyBj2F_9smSv-eNChsnCPNaf7APj8Z_ES6GhcahK2zDOQBgtnRJZJCyk5ddvUa7kxIrKP5DzUkJ52WYt1BtrsScLAEwJqkBSbtgaUN7Z-Fuuqj_df-zM8WqDqkRp7BEB7D56MRqP9HYA4azP-Qx-WDxunaNQT1e7jnSQufMpHbDzatiYhEBMT6LgJpzQCCMy9Oj4anPfLAoDPVbZjIx8Xs791Dx1sQxHa0U9y_rwZJ_Gv1QYrK9WzYQ6-SYCfHYEAbUMdNM84JFtb82Iznj62fzBB6NJ7iaUtWz7LYXBC3s06IxA_o-CXrMXbqUMtWmzR38E-_DmcKuNbS8okvqlMUAgu7SIDBmqCizht72ROW2yaRTO8NA151yD7fIw7muj4rQCgNoKT79s1aM6YwsNfTG9iHX9NEpigY83ifluN1H7a-DE_eiR3OFXw-LYyDwOhYhQyMFwP-bYQ5Dz_2csEbsvCbjcizwXngW7D-8VHmYjdB778JhBZP4SUV_38ZCh4J3tGtrZuw2KwkCKbydTSw-xEabONfM-J3zTLVfE0SzcnwgZwA7KBAos3imG0krGBRbwLktsoQwTqsOL0I0fnlviOdt_0hlRiAxpcOoTLYA-zv45a4kvpyGIXp19RnkiZ4-7Uhx5mgisIYoSNUI6XPyL4qCaP8zxzWRtsIcLcZRP_DrnyNgWctRK_4yib4uimJ0B0LqtC9OU2iV9HeK8LXfnx6ucG5oT-UVUac1eewnhF29yj8lBJw6bTgqxmx-drDsVFUWH58pdO3J3xDoevm6GVckrkJrMKPCv9GLL1yzXT9k_BFMK2ipMwAZALMT3GA8GgU5JJRvDAP1fmWPQ0BfSNj9Osuj-90bqoFt4AzsQfsAtxtz2EXVCFy9DiXPTlqKigL6wZOpfMOPlEryM9prnL3_LRjfVO4xg5y9_wTdSj_LIgwkrkc-33BjwhiCeBt8wdzV2USKdJGKKxdbv4JUSyhsu4b9jmqFBj5mAwGRI5S2lC7ej1Yw5XBHvpmecSpYnnLTFK9NJayQQ79kRx-A-jx6tT_cfAAg3gtUPYY2D6P6Wtm1Q1XtgJXS19ziyiiubP8hjE2JBy-3iBRj5mfajIycJgQ0BPu9E2iD1h5Q1YuVZjtKTb2vMsqWipb8pbYXYAj6lK2iBbeFRs4SQWvCJE1oMRdiXXghae4k3EiM6dxcsLn2q1FvYQmTEAbSMZWq1I_Keg1VEdIoL5vkjf-sseQk9pUhQt3F3ZbAGZ3NDSJnSlJzC4mvGq3K2p9N01hNKVZ5gOXQ4eGtIPsDDtDVOsTbjijeXla9znmyvVPguMbBVTitjSQ5Fy1LqGu4SrfEZ-oDPRjKzO_IFfM43LlpN5B0aOMbu-Ek7eUPsmqTAM6PF61lC_MCohaGX58EdNILrXil-FHq5ykbQtg1a9nDc7PKshh7oX8pGoUoNXo1MJootfRvuyIq_Bpwx4mFqv5Bh3Dad1d9zSjrZFCaGAXkYO0WqEURv40ONPgogpIpVDc0Ypp_hlGmRJ1AKUK0RzNDld1Ps-Q5mGOK9sJyrwCdYe9iTZfMgLQ8m_c3HJMYSe1h77KEKpsPxhAe1qqiN1SD2XezxirSsbNmVvk7EvsqXl3deWztku-caqBTOoU3wHIo2cDLR9jelonAe6f-1BIy5i6SMS1-e8ocrszy5B2JZzJnYlqf5zK9UeJKQuoVtV81w_y77PED5OhVLMtYSjxy_teJAks-2YJ6jsJGZROtevUruHYkeTez4QfN2cBtL9HR66VyxOSpzG251xBha_5iRV_s1FbxZ_dqhpfKX9ExevDHHc_ak3h8SH-Ak18CPWKetG_kjlUrr55cbtzvZeMTBwO4I_L5tjSzsSqP0xFrQzd5V8b8CQvUSpg5POr1MeKkOgu7YTqOCcKzpX8WRy8v4oaxmBx59f2VqdjqFUsdgqd6ncLopqDV4x6ke0O7PGhq2JIBm2434Y76yY0EHEtavfViw8zbmnHUGhYIABIS5Gg_xzwhRam3O_MJWiWw915RYAE

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c9499ea51a2956fd2c1600591ae117fe9ad81065d625b1b2c593c7720e5b228f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:00:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3181
x-xss-protection: 0
server: cafe
etag: 18418590997839133011
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 18:00:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/ Frame 04C6 31 KB
12 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220809/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73a8c4643090bc508a479abca9b19393744e21ab711641ee147c2495dfd3d8b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 99
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11917
x-xss-protection: 0
server: cafe
etag: 3600686600815956419
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 18:02:34 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/essenceukeedcmdisplay403072119649/ Frame 04C6 329 KB
110 KB 42ms
41ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/essenceukeedcmdisplay403072119649/moatad.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b33e127893068ae086ec64b5df2aef9ea9a176ec722a791d1d6bcd3ab66ba8d6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 15:27:37 GMT
server: AmazonS3
x-amz-request-id: TV2R94GBGA5X0AQ7
etag: "b3b514d31ba5f86ea7e5f46dfe11d9cc"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=26168
accept-ranges: bytes
content-length: 112316
x-amz-id-2: d8tn3gfI5Hm66R/w3kbdt06hJR9I2fUOkH04hPUlTLaEdOMHWidFBg4aMTg78sS4AvH9+xYi6HA=

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/ Frame AE35 1011 B
518 B 48ms
48ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a838d5b54fc29f2b96139145232872943e6aad4fe9d8cd5155a9e3e5437dd9f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 490
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 18:04:13 GMT
expires: Fri, 11 Aug 2023 18:04:13 GMT
last-modified: Thu, 27 Jan 2022 16:02:27 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 04C6 0
26 B 79ms
78ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstmHAeNnAtNzZA1wOe3FzFfOInTyP3hgcuOBpvr19M-NkIgZ-Ok7dbMqPeHyTep_nnZHYDWfDBBuv-vw97hNkBBNpSaK1XSVZHcsNa0JgHtqxyuAwcHkb9oqUkMY6KR2ARQd7gckWAFSBdvjFbsu-JwoxWtr_U79AUnijy_fNk9&sai=AMfl-YRq6gYKsbWOhat1TYuECdXFUsGlH73B4SO99PvU2O2aAPmkoeMF53lQ8HcB8kcwxDHUthRBiM6V9uEcYsLJRcn6o1rZQis5Doc&sig=Cg0ArKJSzJiUqm9A-ssPEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=186&cbvp=1&cstd=181&cisv=r20220809.78276&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame AE35 118 KB
40 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 16:26:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5888
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 Aug 2022 16:26:05 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/ Frame AE35 11 KB
2 KB 44ms
43ms Stylesheet
text/css 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/style.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4b2ed4a4e1db05da07b13c5341c732379b916df3a41bed15f4e50bc4c7f3a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 444503
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2128
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 16:02:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 06 Aug 2023 14:35:50 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame AE35 57 KB
23 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 200 preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame AE35 55 KB
14 KB 53ms
51ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

291fcf6b0aea583079f4ea7c943852ddd668ad895ee08b0b557b372040d205a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14120
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 200 essence.js Show response
s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/ Frame AE35 22 KB
4 KB 44ms
43ms Script
application/x-javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/essence.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f7d14e2851e50862360ba5ed85f0ba063d9037057ff325f604c5bbfcc589543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 16:46:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91081
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3806
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 16:02:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Aug 2023 16:46:12 GMT

GET
H3 200 logic.js Show response
s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/ Frame AE35 20 KB
4 KB 45ms
44ms Script
application/x-javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/logic.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c792d7635acdb79263e27dd910a746fe6052832103ba9d47a59ae5c9b6e35573

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 14:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 444503
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4419
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 16:02:27 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 06 Aug 2023 14:35:50 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ Frame 7897 97 B
269 B 50ms
35ms Script
text/html 3.9.57.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=2649142652&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-xKZpxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-U21WeGF%2FRxwnGA%3D%3D&sc=1&os=1-Vw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=728&qe=90&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=ESSENCE_UK_EE_DCM_DISPLAY1&ob=1&dMoatBDS=0&hp=1&ra=1&pxm=3&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com&lp=https%3A%2F%2Fwww.thetrainline.com&t=1660241053785&de=998932248176&m=0&ar=1da355aa18f-clean&iw=d451a40&q=2&cb=0&ym=0&cu=1660241053785&ll=2&lm=3&ln=1&r=0&em=0&en=0&d=28098374%3A2318817%3A340094502%3A164924189&zMoatENV=j&zMoatADV=5488157&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thetrainline.com&id=0&ii=2&bo=thetrainline.com&bd=thetrainline.com&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=essenceukeedcmdisplay403072119649&fd=1&it=500&ti=0&ih=2&pe=0%3A456%3A456%3A0%3A868&jk=-1&jm=-1&fs=199703&na=1233161937&cs=0&ord=1660241053785&jv=1822726963&callback=DOMlessLLDcallback_35395336
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/essenceukeedcmdisplay403072119649/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.9.57.182 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-9-57-182.eu-west-2.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: 415e566f6b14317312af09740e04c0e88fb71e59e3caeb3bf219626770f2a98e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "27074425e450fe4353a9a4bd3bb5441fc30bf991"
content-length: 97
content-type: text/html; charset=UTF-8

GET
H2 200 v2 Show response
mb.moatads.com/s/ Frame 7897 185 B
358 B 40ms
40ms Script
text/html 3.9.57.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/s/v2?url=https%3A%2F%2Fwww.thetrainline.com&pcode=essenceukeedcmdisplay403072119649&ord=1660241053785&jv=787702613&callback=BrandSafetyNadoscallback_35395336
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/essenceukeedcmdisplay403072119649/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.9.57.182 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-9-57-182.eu-west-2.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: 5ef9b587df0fce43ead4b2c161468a2ce0d0fe38e5e9bb4ae7239cd5f8ada582

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:13 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "1329b3a5cb131a2d506d79ac51574c4334273340"
content-length: 185
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame 7897 43 B
274 B 40ms
39ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ESSENCE_UK_EE_DCM_DISPLAY1&ob=1&dMoatBDS=0&hp=1&ra=1&pxm=3&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com&lp=https%3A%2F%2Fwww.thetrainline.com&t=1660241053785&de=998932248176&m=0&ar=1da355aa18f-clean&iw=d451a40&q=3&cb=0&ym=0&cu=1660241053785&ll=2&lm=3&ln=1&r=0&em=0&en=0&d=28098374%3A2318817%3A340094502%3A164924189&zMoatENV=j&zMoatADV=5488157&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thetrainline.com&id=0&ii=2&bo=thetrainline.com&bd=thetrainline.com&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=essenceukeedcmdisplay403072119649&fd=1&it=500&ti=0&ih=2&pe=0%3A456%3A456%3A0%3A868&jk=-1&jm=-1&fs=199703&na=1704018553&cs=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 11 Aug 2022 18:04:13 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:13 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 04C6 0
26 B 76ms
76ms Ping
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstmHAeNnAtNzZA1wOe3FzFfOInTyP3hgcuOBpvr19M-NkIgZ-Ok7dbMqPeHyTep_nnZHYDWfDBBuv-vw97hNkBBNpSaK1XSVZHcsNa0JgHtqxyuAwcHkb9oqUkMY6KR2ARQd7gckWAFSBdvjFbsu-JwoxWtr_U79AUnijy_fNk9&sai=AMfl-YRq6gYKsbWOhat1TYuECdXFUsGlH73B4SO99PvU2O2aAPmkoeMF53lQ8HcB8kcwxDHUthRBiM6V9uEcYsLJRcn6o1rZQis5Doc&sig=Cg0ArKJSzJiUqm9A-ssPEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=380&vt=11&dtpt=194&dett=3&cstd=181&cisv=r20220809.78276&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:13 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 4121_20211215042944202_Logo_728x90_v1.png Show response
s0.2mdn.net/ads/richmedia/studio/4121/ Frame AE35 5 KB
5 KB 42ms
41ms XHR
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20211215042944202_Logo_728x90_v1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bdc6d47e46813a5bc318bdea925c6b10be1f5e9632506379031969b902e7e88e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
X-Requested-With: XMLHttpRequest
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 19:07:22 GMT
x-content-type-options: nosniff
age: 82611
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4854
x-xss-protection: 0
last-modified: Wed, 15 Dec 2021 12:29:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Aug 2022 19:07:22 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame AE35 7 KB
5 KB 166ms
83ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bba4e121b575b4d4d0cf63b159f601cc733abce35ef9ee4a7ba7d963a2471759

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5597
x-xss-protection: 0

GET
H2 200 pixel.gif
essenceukeedcmdisplay403072119649.s.moatpixel.com/ Frame 7897 43 B
260 B 299ms
51ms Image
image/gif 2.20.73.145
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essenceukeedcmdisplay403072119649.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=52&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=thetrainline.com&L1id=28098374&L2id=2318817&L3id=340094502&L4id=164924189&S1id=thetrainline.com&S2id=thetrainline.com&ord=1660241053785&r=998932248176&t=meas&os=0&fi2=0&div1=0&ait=0&url=https%253A%252F%252Fwww.thetrainline.com&mobile=0&initSRE=0.034125&initH=90&initW=728&bedc=1&q=1&BSD=safe&BSC=gs_travel_type_rail,gs_travel,gs_travel_type,moat_unsure&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.73.145 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-73-145.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
H2 200 pixel.gif
essenceukeedcmdisplay403072119649.s.moatpixel.com/ Frame 7897 43 B
260 B 300ms
53ms Image
image/gif 2.20.73.145
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essenceukeedcmdisplay403072119649.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=52&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=thetrainline.com&L1id=28098374&L2id=2318817&L3id=340094502&L4id=164924189&S1id=thetrainline.com&S2id=thetrainline.com&ord=1660241053785&r=998932248176&t=bs&os=0&fi2=0&div1=0&ait=0&url=https%253A%252F%252Fwww.thetrainline.com&mobile=0&initSRE=0.034125&initH=90&initW=728&bedc=1&q=2&BSD=safe&BSC=gs_travel_type_rail,gs_travel,gs_travel_type,moat_unsure&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.73.145 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-73-145.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 7897 43 B
274 B 40ms
40ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&ob=1&dMoatBDS=0&hp=1&ra=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2Fsadbundle%2F14319481515514265600%2FEE_Consumer_Dynamic_Geolocation_Q4_2021_728x90%2Findex.html%3Fe%3D69%26leftOffset%3D0%26topOffset%3D0%26c%3DowMhlNlv3x%26t%3D1%26renderingType%3D2%26ev%3D01_247&i=ESSENCE_UK_EE_DCM_DISPLAY1&ol=2649142652&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-xKZpxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-U21WeGF%2FRxwnGA%3D%3D&sc=1&os=1-Vw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=728&qe=90&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thetrainline.com&id=0&ii=2&f=1&j=https%3A%2F%2F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com&lp=https%3A%2F%2Fwww.thetrainline.com&t=1660241053785&de=998932248176&cu=1660241053785&m=69&ar=1da355aa18f-clean&iw=d451a40&cb=0&ym=0&ll=2&lm=3&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=94&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A456%3A456%3A0%3A868&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=52&cd=0&ah=52&am=0&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=28098374%3A2318817%3A340094502%3A164924189&bo=thetrainline.com&bd=thetrainline.com&gw=essenceukeedcmdisplay403072119649&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatENV=j&zMoatADV=5488157&hv=findIframeAds&ab=2&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=2&jk=-1&jm=-1&tc=0&fs=199703&na=99202075&cs=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 11 Aug 2022 18:04:13 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:13 GMT

GET
H3 200 EE%20Nobblee%20Regular.ttf
s0.2mdn.net/creatives/assets/4381778/ Frame AE35 175 KB
46 KB 42ms
41ms Font
font/ttf 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4381778/EE%20Nobblee%20Regular.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

209d6a53fc85301549cf10ccece3c82cc921bf931bac70e3e98750ead7f0cecc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/style.css
Origin: https://s0.2mdn.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:55:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 540
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47220
x-xss-protection: 0
last-modified: Thu, 09 Dec 2021 15:42:43 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 11 Aug 2022 18:10:13 GMT

GET
BLOB 200
OK d6ecf73f-a3e3-42ea-b815-86e66ecc2ad6
https://s0.2mdn.net/ Frame AE35 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://s0.2mdn.net/d6ecf73f-a3e3-42ea-b815-86e66ecc2ad6
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bdc6d47e46813a5bc318bdea925c6b10be1f5e9632506379031969b902e7e88e

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Length: 4854
Content-Type: image/png

GET
H3 200 4121_20210629025856782_pixel.png Show response
s0.2mdn.net/ads/richmedia/studio/4121/ Frame AE35 108 B
137 B 41ms
41ms XHR
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20210629025856782_pixel.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ee7ce04e2656eeb176a3fa57208d9c5e39062b77bcccf1ccbfb13264ebe5b6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
X-Requested-With: XMLHttpRequest
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 14:24:30 GMT
x-content-type-options: nosniff
age: 13183
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 108
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 09:58:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 Aug 2022 14:24:30 GMT

GET
BLOB 200
OK ef51bc89-0d42-4d76-8f70-92f0ef65b367
https://s0.2mdn.net/ Frame AE35 108 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://s0.2mdn.net/ef51bc89-0d42-4d76-8f70-92f0ef65b367
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ee7ce04e2656eeb176a3fa57208d9c5e39062b77bcccf1ccbfb13264ebe5b6d

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Length: 108
Content-Type: image/png

GET
H3 200 4121_20210629025856782_pixel.png Show response
s0.2mdn.net/ads/richmedia/studio/4121/ Frame AE35 108 B
138 B 41ms
41ms XHR
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20210629025856782_pixel.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ee7ce04e2656eeb176a3fa57208d9c5e39062b77bcccf1ccbfb13264ebe5b6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/14319481515514265600/EE_Consumer_Dynamic_Geolocation_Q4_2021_728x90/index.html?e=69&leftOffset=0&topOffset=0&c=owMhlNlv3x&t=1&renderingType=2&ev=01_247
X-Requested-With: XMLHttpRequest
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 14:24:30 GMT
x-content-type-options: nosniff
age: 13184
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 108
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 09:58:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 Aug 2022 14:24:30 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame 7897 43 B
274 B 41ms
40ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&ob=1&dMoatBDS=3&zMoatLT=%7B%22t0%22%3A1660241052840%2C%22ta%22%3A1660241053038%2C%22t1%22%3A1660241053060%2C%22t2%22%3A1660241053249%2C%22t3%22%3A1660241053249%7D&oj=189&gq=5&zMoatDTYPE=4&oi=4&zMoatGSTS=0&hw=2&gv=gs_travel_type%2Cgs_travel%2Cdomain_safe%2Cgs_travel_type_rail%2Cmoat_unsure&zGSRC=1&hp=1&ra=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=ESSENCE_UK_EE_DCM_DISPLAY1&ol=2649142652&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-xKZpxzFtVWlgP6m3tVv3EhYKQlBk9l%2Bd1Ss78ABRGBCPEpCfxlXpQB8EOC0dEk1CVCWz&rs=1-U21WeGF%2FRxwnGA%3D%3D&sc=1&os=1-Vw%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=728&qe=90&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=1&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&zGSRS=1&gu=https%3A%2F%2Fwww.thetrainline.com&id=0&ii=2&f=1&j=https%3A%2F%2F77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com&lp=https%3A%2F%2Fwww.thetrainline.com&t=1660241053785&de=998932248176&cu=1660241053785&m=206&ar=1da355aa18f-clean&iw=d451a40&cb=0&ym=0&ll=2&lm=3&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=94&le=1&lf=62&lg=1&lh=32&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A456%3A456%3A0%3A868&aa=0&ad=72&cn=0&gk=72&gl=0&ik=72&ic=72&ez=1&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=52&cd=52&ah=52&am=52&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=28098374%3A2318817%3A340094502%3A164924189&bo=thetrainline.com&bd=thetrainline.com&gw=essenceukeedcmdisplay403072119649&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatENV=j&zMoatADV=5488157&hv=findIframeAds&ab=2&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=2&jk=2&jm=-1&tc=0&fs=199703&na=2076612478&cs=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Thu, 11 Aug 2022 18:04:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
H2 200 pixel.gif
essenceukeedcmdisplay403072119649.s.moatpixel.com/ Frame 7897 43 B
260 B 204ms
54ms Image
image/gif 2.20.73.145
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essenceukeedcmdisplay403072119649.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=72&fi=1&apd=196&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=thetrainline.com&L1id=28098374&L2id=2318817&L3id=340094502&L4id=164924189&S1id=thetrainline.com&S2id=thetrainline.com&ord=1660241053785&r=998932248176&t=hdn&os=1&fi2=0&div1=0&ait=0&url=https%253A%252F%252Fwww.thetrainline.com&mobile=0&initSRE=0.034125&initH=90&initW=728&bedc=1&q=3&BSD=safe&BSC=gs_travel_type_rail,gs_travel,gs_travel_type,moat_unsure&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.73.145 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-73-145.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
H2 200 pixel.gif
essenceukeedcmdisplay403072119649.s.moatpixel.com/ Frame 7897 43 B
260 B 206ms
55ms Image
image/gif 2.20.73.145
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essenceukeedcmdisplay403072119649.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=72&fi=1&apd=196&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=thetrainline.com&L1id=28098374&L2id=2318817&L3id=340094502&L4id=164924189&S1id=thetrainline.com&S2id=thetrainline.com&ord=1660241053785&r=998932248176&t=fv&os=1&fi2=0&div1=0&ait=0&url=https%253A%252F%252Fwww.thetrainline.com&mobile=0&initSRE=0.034125&initH=90&initW=728&bedc=1&q=4&BSD=safe&BSC=gs_travel_type_rail,gs_travel,gs_travel_type,moat_unsure&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.73.145 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-73-145.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
H2 200 pixel.gif
essenceukeedcmdisplay403072119649.s.moatpixel.com/ Frame 7897 43 B
260 B 206ms
56ms Image
image/gif 2.20.73.145
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essenceukeedcmdisplay403072119649.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=72&fi=1&apd=196&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=thetrainline.com&L1id=28098374&L2id=2318817&L3id=340094502&L4id=164924189&S1id=thetrainline.com&S2id=thetrainline.com&ord=1660241053785&r=998932248176&t=nht&os=1&fi2=0&div1=0&ait=0&url=https%253A%252F%252Fwww.thetrainline.com&mobile=0&initSRE=0.034125&initH=90&initW=728&bedc=1&q=5&BSD=safe&BSC=gs_travel_type_rail,gs_travel,gs_travel_type,moat_unsure&nu=1&ib=0&dc=1&ob=0&oh=1&lt=0&ab=0&n=1&nm=1&sp=0&pt=0
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.20.73.145 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-73-145.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 18:04:14 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
BLOB 200
OK 6f367a2e-7f6a-4453-be40-2995fee77a38
https://s0.2mdn.net/ Frame AE35 108 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://s0.2mdn.net/6f367a2e-7f6a-4453-be40-2995fee77a38
Requested by: Host: eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com
URL: https://eac6b2efc7b7364fde6eb3506965c916.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ee7ce04e2656eeb176a3fa57208d9c5e39062b77bcccf1ccbfb13264ebe5b6d

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Length: 108
Content-Type: image/png

GET file.mp4
gcdn.2mdn.net/videoplayback/id/c9c25e2d3220e90e/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/ip,ipbits,expire,id,itag,sour... Frame AE35 0
0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame AE35 17 KB
6 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 18:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 18:04:14 GMT

GET
H3 200 dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js Show response
pagead2.googlesyndication.com/bg/ Frame A594 36 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/dJtiYfEJEI0hyw5wQ_g_8NlKRsHdja2JZeZ5T9NF0jg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

749b6261f109108d21cb0e7043f83ff0d94a46c1dd8dad8965e6794fd345d238

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 17:22:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2532
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14301
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Aug 2023 17:22:02 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4CC7 14 KB
11 KB 96ms
95ms XHR
application/json 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022080801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e04cb1b7ded28924c46ff8d36cc6404cb4b4004d437e4125afb5955f8a0964cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://77a6e40e2777037a87578ae422746125.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 18:04:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11024
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4CC7 0
0 160ms
77ms Fetch
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstu1cSvpqh7ZD74U0k3b-8tfpSALyn1s7BXP0u-u9BiwndqoEtsoU4F5ubCRJobCm6qHxAdKo6zbs1lvaLMg5amxJ4d9UHQX-VE0f1YVDmKpMB-eUtLOGs16ne1L9tHmkrA-HQmlWw9rfFG5eQC7fD5cDCQhFcA5ldqEgIMOc2PZOoK2tPDTI6pY5zBaetDjFtwMrpYvTw7hCzfUUx9ahiqvFYtAO7uVe57Ur4qhA7NvkESJgXIHPwQ_4picsI8hLjJfHlFZUgSrZvIrnOcEs7TSCAXT0zdPETNsCMOi4Vs9AjZKfrGY4H3hliW_nXDeRayBNaZcrZMAEicYGpSEbTwPuUHjw81Bv_roXIO&sai=AMfl-YREhSmc4-9f7gUZAcrvoMk7jMYG8pfMMVt5C2l-eznBaMCF5xcepXvwv2WXbmdgqr8CYF-LqZrE46c-R4gwT5Wmx8gczP4IuJ989aYqzSooriZwVk35b-RxkAs9eg&sig=Cg0ArKJSzF9dWPXuf15EEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS