thiennhienkythu.com Open in urlscan Pro
104.21.16.11 Public Scan

fra16s45-in-f14.1e100.net

Software

cafe /

Resource Hash

78ef244a58ef97751f4d1f3bd020ab86a5c27b5ed7622be1d75d33dc9b1b24ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thiennhienkythu.com/
Origin: https://thiennhienkythu.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51251
x-xss-protection: 0
server: cafe
etag: 3061142114851435867
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 07 Oct 2021 06:05:27 GMT

GET
H2 200 tie-scripts.js Show response
thiennhienkythu.com/wp-content/themes/sahifa/js/ 78 KB
24 KB 16ms
15ms Script
application/javascript 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thiennhienkythu.com/wp-content/themes/sahifa/js/tie-scripts.js
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 29dff356fdf5f1de3bb18da300895838b214cb8fcd1af58e7e984a29817b6315

Request headers

:path: /wp-content/themes/sahifa/js/tie-scripts.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 11 Jun 2016 19:55:18 GMT
server: cloudflare
etag: W/"575c6ca6-13831"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9AvHd0Pm8m2fzPcYPfWhfYGBCEooDZFBBJ6xGsveyGffqfckAjKm%2FXva3W6AMzXThU2j6qVYeqi9IA2Ti4DaAT4%2FJs5pRBaDIF%2BbsTJyxZ7OBPS7%2FiBes3i66Gm47ArCWjDRmemF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 69a4f01869e26901-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H2 200 ilightbox.packed.js Show response
thiennhienkythu.com/wp-content/themes/sahifa/js/ 75 KB
23 KB 19ms
17ms Script
application/javascript 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thiennhienkythu.com/wp-content/themes/sahifa/js/ilightbox.packed.js
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 77b74a5bce714f35bfcde3cd6624f4ace3fbb31adeea328660110d7cd6849d72

Request headers

:path: /wp-content/themes/sahifa/js/ilightbox.packed.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 11 Jun 2016 19:55:18 GMT
server: cloudflare
etag: W/"575c6ca6-12d6e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eTI5JmiLq58l6%2BRt%2FvHhoJyYxSpwOpE3Fn6xKWv8ODu0Ka1e3JyYQ%2B4VgdmcM%2Fs7Nf95gVoyjpwDQ4gxYLNL7o9rNwqItiG5sM70ssNdZp08rqTCab7DnXj6qhEBzdte0c8J%2BmbK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 69a4f01869e36901-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H2 200 wp-embed.min.js Show response
thiennhienkythu.com/wp-includes/js/ 1 KB
995 B 17ms
16ms Script
application/javascript 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thiennhienkythu.com/wp-includes/js/wp-embed.min.js
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path: /wp-includes/js/wp-embed.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 11 Jun 2021 02:56:06 GMT
server: cloudflare
etag: W/"60c2d0c6-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1iCSjBMOvg30sJ56u2ISCpeIvWwD2a3nofwi1uf%2BSJAe0WSAuTJfYFPFXf4vi9y9jCYQi3nnmqO7xPi5mgmnea4Vz2s2D60FLjDZyYkoXFfixXJ%2BuFk59lYiKYbhGvbiYlp%2FMft"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 69a4f01869e56901-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H2 200 search.js Show response
thiennhienkythu.com/wp-content/themes/sahifa/js/ 15 KB
4 KB 25ms
24ms Script
application/javascript 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thiennhienkythu.com/wp-content/themes/sahifa/js/search.js
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: d6c6d0b6440485f2536e96758b074c4713ef69a56511f2af2128f23ce6eebdca

Request headers

:path: /wp-content/themes/sahifa/js/search.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Sat, 11 Jun 2016 19:55:18 GMT
server: cloudflare
etag: W/"575c6ca6-3aa2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6LqMEzT2Gq57Lpzu5%2FayBenvbYPM1xfgsU5C7gYzPXc2pQGlF3sG1j6mh9DM8pvfGGWeRTS%2B5x%2BzHmaYoSGisgWb2MhGZ6vhqbej4ahaxnHx8wo1bHH7bbDReb4eSmK3EjAmV1c8"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 69a4f01869e66901-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 wp-emoji-release.min.js Show response
thiennhienkythu.com/wp-includes/js/ 18 KB
5 KB 15ms
14ms Script
application/javascript 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thiennhienkythu.com/wp-includes/js/wp-emoji-release.min.js
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 29 Jul 2021 05:30:25 GMT
server: cloudflare
etag: W/"61023cf1-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RNRZ7OyCC6QJ2lRaY7fDOALOAuGwcP5C3aInR%2BnuBbOPw9V%2Fc8XoGyqNdr9WEa1AKIxJPHi0xpf%2BYVt85a7LwK9nSi%2BWa2UxGpheNImtqn7K%2FOYJZjRcl5H3OejxCsAS5ZtA9rLL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 69a4f018a8654327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 33ms
8ms Script
text/javascript 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4710
date: Thu, 07 Oct 2021 04:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Thu, 07 Oct 2021 06:46:57 GMT

GET
H3 200 body-bg7.png
thiennhienkythu.com/wp-content/themes/sahifa/images/patterns/ 21 KB
21 KB 15ms
15ms Image
image/png 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/themes/sahifa/images/patterns/body-bg7.png
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 7a6ac6e588a725241e6f43feaad46fb36de9682576f5f29c570edc3ec5247477

Request headers

:path: /wp-content/themes/sahifa/images/patterns/body-bg7.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21146
last-modified: Sat, 11 Jun 2016 19:55:18 GMT
server: cloudflare
etag: "575c6ca6-529a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rHju6%2FREwpwhNiZnSt2WQN2zDqOt4MjzS6LN3c2Rz9tH6wSBiCXbCY%2BqaryxOwAcQ6cK%2BFqnwCsCgRi80i15yFDNVKftP0PhHAex4N4N1Z78cS2qEf%2Bcq1d2qTV1tD2nYbKZNUVW"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f018c8b14327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 fontawesome-webfont.woff2
thiennhienkythu.com/wp-content/themes/sahifa/fonts/fontawesome/ 70 KB
71 KB 18ms
17ms Font
font/woff2 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thiennhienkythu.com/wp-content/themes/sahifa/fonts/fontawesome/fontawesome-webfont.woff2?v=4.6.3
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

:path: /wp-content/themes/sahifa/fonts/fontawesome/fontawesome-webfont.woff2?v=4.6.3
pragma: no-cache
origin: https://thiennhienkythu.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
Origin: https://thiennhienkythu.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 71896
last-modified: Sat, 11 Jun 2016 19:55:18 GMT
server: cloudflare
etag: "575c6ca6-118d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BJoR6fpxKw%2BfNve8mnskxUbQH7GsaTQNO1nFuy2rM4L53qAY4uXE%2FWgdbOLVM7zSRePQ72UrKneK0j%2FlskP6Ws64RklwBQ2xmZ9Brr%2Bi1YH92hz84PzaTdB6r5hf1DPuaXszVyNQ"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 69a4f018c8cc4327-FRA
expires: Thu, 21 Oct 2021 05:35:47 GMT

GET
H2 200 SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v12/ 21 KB
21 KB 31ms
7ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3Aregular%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

a615849237c0ce94e73fc69d86e5f9c58bdaca8d9756a5ff4c88fa86b14e6177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://thiennhienkythu.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 18:02:17 GMT
x-content-type-options: nosniff
age: 302590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21232
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 01:56:42 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Oct 2022 18:02:17 GMT

GET
H3 200 stripe.png
thiennhienkythu.com/wp-content/themes/sahifa/images/ 93 B
729 B 12ms
11ms Image
image/png 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/themes/sahifa/images/stripe.png
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 23c79bb552706be2ca97bdb259921e3269a5263326b147676c2f7909a45b58c9

Request headers

:path: /wp-content/themes/sahifa/images/stripe.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/wp-content/themes/sahifa/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 93
last-modified: Sat, 11 Jun 2016 19:55:18 GMT
server: cloudflare
etag: "5d-5350608d7f580"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B4y%2BqshpZr4W4PIdbwSh%2F18Ds4CvPbj5ViAmX%2FJPAqUC%2FVBkRDgClr2nIpqEe9lErU5Fbb%2FYLlYUY%2F2RDUu48Xkgw4Yh16CcIB3c9LrUBY9JIlfskwSkH5ud7dPC0BPDvYYCIYmU"}],"group":"cf-nel","max_age":604800}
content-type: image/png
x-accel-version: 0.01
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f01909884327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210820_611f2e3510969-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 8 KB
8 KB 14ms
13ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210820_611f2e3510969-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: c3b77bda111c7a7d4c53f93bb6f221f5234b03aa14e52816a205a3491e61d4e3

Request headers

:path: /wp-content/uploads/2021/08/20210820_611f2e3510969-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 7884
last-modified: Fri, 20 Aug 2021 04:23:17 GMT
server: cloudflare
etag: "611f2e35-1ecc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8YLSQAEiNEUwLy06k7Bohwph%2Fu6SkFKvlCRowPHCN1ao9xYkO1iTKdLhRFrK4i37OCMQwxVmvYN0wo%2FQGoeT1Uusq3ZeenAc3yFMudgJj5fQfiOAQ%2F5xcwzwuZRvg%2FwkHUeWNByc"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f01949fa4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210820_611f11c5e92e5-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 10 KB
10 KB 15ms
13ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210820_611f11c5e92e5-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: b0e59cdcffa475bb83e2d4637c0fb6e626f6b4ec2c97584c7fda25b6fef1e705

Request headers

:path: /wp-content/uploads/2021/08/20210820_611f11c5e92e5-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9885
last-modified: Fri, 20 Aug 2021 02:22:10 GMT
server: cloudflare
etag: "611f11d2-269d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xTJfwGR672Tss5uFx6qAlmXsiKrNQgKFDLrDkBHRwa4JxtdsaU94OkdKetzMtVP8hcyyfmjDsDUad%2Bg07z%2Bd%2BgDXkCYSxbEI4Dq8AW1KHmEEAASWB6ACqOR4WH6PyFpRthYxmoFf"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f01949fe4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210819_611de105cb8cc-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 14 KB
14 KB 28ms
26ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210819_611de105cb8cc-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 8f07c930f36b0d76adeb289d22d7690788a29f6109c8283438e30f69e03567f0

Request headers

:path: /wp-content/uploads/2021/08/20210819_611de105cb8cc-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13946
last-modified: Thu, 19 Aug 2021 04:41:42 GMT
server: cloudflare
etag: "611de106-367a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HVqh3SodCunkQKybKbYkISq46Se2FIgfw2T896DfAuTZDkUsKk5gegGthYuHcetyTKoXknxLgK26ZQw4odj0NFll82pmPiUXVBXPurxaIG%2Bl6z5%2Fl2LfXFJN1L5cn8GY65NkSwIQ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a014327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210819_611dd2f44b297-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 8 KB
9 KB 16ms
14ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210819_611dd2f44b297-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: d6f1b478d14ee5faacfddf561fda9e2f02a199ebfffdaa8b6f68309088a26ef3

Request headers

:path: /wp-content/uploads/2021/08/20210819_611dd2f44b297-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 8687
last-modified: Thu, 19 Aug 2021 03:41:40 GMT
server: cloudflare
etag: "611dd2f4-21ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rwBrHETcB8w44dUufpOFTIcrDRSFYuBWzCo4k6kQ8PdNFFhD5NwgUmG1GP6TAflgLyNUOJTJpY45rY5mmf6WWjRtwwXR799BlinFOm9BYIRdqEsqvNVsiB%2FsYkmwodpdZUlZkKuM"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a034327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210819_611dcb81265d7-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 14 KB
15 KB 29ms
27ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210819_611dcb81265d7-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 099e0c110f560ecc0a326d8b05f64b9c2a35592247177a59dcb86ffc68c5face

Request headers

:path: /wp-content/uploads/2021/08/20210819_611dcb81265d7-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 14297
last-modified: Thu, 19 Aug 2021 03:09:56 GMT
server: cloudflare
etag: "611dcb84-37d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JFC51JCgDl2PV6Z2UgGJAVTYoVSI9GEShybz6XyC9jRt1qNtkzv%2FnMyxv9KI4nmzuWrFCNDFTpAil2cBYQQJV0vQNkdi8COhVX%2FRiYri7%2BtAplePQP4UZ4UUCty%2BWwMFw6NsBXgc"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a064327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611cd3a6dac01-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 6 KB
7 KB 30ms
27ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611cd3a6dac01-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 8239469918f9074d565cff58466254ef75db88bc9b70ea1f60390cd0967ce6a9

Request headers

:path: /wp-content/uploads/2021/08/20210818_611cd3a6dac01-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 6401
last-modified: Wed, 18 Aug 2021 09:32:23 GMT
server: cloudflare
etag: "611cd3a7-1901"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BZ2Fm0eUnOjmSAkm8c9oPc1WPbCCMNoSAyjGe7KsN8qNM4kHT9MjJs485smYOgKDitRAQqFVXg5%2BNzh3VqrCujCYIuXE8EDyb1Tb6dVPHA8aVHGnNjC1MzE9rzN0CkuWxuLoUWl5"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a094327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611cc58d5952e-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 10 KB
11 KB 24ms
21ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611cc58d5952e-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 1ecf794e43d598fccba2be2bfa9f0042308cf3e63a25bbc713436497dce08276

Request headers

:path: /wp-content/uploads/2021/08/20210818_611cc58d5952e-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 10373
last-modified: Wed, 18 Aug 2021 08:32:27 GMT
server: cloudflare
etag: "611cc59b-2885"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hZi4w1uTQP%2BmvH66BuJT%2BINHIpREQCWqmTceY3VchaPfbAGimzwSMNdmw3ZD7ybk%2FMHEyxdUA62xi29qC0NZV3kYw1sW2NdrleBp4rR923aQ6Dp2okgoWKQX8tx%2FNy%2BxqluinPTk"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a0a4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611c7e5410991-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 13 KB
14 KB 16ms
13ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611c7e5410991-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 9da24a449a3c4604d69bf252ac8a47a7e424d76f83d2c8ced188852558b0a61f

Request headers

:path: /wp-content/uploads/2021/08/20210818_611c7e5410991-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13770
last-modified: Wed, 18 Aug 2021 03:28:21 GMT
server: cloudflare
etag: "611c7e55-35ca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B6N49nKABFfIEX7uIvdo3lrR9LFJKomu570pQrb%2BY6rygYQ%2FHqdcljKMNsardh%2FBl8aHk%2FTHKdz%2FV%2FqXSIc%2FHOo%2FITXK00prc2LRH44rdj8Q%2B6BV3MTTlx%2B%2FqYTIQxHUgXuZnLMW"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a0c4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611c7031e8bd3-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 9 KB
9 KB 15ms
12ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611c7031e8bd3-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 8f4eb5abcb8fd41a5ebe7913cd85b70f407749e8798f3c31a1c2f420d530f8e5

Request headers

:path: /wp-content/uploads/2021/08/20210818_611c7031e8bd3-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 8926
last-modified: Wed, 18 Aug 2021 02:28:14 GMT
server: cloudflare
etag: "611c703e-22de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vc1QGIWAdBd8MY9OjObn%2BtJUmS1Hc2H6T9vKuI9JqrFkg1oAUyZ1%2FK7fy0iqlHmySWZnU48oaKz1gbU9TYyu0v11MIM%2F5QNUzKXWz7QOQY%2BMHc7w5C5TYMAA7EyiWFt8BrhCWzEI"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a0e4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210817_611b38db42514-310x165.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 17 KB
17 KB 29ms
27ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210817_611b38db42514-310x165.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 21669aed8f011ee1f19c199eeb037b5d6be0b69d10e020e12a076e4da6e2ae1f

Request headers

:path: /wp-content/uploads/2021/08/20210817_611b38db42514-310x165.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 16982
last-modified: Tue, 17 Aug 2021 04:19:42 GMT
server: cloudflare
etag: "611b38de-4256"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EZjgvzFIy337PUkIeVK4e8bNrS%2B50spcNf0DhHKrGdg5rf95qB5cVNawzZHrVNd5yi3zMBWdOG3Pf1fWv%2BBaht5zh5KcovSORk0WVsPZb17wmvhMjTc0rA1i4q81lyTwoQCqteXj"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a104327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210820_611f2e3510969-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 2 KB
2 KB 31ms
28ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210820_611f2e3510969-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: c371098b3298383b7cb765d5bb361e33e46032c895cae421fc538bab658f230d

Request headers

:path: /wp-content/uploads/2021/08/20210820_611f2e3510969-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1846
last-modified: Fri, 20 Aug 2021 04:23:17 GMT
server: cloudflare
etag: "611f2e35-736"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bGZxSXumXllx%2BivLzRGD77%2FozXBa25HH1dFqe2FOJMxgHIkyI27Z8dbNJ1Gk1kq3gGdkQ8246y3U2W3tdhVd3tFcoHZmrjk3wNz7kuHwhHSGkJto80ZA2cm8arhAjHY795eUmUdk"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a114327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210820_611f11c5e92e5-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 2 KB
3 KB 24ms
22ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210820_611f11c5e92e5-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 29d05cdb1e23f4e10d6d17c32f4a07479bcf489c015a6fb6b067daa2c9b4ee69

Request headers

:path: /wp-content/uploads/2021/08/20210820_611f11c5e92e5-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2483
last-modified: Fri, 20 Aug 2021 02:22:10 GMT
server: cloudflare
etag: "611f11d2-9b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5mieVumznKI9Yw0q8iM%2B4cb24puZUeCnw6j18WJmY0u1PXzM89dYa%2B%2Bjxz20iuSfmMbiK1q9RAsEgXtBU%2FqXC5WauEMnfOIB1aUvh8qi%2BjgwzvCBMeij6zJwDsjX9e1VUidcdc63"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a134327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210819_611de105cb8cc-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 3 KB
3 KB 25ms
23ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210819_611de105cb8cc-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 2fa1b633ec69420fab340de315f09c996ec387fce4b9ebfe4a0ce206ed8de60c

Request headers

:path: /wp-content/uploads/2021/08/20210819_611de105cb8cc-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2783
last-modified: Thu, 19 Aug 2021 04:41:42 GMT
server: cloudflare
etag: "611de106-adf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GFIt4qJJHtrwZ5MOOP%2BcWGTSSC0HMdwB4%2FjRjcI4UlqOMje5oClK7axai9y0GYiFM%2Frgj%2FCKIEwtgvJQrVb9BsyFAMYLKKhR1yO4Z3xxFJmWX31PGUg2bu%2FHt7D4nfleAeyyH84%2F"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a144327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210819_611dd2f44b297-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 2 KB
3 KB 31ms
28ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210819_611dd2f44b297-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: c9415421ca9b3694c68e2dcec6dab61b75e931fea06b61f834ba23b69cf4f0ae

Request headers

:path: /wp-content/uploads/2021/08/20210819_611dd2f44b297-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2124
last-modified: Thu, 19 Aug 2021 03:41:40 GMT
server: cloudflare
etag: "611dd2f4-84c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Piv6Jo%2B%2BoW7F%2Frvszz4E3cksa7%2FdEAic1XlsbNvB5uhuiI2ZbQdg%2FfU%2FX34%2FxsbbkUMovaMN%2FR0HovLEOlNUFiJ3ImsvcuEpX7V%2BkShJUyvPBW9ATo5HegKurLrah1VEsS8M2%2Fgs"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a174327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210819_611dcb81265d7-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 3 KB
4 KB 31ms
28ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210819_611dcb81265d7-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 6c290725cc09c6abdc5b37a24bb4492d5c5bdaae911b2863ea2aa23aa340f2b9

Request headers

:path: /wp-content/uploads/2021/08/20210819_611dcb81265d7-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3117
last-modified: Thu, 19 Aug 2021 03:09:56 GMT
server: cloudflare
etag: "611dcb84-c2d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=snHGt0EJa6%2FVHOXFjnrPyvQKIv1NjbI%2F7LYhgAkUcJxOwHb%2BL6cptrDcUlT4DjW%2BZ5IahwUYmBrOkd23TCl8I7KeP5xA7hUgk0FPH225xlMFgitdV%2Bxnj4VL6X79bP0irTUfCmcg"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a184327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611cd3a6dac01-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 2 KB
2 KB 25ms
23ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611cd3a6dac01-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 9a2041706bc97e60b64997635e5928b6356164a3185afd4cb5f768ac1b72029b

Request headers

:path: /wp-content/uploads/2021/08/20210818_611cd3a6dac01-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1738
last-modified: Wed, 18 Aug 2021 09:32:23 GMT
server: cloudflare
etag: "611cd3a7-6ca"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5yEEY%2FLQUjI7RafciSu0wRJ2gVGKSBYu9NyLGXrWiMg8%2FvazDYXk%2BuxdgFK%2BFIJenWdkE9x00LptOuhi7RV5zh6pi0sZ3sUGmFcaeXMxJCm0bk5ddBkWZAxmaBwx%2B8bBdDJIBFnS"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a1a4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611cc58d5952e-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 2 KB
2 KB 30ms
28ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611cc58d5952e-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 186ff796fd70857b01503aec8e25b0dd333d2a6b6b0f6952beac2f8312596fd0

Request headers

:path: /wp-content/uploads/2021/08/20210818_611cc58d5952e-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1852
last-modified: Wed, 18 Aug 2021 08:32:22 GMT
server: cloudflare
etag: "611cc596-73c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xlj2bpPNF9zGlqtpgQeMq1uS0uHR4TTJ5DAOQdHJ1K0PWK6whAN1NlaUqtCTSOVEOdeFeVEmaqHi201RKhBaX5ODQQx0vc%2BAFWwgZPFEnUJ0CjDZbwFyz4EL03j1VAVNoCcA0Cmq"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a1b4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611c7e5410991-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 3 KB
3 KB 25ms
23ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611c7e5410991-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: a7d4e1b3ef6c74e0b7543f7583666102344d4801a956bef1536a9224ed34b0a1

Request headers

:path: /wp-content/uploads/2021/08/20210818_611c7e5410991-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2760
last-modified: Wed, 18 Aug 2021 03:28:21 GMT
server: cloudflare
etag: "611c7e55-ac8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=htwGauvuiUPpHA0IQdfVSjbYc5hwdiQKxk7CnxSaGEsoZiVFfqTMtfCaG63KcjU%2BKabSGoJEdQw3%2BjIgMrhePFth4QNh%2BxGOIMUmVxBqXQvasSUL0qzVDDVTOHqatKWAOOf6iEA%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a1c4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 20210818_611c7031e8bd3-110x75.jpg
thiennhienkythu.com/wp-content/uploads/2021/08/ 2 KB
2 KB 30ms
29ms Image
image/jpeg 104.21.16.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thiennhienkythu.com/wp-content/uploads/2021/08/20210818_611c7031e8bd3-110x75.jpg
Requested by: Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.16.11 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 51c4c7d09895e28cda82c9d98c89af19f5bf779dcb508e253bd9980ecda992eb

Request headers

:path: /wp-content/uploads/2021/08/20210818_611c7031e8bd3-110x75.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thiennhienkythu.com
referer: https://thiennhienkythu.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:27 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1780
x-powered-by: PleskLin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1640
last-modified: Wed, 18 Aug 2021 02:28:14 GMT
server: cloudflare
etag: "611c703e-668"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9RNxeeKrGN342z42KtlA5RxXd%2FQeoPc%2BjJOVexVQQI0gYPPknCT06lfabmV8eZkNDCOHOyqOAB5pYmhO%2B1cn7ijMd5aECyOqHygw%2FfhWT5BwlHuqnGubfQKXV5nTbfl9ZJcmPBuy"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 69a4f0194a1d4327-FRA
expires: Sat, 06 Nov 2021 05:35:47 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/ 257 KB
95 KB 54ms
39ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1828578781656677&plah=thiennhienkythu.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1828578781656677

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d4c1f4ad75aa23200a7b5d63e1994b70f989742dbd44d04429045a0dab617b89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97185
x-xss-protection: 0
server: cafe
etag: 16231236622537800498
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 07 Oct 2021 06:05:28 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211004/r20190131/ Frame D831 10 KB
5 KB 56ms
13ms Document
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211004/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1828578781656677

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f14.1e100.net

Software

cafe /

Resource Hash

e59f39fd9be6b3737942676248d273b23f94ab60f7b7e608230d6a107dccb7ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211004/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thiennhienkythu.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 06 Oct 2021 15:14:38 GMT
expires: Wed, 20 Oct 2021 15:14:38 GMT
content-type: text/html; charset=UTF-8
etag: 10398570473303663775
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4601
x-xss-protection: 0
age: 53450
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 30ms
14ms XHR
text/plain 172.217.23.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1757043831&t=pageview&_s=1&dl=https%3A%2F%2Fthiennhienkythu.com%2F&ul=en-us&de=UTF-8&dt=Thi%C3%AAn%20nhi%C3%AAn%20k%E1%BB%B3%20th%C3%BA%20-&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=161106828&gjid=1986621486&cid=2019392783.1633586728&tid=UA-81408464-6&_gid=723063337.1633586728&_r=1&_slc=1&z=661922928

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://thiennhienkythu.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://thiennhienkythu.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
466 B 54ms
15ms XHR
text/plain 74.125.71.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-81408464-6&cid=2019392783.1633586728&jid=161106828&gjid=1986621486&_gid=723063337.1633586728&_u=IEBAAEAAAAAAAC~&z=2021708302

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.71.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wn-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thiennhienkythu.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 07 Oct 2021 06:05:28 GMT
content-type: text/plain
access-control-allow-origin: https://thiennhienkythu.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 209 B
664 B 44ms
19ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=thiennhienkythu.com&callback=_gfp_s_&client=ca-pub-1828578781656677

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1828578781656677&plah=thiennhienkythu.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

cafe /

Resource Hash

0f94e99f85ee5fdb0199dbf95f4b204ab29bce77cc38d7bce7a2740b1249f7d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 198
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 43ms
21ms Script
application/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thiennhienkythu.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 78ms
30ms Script
application/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thiennhienkythu.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C831 101 KB
34 KB 288ms
273ms Document
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&adk=3046330955&adf=2044148826&lmt=1633586728&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthiennhienkythu.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728097&bpp=4&bdt=379&idt=116&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1069728112185&frm=20&pv=2&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=144

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c7c021aafb2dd5ff51fab094db339e492353ba9b9a4a58c645e73d82c011fb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1828578781656677&output=html&adk=3046330955&adf=2044148826&lmt=1633586728&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fthiennhienkythu.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728097&bpp=4&bdt=379&idt=116&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1069728112185&frm=20&pv=2&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=144
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thiennhienkythu.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 07 Oct 2021 06:05:28 GMT
server: cafe
content-length: 34908
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 07-Oct-2021 06:20:28 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 07 Oct 2021 06:05:28 GMT
cache-control: private

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
522 B 50ms
21ms Image
image/gif 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-81408464-6&cid=2019392783.1633586728&jid=161106828&_u=IEBAAEAAAAAAAC~&z=1544359077

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 74ms
31ms Image
image/gif 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-81408464-6&cid=2019392783.1633586728&jid=161106828&_u=IEBAAEAAAAAAAC~&z=1544359077

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 35ms
21ms XHR
application/json 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211004&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

59bee28aeb37181b8b53a088a1afb04e371b9023a926fcfa06ba9a83f87d2c62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8515
x-xss-protection: 0

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/ 142 KB
51 KB 29ms
29ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d9db6cdd27d4b4ca266f94143ceb0f4ce00cc3dbba764041099e26125f9b795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52305
x-xss-protection: 0
server: cafe
etag: 18072834804161166964
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Oct 2021 06:05:28 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 28ms
28ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pm&rt=1&c=ca-pub-1828578781656677

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 28ms
27ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=1&wpc=ca-pub-1828578781656677&warn=12%2C13&w=1600&h=1200&eatf=false&reatf=false&a=6%2C1%2C5%2C7&apv=20211005_113606&sat=1633548413144&afm=0&as_count=0&d_count=0&ng_count=0&am_count=1&atf_count=0&mdns=0&alldns=0.075&allp=28&fd=(0%2C15%2C1)%2C(1%2C10%2C0)%2C(2%2C0%2C0)&pgh=3341&su=thiennhienkythu.com&pvc=1361001907429351&r=0.1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 49ms
25ms Script
application/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thiennhienkythu.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 61ms
26ms Script
application/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thiennhienkythu.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B91C 28 KB
12 KB 547ms
546ms Document
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85c5d02ac58746780b79cf63b1303a94d524638ebe27890b356d7a04f565407b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thiennhienkythu.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 07 Oct 2021 06:05:29 GMT
server: cafe
content-length: 11950
x-xss-protection: 0
set-cookie: IDE=AHWqTUnxruk86BVcZH_hRs4otHSX64hZns7ft5We3bTwv0f-9oitfnZx0DK3Uuz91qQ; expires=Sat, 07-Oct-2023 06:05:28 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 07 Oct 2021 06:05:29 GMT
cache-control: private

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 90ms
46ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 07 Oct 2021 06:05:28 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 27ms
27ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pr&rt=1&c=ca-pub-1828578781656677

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211004/r20110914/ Frame E2C0 10 KB
5 KB 7ms
7ms Document
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211004/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e59f39fd9be6b3737942676248d273b23f94ab60f7b7e608230d6a107dccb7ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20211004/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thiennhienkythu.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 06 Oct 2021 18:15:54 GMT
expires: Wed, 20 Oct 2021 18:15:54 GMT
content-type: text/html; charset=UTF-8
etag: 10398570473303663775
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4601
x-xss-protection: 0
age: 42574
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6BD0 624 B
300 B 19ms
19ms Document
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvyrgEQw_SIvwIY_J-ZtAEwAQ&v=APEucNW2fN5DLKdibbuxEatajs7jSKBmg-2DgSemUmqn2LKl_btlJGf9E62a7kP5JQNCdWGRNEZRWZB4Xjz4b1RH0ksZPgCbeQ

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CPvyrgEQw_SIvwIY_J-ZtAEwAQ&v=APEucNW2fN5DLKdibbuxEatajs7jSKBmg-2DgSemUmqn2LKl_btlJGf9E62a7kP5JQNCdWGRNEZRWZB4Xjz4b1RH0ksZPgCbeQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20211004/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211004/r20110914/zrt_lookup.html?fsb=1

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 07 Oct 2021 06:05:28 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUkYoNw7aYcxiT0fA3epAi3shLBn7fcp9sp1kWlH2gd0UKleJGm7fkSmfWWv; expires=Tue, 01-Nov-2022 06:05:28 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 07 Oct 2021 06:05:28 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 4A1B 106 KB
38 KB 32ms
10ms Script
text/javascript 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 14:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54614
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Oct 2021 14:55:14 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/elements/html/ Frame 4A1B 6 KB
3 KB 7ms
7ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fb9268e99659f17a183de7aa0d4e27453f96c159a7ba99d6482522f8f72d1009

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:04:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 61
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2631
x-xss-protection: 0
server: cafe
etag: 10983085961369067521
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 06:04:27 GMT

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/ Frame 4A1B 18 KB
7 KB 6ms
6ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/abg_lite_fy2019.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2df1e67459f1d7eda2c4c5af7e07c73f911f6c898f3d061d8f3e9a32ad63fe31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 05:54:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7605
x-xss-protection: 0
server: cafe
etag: 4152153861754824712
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 05:54:33 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/ Frame 4A1B 3 KB
2 KB 16ms
16ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/window_focus_fy2019.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 05:59:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1344
x-xss-protection: 0
server: cafe
etag: 10107448882299530629
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 05:59:02 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4A1B 122 KB
38 KB 51ms
29ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

sffe /

Resource Hash

eb35e2fc6b44a1ba314358847a3ecffb044ac056ff0b374ec17856062cc75ee3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37846
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1632957210746890"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 07 Oct 2021 06:05:28 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/ Frame 4A1B 14 KB
6 KB 17ms
16ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85d8dd4789aef864dde1bea614b5ceec78e9d19c30cc2a14b4a358fa63df8ace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:03:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 127
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6206
x-xss-protection: 0
server: cafe
etag: 15755272758842173338
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 06:03:21 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4A1B 42 B
63 B 27ms
27ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CXqd_59XZu6OKDDnnjOO1g4mPSh0ex865LEPa1wOArTLuhQooR8mjvAvLQATKJpu4XptyUy2DDkLKRgq-GW9Z3qiqJjPvhbCSJJWjK4Weaji8IESE

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4A1B 41 KB
15 KB 16ms
16ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211004/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 04:39:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5170
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 07 Oct 2022 04:39:18 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6BD0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdMtz8Mrh8ka_U_-zz_XOY&google_cver=1

43 B
1014 B

28ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdMtz8Mrh8ka_U_-zz_XOY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvyrgEQw_SIvwIY_J-ZtAEwAQ&v=APEucNW2fN5DLKdibbuxEatajs7jSKBmg-2DgSemUmqn2LKl_btlJGf9E62a7kP5JQNCdWGRNEZRWZB4Xjz4b1RH0ksZPgCbeQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:28 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 07 Oct 2021 06:05:28 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdMtz8Mrh8ka_U_-zz_XOY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6BD0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YV6OKBc7oZl4R0PHHFdvlQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdMtz8Mrh8ka_U_-zz_XOY&google_cver=1

43 B
894 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdMtz8Mrh8ka_U_-zz_XOY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvyrgEQw_SIvwIY_J-ZtAEwAQ&v=APEucNW2fN5DLKdibbuxEatajs7jSKBmg-2DgSemUmqn2LKl_btlJGf9E62a7kP5JQNCdWGRNEZRWZB4Xjz4b1RH0ksZPgCbeQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:28 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 07 Oct 2021 06:05:28 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELdMtz8Mrh8ka_U_-zz_XOY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 6BD0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIgXpN4CpTkHxYMdfMaw_gQ&google_cver=1

43 B
1008 B

8ms
7ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIgXpN4CpTkHxYMdfMaw_gQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvyrgEQw_SIvwIY_J-ZtAEwAQ&v=APEucNW2fN5DLKdibbuxEatajs7jSKBmg-2DgSemUmqn2LKl_btlJGf9E62a7kP5JQNCdWGRNEZRWZB4Xjz4b1RH0ksZPgCbeQ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:28 GMT
X-Proxy-Origin: 216.131.114.169; 216.131.114.169; 867.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 86d49307-d175-4d63-a746-813f87b3381f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIgXpN4CpTkHxYMdfMaw_gQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BD0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQ4NDY1MjQ3MjkwNjU1MjIzMg%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQ4NDY1MjQ3MjkwNjU1MjIzMg%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:28 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:28 GMT
X-Proxy-Origin: 216.131.114.169; 216.131.114.169; 867.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 7f5ee34d-a7cb-423d-9ab5-5fae4f00eb0c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQ4NDY1MjQ3MjkwNjU1MjIzMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 0EB3 12 KB
5 KB 23ms
6ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thiennhienkythu.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Thu, 07 Oct 2021 04:39:14 GMT
expires: Fri, 07 Oct 2022 04:39:14 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 1A33 783 B
534 B 63ms
26ms Document
text/html 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f4.1e100.net

Software

GSE /

Resource Hash

5b851e08ea9a9ac6486afdf3b895dc2443e98b373e2f959d6ba3414e17292ed9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-iAyxO45CaNCdz0Lqe+aisQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thiennhienkythu.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 07 Oct 2021 06:05:28 GMT
date: Thu, 07 Oct 2021 06:05:28 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-iAyxO45CaNCdz0Lqe+aisQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 949E 22 KB
8 KB 9ms
7ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 07 Oct 2021 04:39:19 GMT
expires: Fri, 07 Oct 2022 04:39:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5169
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 98 KB
20 KB 22ms
8ms Document
text/html 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cc1bc6b9376eca2e0c094d3d65144776a49b9fd267aca0ee12df9906a5a4183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/2675768160559214074/728X90-3/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Sun, 03 Oct 2021 17:42:16 GMT
expires: Mon, 03 Oct 2022 17:42:16 GMT
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 20693
age: 303792
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4A1B 0
592 B 59ms
35ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvYm4m3ObqJ-8H409lq40qYuxJPdwVtIpZgzGHpRfrQh6opCN4dUL7SoALF6wdOJyu0_DzXkaBaiQNf_LfMkZ-J_5o8bMuLg_dbfW46vJLOMNBZapX8i1MPONS_NtsSkMv0umtJmqxT8jRRBffnR6sLfNogBouw4j3r2qArIaWY3J9yOuIwsVimh0Yb8euzfjRt8JOp2s_iP04_T8zzQpRVweJPGzdgJ4nYy0KV5Br-c2T9IPzB_PH2EWAUzY1lbjm0S_saXt5glQZRnnwG7FJbgjYrGxwqEG0fZ1Ncy6A3FOZ3PTr8SKvF8DZ7ay3v3c1AsK91tJ6qMQ9Banqe9TM3YuLQwPf9PxRGzT-aekYRavr0k1Hm0VaXERqaImGhomOsOV4muV5XWZ5FmV9GPJBXSWxQbH-Y1gO4N_z-oLT1LVg1wn7l3W-OZxgyEdzS5LkIs3WR9UWqWTPtCMXrWSkwqnondbwUmoArpnKZ0M7nAWJ5lF0ZDKyd3WZGpTU34lcLGoTRhj980ndS1QjZjKRO_F7nN3taYLkHqZJigwGiRfwkbkTNFu4gc6ka1la3l2EWBAKjWP-DmviCRi7YVEttPikVmlKlClalfd_KdsVBZ460_l2y4xxOaB7XBtbOk7dr8ghnO1mPryYqDZF9oQX6WHlTbZhTzDYcednzix0W9HXGvLnifhTC_ZsxlTqNRe1_1uexAVWOJbQdcWhWDQlPrdl63wAQcSCHNxh5TdUj6sa47gMPEO6WpsJp6tgwqQUAkefohDHF_LuxB7vwKDO8O4uxDt_3lJSNOcl5dtts57m2XlUZm4Kgs0OTMLAzKz7urYHdWBlUEjNlrOKDl_CYgZ03UoaoTE8gHNGvIwckGuAGrjJ0aJy3FVbUuYJr65wrY5DjTWk9mNB5TX_hMO7T4QVgAG0VBILipbRJOY8dcvexb2yIN3uiusSzbihmH1czjHyjbMJuhoGgLXidwJ5b5up6EFEfXrcnVQQ3KqkRdEP4_Un7R5aepC0B4ApfOYQhKmvfzAEnF3QJ0gwa84_iSbpk6ZcdURJii9PtJW0LIMqy7x8o6nALAtATOcyRYkVUOTSo2QoqbAZB-F7_WDVUCDw&sai=AMfl-YSTGfGgT9XN-hy__hBoUsbhnFvYdZ-hOCMXKCbGVJ_k_bc6Z6d7i1EUWheTiOkbMsbtGLwhyrXOXwoX3LOe7XNfjtb7FYl86oADtG0xPLIs1ovWlAhJGYJVAFchJ6QxhOsfesJsHJwe4nSfwTPdY058kW64uJSEzqdK8SgvHw&sig=Cg0ArKJSzCfNiUvRwwd_EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=63&cbvp=1&cstd=59&cisv=r20211005.85642&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 07 Oct 2021 06:05:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame 4A1B 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb3aa67ab615185c2f855dbc9905bb3fa45cbd50f9f5c71052f334d9cd62f099

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 DcmEnabler_01_246.js Show response
s0.2mdn.net/879366/ Frame 1BA8 28 KB
10 KB 7ms
7ms Script
text/javascript 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44e04e4776c58b34580006ef8e8a1e1ae336f3e9c429ae242fe9a8f090889b79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 05:11:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3212
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10121
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 08 Oct 2021 05:11:56 GMT

GET
H3 200 uoJ82QSyBbq_FXH5zff91I1FpHA-XwZ_JVg0ka7Wlv0.js Show response
pagead2.googlesyndication.com/bg/ Frame 949E 35 KB
13 KB 9ms
9ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uoJ82QSyBbq_FXH5zff91I1FpHA-XwZ_JVg0ka7Wlv0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba827cd904b205babf1571f9cdf7fdd48d45a4703e5f067f25583491aed696fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 17:27:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45465
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13468
x-xss-protection: 0
last-modified: Mon, 04 Oct 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 06 Oct 2022 17:27:43 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 1A33 0
0 59ms
59ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211004&jk=1361001907429351&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 y_GpSJCDeJUhy2edwqiqULXjheMgRVI09JfpD4O8H0g.js Show response
pagead2.googlesyndication.com/bg/ Frame 0EB3 35 KB
13 KB 8ms
7ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/y_GpSJCDeJUhy2edwqiqULXjheMgRVI09JfpD4O8H0g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbf1a9489083789521cb679dc2a8aa50b5e385e320455234f497e90f83bc1f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 05 Oct 2021 13:10:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 147317
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13365
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Wed, 05 Oct 2022 13:10:11 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4A1B 0
23 B 45ms
30ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvYm4m3ObqJ-8H409lq40qYuxJPdwVtIpZgzGHpRfrQh6opCN4dUL7SoALF6wdOJyu0_DzXkaBaiQNf_LfMkZ-J_5o8bMuLg_dbfW46vJLOMNBZapX8i1MPONS_NtsSkMv0umtJmqxT8jRRBffnR6sLfNogBouw4j3r2qArIaWY3J9yOuIwsVimh0Yb8euzfjRt8JOp2s_iP04_T8zzQpRVweJPGzdgJ4nYy0KV5Br-c2T9IPzB_PH2EWAUzY1lbjm0S_saXt5glQZRnnwG7FJbgjYrGxwqEG0fZ1Ncy6A3FOZ3PTr8SKvF8DZ7ay3v3c1AsK91tJ6qMQ9Banqe9TM3YuLQwPf9PxRGzT-aekYRavr0k1Hm0VaXERqaImGhomOsOV4muV5XWZ5FmV9GPJBXSWxQbH-Y1gO4N_z-oLT1LVg1wn7l3W-OZxgyEdzS5LkIs3WR9UWqWTPtCMXrWSkwqnondbwUmoArpnKZ0M7nAWJ5lF0ZDKyd3WZGpTU34lcLGoTRhj980ndS1QjZjKRO_F7nN3taYLkHqZJigwGiRfwkbkTNFu4gc6ka1la3l2EWBAKjWP-DmviCRi7YVEttPikVmlKlClalfd_KdsVBZ460_l2y4xxOaB7XBtbOk7dr8ghnO1mPryYqDZF9oQX6WHlTbZhTzDYcednzix0W9HXGvLnifhTC_ZsxlTqNRe1_1uexAVWOJbQdcWhWDQlPrdl63wAQcSCHNxh5TdUj6sa47gMPEO6WpsJp6tgwqQUAkefohDHF_LuxB7vwKDO8O4uxDt_3lJSNOcl5dtts57m2XlUZm4Kgs0OTMLAzKz7urYHdWBlUEjNlrOKDl_CYgZ03UoaoTE8gHNGvIwckGuAGrjJ0aJy3FVbUuYJr65wrY5DjTWk9mNB5TX_hMO7T4QVgAG0VBILipbRJOY8dcvexb2yIN3uiusSzbihmH1czjHyjbMJuhoGgLXidwJ5b5up6EFEfXrcnVQQ3KqkRdEP4_Un7R5aepC0B4ApfOYQhKmvfzAEnF3QJ0gwa84_iSbpk6ZcdURJii9PtJW0LIMqy7x8o6nALAtATOcyRYkVUOTSo2QoqbAZB-F7_WDVUCDw&sai=AMfl-YSTGfGgT9XN-hy__hBoUsbhnFvYdZ-hOCMXKCbGVJ_k_bc6Z6d7i1EUWheTiOkbMsbtGLwhyrXOXwoX3LOe7XNfjtb7FYl86oADtG0xPLIs1ovWlAhJGYJVAFchJ6QxhOsfesJsHJwe4nSfwTPdY058kW64uJSEzqdK8SgvHw&sig=Cg0ArKJSzCfNiUvRwwd_EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=174&vt=11&dtpt=111&dett=3&cstd=59&cisv=r20211005.85642&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 C1-01.png
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 11 KB
11 KB 8ms
8ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/C1-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8e6bde3580013f431e89a2cfd1f208cbc606578b2c878d4e0cb39c5d349a2f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 17:42:20 GMT
x-content-type-options: nosniff
age: 303788
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11394
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Oct 2022 17:42:20 GMT

GET
H3 200 H1-01.png
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 31 KB
31 KB 9ms
8ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/H1-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a4f5630df345b00bcf13f5446cf0935a637593cd62ae81df54e6f4ed6acbef9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 17:39:13 GMT
x-content-type-options: nosniff
age: 303975
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31833
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Oct 2022 17:39:13 GMT

GET
H3 200 LT-01.png
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 9 KB
9 KB 16ms
15ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/LT-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75a4ec38c1f19e6b490e16bdc7f8e203f8ed62d9267ada7f81238ea06a07b66b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 17:39:13 GMT
x-content-type-options: nosniff
age: 303975
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9386
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Oct 2022 17:39:13 GMT

GET
H3 200 LOGO-01.png
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 12 KB
12 KB 13ms
12ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/LOGO-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71800214b995083c38bb79a5c19b935842400d08a318633743031208abee2269

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 03:57:42 GMT
x-content-type-options: nosniff
age: 94066
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12676
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 06 Oct 2022 03:57:42 GMT

GET
H3 200 BLUE-01.png
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 7 KB
7 KB 16ms
16ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/BLUE-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

442a38dc92e1b8db95680109e41a779d7e9ce80777ab7b96481aee75f9ae9995

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 17:42:20 GMT
x-content-type-options: nosniff
age: 303788
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7175
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Oct 2022 17:42:20 GMT

GET
H3 200 1-01.png
s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/ Frame 1BA8 739 KB
740 KB 16ms
16ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/1-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd0a50d023fd30b877fc0b7d5af29cf9e20e5a3adc8d136cd1cea7bf16052c6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2675768160559214074/728X90-3/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 17:39:13 GMT
x-content-type-options: nosniff
age: 303975
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 757111
x-xss-protection: 0
last-modified: Sun, 12 Sep 2021 11:04:18 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 03 Oct 2022 17:39:13 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 949E 0
20 B 30ms
30ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BT-J3KI5eYcmDEc6h-gbY0a_wCwAAAAA4AeAEAg&bg=!WFulWx_NAAYiB-bNIgc7ACkAdvg8WvO0Bz2j3wbZ_GmVd0QOlpKZuYkdE3UuF3vMuo_BXhF4esthygIAAADRUgAAAAxoAQeZAsa4RuK5CdD14OfGFJ_Ma-z4p4uv_fGlmIBgLIWtiLGbBdjQENhgD5jg4kCoQBTDvnejROQAa-CqdaKJxehaNWl-V-g-qszduZ0SK3p_spQ4bQVvkOGyN81xObKoTC5H6QeSbKUKKsjdgHOx-CjO86CUEMgq2SSm5DVIK5p_ViI5wDnT08tjgZHe6yRFAlIZ-cbblZJmNeGp5xkiPm2xMBuKyS05CTeCfaMxCsZutUTv9heRm7CuxDkjNt4UtbAhjcOAmJttPGoqBGd7Q2Z_gszGozlmyKda4tKnvJKaPUCCdEpqbRFsVbNtM7HeMR3IWX-lzALV1ACU4qf52uu-1w28aRQ7HTZI-zb90rE9dSUdv0i33OSn5FiKWVSsy8HsT1_G0MsyI_u0SDXlPE-A8sd2LXlKBe2yeXJvbHd8q4T-Qpv14ChHBC5hjKIiKwNQoUBXIJL-gud_wSIv2BfjxPg58qAsiYAGxk0c-v9TpVlkSC5t6fDUGDs74DFD4dXtz2bVz4i9LCyYnlqyO7xFllCcP-AjQd0Y1V9yut3k9PWlO5d8u5l57qyMTQsxPrkHZvTr7yOwoswz-p1YdfhBgsTBlWSMd1uNfrOmrZ-_ZFXR1hMSPMQFgrCORoTyYMvKoHbb-fbOawkBty4ZWqOQg6x_ac0x3GXxPPFkBtUqYKrBHbi75rqY2Uh86Eqtkd_Oiyx0xleJqtWiUa6W3QWVFyp6oseJqY985ooWxp770inZRkmH35cLiQIndip-PuHIOI92UBIqlKBVt_T4gT5hkIWYL5gKtrxc7f-dyjoZKopLBaxRA5aCPPgbtI462TMCPtrpNVCM8WBHWK5BOOuI1SshUrBpAchBv3OrmcGkerPJQ9ZRLtjDPdw_pFK9vLlMaVAKrEClg7QWYS1f7Yy1o6fXTNrBQGbNNNvNKoN42u2eOPfPxbF2bQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 62ms
61ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20211004&jk=1361001907429351&bg=!Q0ClQATNAAZE-GIIRPg7ACkAdvg8WsSHGqpzCBKX2lXRg9xlFGxMKAl5o6iXK1cDRASNo5o_K78tgAIAAADBUgAAAAtoAQeZAof2NSNCAalz2GRW9V8nnutEjUye9nq_xd2SE4zHeFDmmEM4HThdvS-SXeoHQiDWuF7A0IW7jQF2fF8B-qq7em7SsjlwTQ8pMpgehnSjQSYMEVGXGgTSfPH2GtnYdFDxdEHfwQOsEiVezcNshf9EPMJf47CG5g-aejGYTF0y1sDpVxEeZX1FDJCq0ozxIaBqceuR9-3pbRjnu5aoecukNRQDPgrVu-6CABUu_BmpuhDlWyR_s11Er4mE9QXV8JGO54HbvQgnxfVcjSieBifxde-jJinPzeuHG3lIEM7V_AAduDQH29YLOipnB4PVVhpXIteJht4uGVBcGnFiIJm6qzMCLNt9J0rcJdDKHazW4EdpIxXjfOf9NnMyVH7y4EUrrF_BuEwrfgDFZbi7GOa7jidpTooh09s_vAMsoQTdKFY7Okn7NgzeVW3jH7G8b9zKZEhaJ_TTIsXIdoApXHG6toBHQYeNcKkDfKLRCTjKp7B7vx61zINuv3YVCVPirjpM6SqVXYxzOA8VAOjS5jbYeibxX7vJEqPJypr3CER-0rQyXpyWDrhMPgPXjHxj3zfpM9xEZ099pfXLjLXLN3y6x2X2JG7OclGcHi3HeNUZpK8aY-uV33gvteoAVJ6jQMGxl6NSLpYQZhJuitZFuHk7puo9NijKWu9pcMvJd5vvbEjjAF6uMYvrifgqZgSRLkk9wViZS4r5zb7TZnRDtQPxAI6ROHKT15MFsBy9kcueiwPHNFMph52N2WmgmJ_o0FEIx1ov3Cp_WJibn1P0LbuYft85_eWXTGg7_rML42s-ElbeDliCRQ4_Kv-rXtNVJt29oCXvMkD98EpYLpVq2rmM7sPDefKHNjj78A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://thiennhienkythu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DFAE 624 B
297 B 19ms
18ms Document
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_pMxDynVcYueWptAEwAQ&v=APEucNWA030qHkUh_F6I7vphHm0wlTD5AN8SGxIV56bIxmtaBrsO11NLYl5ZD0qcdSoWvFLjtq0VBxEqLGm8EQfdHyS7UJzi4w

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CO_pMxDynVcYueWptAEwAQ&v=APEucNWA030qHkUh_F6I7vphHm0wlTD5AN8SGxIV56bIxmtaBrsO11NLYl5ZD0qcdSoWvFLjtq0VBxEqLGm8EQfdHyS7UJzi4w
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnxruk86BVcZH_hRs4otHSX64hZns7ft5We3bTwv0f-9oitfnZx0DK3Uuz91qQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 07 Oct 2021 06:05:29 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5675 12 KB
9 KB 31ms
31ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Az_DjG-LyobvdBuVdHMsN1jIgOHr9hGZsyFmLyPtyYSvNZpMJ0CfV4HbIeSUqMCgNu1DTnjh6HGX5z-FCpOA9C_hNdy_aHnxBINfZKZ_VKEAboYGRFngBaemH6TBetatHVeytOGpA78vJ1fNPYeHN-kvvzNA&dbm_d=AKAmf-AgXt-C11unfohydcIMhwrLAK3klWLzhS7HRWZRvmsMFgGbQJG5iEYWKZePFLOjdLADDwNXbObzy7ZJdqraWaAEdSvqxv3Xx0AnwUuCEFmsLT6gRP7jgELlDXUXJA0cCXt0YhNu3aoG_goGrKYZP7QWq7AkLMN5-ihiuVsVHveAR14nIGlI5IxqrnIUExTOENmTebp4MiOS_qja4FrZus4wasCklra48bOpjUCCyqFPPzJSU8faWp8vyRaQEbi5ebw9irNwTWhdYYPQyk5_Ma3s_43xxjv8o7-RmK5lG5In6QJB_bTzPwC2PyohTL814khfdh3q6-9Iu8mU8G5w96XWZxHDrT8ov2CZl1Z12mC_J-vLhHbe9tBGx9hKZNtb_iuhuk0_MjQGdWwxA2UMv9X-hx27B03ThwCJI90YUpAMHbxZLI6OzOEzLZDeHTfCw1u7XH0tjmPvZVJxtlpA71vxsIHwN136vz0eOAdbR5ttHM5fMqVBvSDfIUCIPIxk3Ts8t6OH-cUyX0oWezudNRZM4s91XygGC7PCqQKRPNyzHggBsXPrzMoVJiJKZGwrEQXptTbzQq-kcNB3npcI83odmoptYsrtKD0cwGO8c7louTwtegRoVBywmuttAA1HiQI4DEpD5nPPvQ8YFpIs_iBhUCmdXMG5Ldc0m4bxyzbROwLl902EuJRs-tofqzSnpYsh9c5et_KhA5ZV0CV5DPxJi_mi9vnT0IEbbCsrjAkwb4V74jWhg81CJN64c-4dW_yhE_TkY9S6668nTDjo3ajh2aUhs9ZGuxUWd2d3dXAf2PwwlEwzPy-lvMXBSVmRhvaR5tv8g-1-NZHupi58lFzoXfceTs2tvky7L5cSgO-90FOaLemy1jhIBvAuwRVe_UCQtVorQq8Vtt_ZZF_J_qpnyuq8xHI3_g8JYQBKEQCd0g8kNhXU1SrqAE9UwM2sf2pay-zxZt981vhMRW2X4mpI5_b9qzjA79fy_fp1t59CcSmKMadMzl80WBDRRLjnb-Ldt5dTdV4wVYbInwHrXeyqtFyoI7jliT8lc3elvfYrvgS5F7UZraewUIRh5I-Y_le-k9R4TuWWWdloHds5JMdnbXAgocxZSH01-XOnxS1GbMk0Yt1TIrEx193r0_REefgZHXtV6p4mugyrvsBnk-Oijz2TrSaq75q71b0rhN7CTBQoPY0FhCHkVsP9Qs9ecUYQ5B_8SW7vEH_Tm1ksNO7aWUH2yjuXtsuWYTCFw2NC1AoF1pWX9jwyrdpZPQus6u4RumzIlGIPXRiqaio0zhD2krrdWmJSDRwvNVe7PI99-GT0ljFyoB02Pj0YAU2dg5vJwKb9b0wD9B_wwy6MyEKVHEQOTJbyHIE2PRFQCEbpJoythcjBU0t7Xem9rCxqtrI-0nFL9qTz6W0Of74ZcIb-wPXbHrcx9cJCy9DUi9RBLH805qz-tExYGDfHKtM0d-r3Ilz4n_SolhpoUIqjc4n7JxlVpeN6VKCaZpAVOeG3KK0N4bGH8diomoSkOYmWoy8m2JnMbsKF42ptBY5hZuey_RPmAxp_qcCV0trQLy1BuNUfYxFEyL7c_emOhEluyahUpyaZgL_4FfY1PhhViF_0OhQA74UOobDSdqUobIprk1skQU69SEVeWfJKtWGtmijvw1GMY2juqgC_x1OZWcI4wl6ha6HHdq7UvbBEa-1n_hp56piCimosX4cKW_o-rBUVoqPNuWtVFkBHy0OjN93F6Q26u5X7fRMz-Ihyn2Ly4Y_IUdnNgVkdnA1DPjKWJL_RfBLnR-K9OaBG39ir-xCIgIKo1g129oRXOBSKf0QQMpdnt8qBfnunwuWWBCqw4_PADjOmivpY7r4g4A8-JB2NgBzUZNWr2XLAJ0pQfSmvd4k6UBuRs09KtlEa82wiwoRUbcYaDpTyX5Mw6YUKDh2i1D9y01oDin5Bx-KT-st1XcjWjHxSPTPxre1TxGrU1_G478niS3QmzJvbO5qXL6E-HlcfA5qJ9IrCNqcLt12Tn1z6Dp2sSM09_v3PSk55uTsOdrlXP780M7Smxqh1uQ_Uychcjaw8KngcXAFd1ITckJHYHxxN3scJ59HGozql45vekAaFzj_inYhvodfh6iUpJm8ZMUYgDHJBu-jZlKM-IR0iGZTPNCl8JLTN6ggrmXuaQHfhWfjNxuOHriGep2wpNzouuU-0BXWxEbn22T10OxyrVYvFU_CmuNQeFNpi7MECTBNMaGNHMhi8DZK6jjyxl4tsGqH29a3uppM7-Xwi55YhxxGofBp8bP_1aXSAd0e4K91QY61KlHHC0rgOlDIn0TfhIQ5joTo0OeBled-x21TodM3PXGwxGnOuGvh6QE5MkXGCN7ZgXniSJWmjJwBYjNVgqkiww0XnT1Ka4h2ydx7qIbI81ufDAOS_W6X6kukN31oPz8vliuIh-sjXKBAz88vMPiRaIu47BFs9zBn1BH6V78q7bikvFFCV-LYRi5Iu1ZosvUmaVb5_KMvikifUUUHrDPrAfzCNRHvSPDd9z1Q9IzCnWR6bJYvGdyDB13KrzG1v0B7hzul5GY1ZUFjW5m0EUg&cid=CAASEuRoux_9BlJjP0Xw_r3fOVck0Q&rfl=2%2Chttps%253A%252F%252Fthiennhienkythu.com%252F%240

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f199271741b83af449973b0e37bcacbe1a76da7e4f3077edc5ec8463affabbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8749
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/821867/57401168/xbbe/creative/ Frame 5675 235 KB
79 KB 137ms
60ms Script
application/javascript 34.252.163.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/821867/57401168/xbbe/creative/adj?p=APEucNUpXO7xgWxWskfsBQhFhrN3Ds83nQ7uTmvdXm4juYtcAh5SWeI&d=CnkAoCZ_4Gup8rPpXt2JhYDmYW5JqIJCPx0AjJvYDybtX12rvvmi9dVrfIpcQSyrWqaEDGsoxWxGYXm7flABcSdVqhTn2EryqjuJwr4zH7N4XPBDNWpS1pc-DK_e5xfGutNpb7BADZ1UFOeBRHfxsstirg4FEF_2gq6pEpkTAKAmf-Cf0q3chQTKdKOhPQhW1OQKmhcJyr_7ZDmQ-8eDKDS5H8Wha2Dz81ynjJZovwTxg0P_e-lQSlsFGaXvXampC_qQ69EKBBVQHdsI1WBdmCH82MQWiJbP5jfQhUGEkOkj_zKUkYSB8tcDhroKO325c0afextgRCysgHhTXyojlTcOtj6_RyKarTwK3xzc0hsDzdSwTtKc2BtPPiKnRvOg67UZNszonnD5wz7BG5v4PI90ggc8xX21lHTR22F0_Zgt0xc-0Qx9PooImapQrzfNuBiPlKCCYSlmGYGjnjl7knAFk14JvDcTvLc3GtYWwW9PkdIL4iGo2uVsXXKBkOuKkyZm4Rh-qv_4woRTu8DvY88sIxl7bXlqonsLsJHu5MzsRfF9yYvasAxMnQLEkA-hRcVsLbxQWO4ELRRFGh1GlezszIicjv-zk9nm47ivvQMaR-43aCiCgQR5x_rOxQK6HJxo_lStdckls-8b-9QPxlwkIAwaWLaIfg46Vaow3YGsdu67Nzrm1XZSrRRXznfVRFObK9-gxjAGIqGDzK7KMcTdi4885DY-kzrEr0LkizaZ4UNitCNWn0UndF3FP8ZPo3MXlkHB4sPZsubG6x46irdbG7iS3T8oZaZn1gSFW9pUL8Xl5DMy-FZpV0sUQy-9G9vwWMGtQ77sQUGeZNTXjge2tfayXbcHIpOSQMfaJ0CVXlWKe6k_mnbnprrwsIhZSYR5xuDshYirZGtzrpKk2Y7tTsntt98CPDQW_JP0LXfdG2v0J5Bfaa5QfOHdN6OVQ5b1Cqdj4zmMkF0Y4WiffvbAse2z4mZgCAbsOSqXWax5S467dVHQIU0-qyC2IBhQuK-EYx3b3REbBpi92uNy25VP3CMowwSORJvMtRQ4o3J9ivLzs6afV6A18qllTScZFp25M_ryXfQr6x34a3N3n4Sc3VzoQnHlJSCPbA1I9mVFJ72X0ns4uPG2AKtsMmf77eFeThfCS4yhq_0b0MHul5IBCTVZUWACnp9LU-4Bo7yH6tfaYQzFS8ApivL0Thup_KA64fg3r5fpp7fAFdFFO0im4kvvs0GMc_W_Ey9l_lJCAIAcMQHe-OYq9dccAhsHptJBHfeh1s4_SehiRO4IfJQpkcdLnqu8E6F2Tc7x2SbvJWnpQbo1LZScHSFKPqpzffnD3JvW9VUgRGY8vrrDMDYOmEySvlJlTDEB0WvUZ93CsXa2TMp9bLdziGOy5etdJqQZRRP1VlQQQLXqrwRMMy--S5UUIz0FuH6zdssetGnzjZPRFHBA37zEwFo5QaFFlc_DE_bCxpmCNnqgeIkRvR6tcb9J1Ect_zsPrAaWgj4UheCsc-YSu06LZf9TND2UBFW2zDbnE86QZONpM6P8Oc4UdlYHVNpznwfb84ChHeTzMBGY-r-yqB7AK6oArKzot4_qRSD14gCiG35Y3-5zzoupNINiMCxwYQr0GVxU-e7jXYdNW_d-Q9OYeaJ1j0lBe-24aXG4L0JZ1LvROVvRrvlldKybwPqsrfwbWgF_YEpclr9Te2adF5eYIJKht78IhdLqfZqGCeJ8bNyI3WpgacgJnTZa6hjRCzxOHyCbOA4yCRC1S2IurTI5jLTOL6W8jVROtNwoyIMyU9TXNlUmI6uj76Zrud74zh_EdEeirE0HH6iPbcuquLuAcXa3SvkghSj2K5ncFJWxEfxbsmLVaYhEMhXP1Kds9cy1be72S64c8latdyFflFgatjS1rIHLvzJCSk17_cwct-KQeG3Q153Q8d2u3AUPRF9OhrJQnWKN-4ppVtg_4l_gPD74ij__xWuUTkeZDQ82R-T9CgtNlbXWKwgOef9ttpNPtALV2J7dRgHNxvysTuErzAd2dw4nz1m7CbNkYbxvf_53b_EdbXP23Cl4aThx5lavcepwrOJ4JIm-Zu6dBJWEnyzuk4_O5t9q3-xHnBhvImrdrY7kmMD-ETTqsWWEZbP14ll3CoMRwmlndAW4nfVNZw2eu5Q5PJrWMn3BIiKKwSjzM48vzXD0u1R2bytCt6bTHWqIkPmtaFnrKEHuayo90ujh8cy5dDq0KRVhGjkSHFfOHA-G6cpyos7_Hru34jHX23qQSxgcy4c6r4K-7dMHjf8orinPbrqVP1lSNk6mofzNAkN61tRnBbgzl2pcfS41KPPYawVWj2clVy61a7tAaGGvDFJO0ygk3Dm9xXkEV4PHrRjsZzGNVsksnBOFUth4PwXKDKoB-Fb5uO-eoYHEfLWz9D6D8z0QHslAP0q_XdL3qZt8-Z-KcnqVsbxYfvfq3eUHe602O1dBA-HUClLmE1ispQ2cx4W4XcvF_pyJ_4KQ_rBYmHaZFRq4AIimOIcit-yZC6_E0T8GG19IxSq3shbzy3rAyz46CWK92Q74K1-2eQ_5iUPFqOWc6pN1eVQ8zPnoceHhAoZN6jZ4_40Wr_kCjCmLTWonIYuiXaz0nzTkiFw_YlCSBPpN2Bxkq0lgRzZWQmdUtLeXyHd6VOfHtBXf1WLmYHimsGJi4LeKL1yAkj8kxDGX4abDHmaW47RdMmd40jTVmSTNL8EjwZWET-Y3pR1xPWC0kmqx-DPwseoD2fbwx_ax4eAtNCC-nR6_B7MYHlaO8u5jkH4F5lxrqe0ivuJC8zm4UOkYodgqoMQnAPh-lA0dTJFupYnnbhDo7cZ2VBROkvlhWuwNbD4oMRN4lnIAvy-6qxXTTw8TdC9gWgtbNxOpXWU0zzeQZCnBbCi7iaIcTMvl4v_7i3A1IJCzbeTNOCgQpTJQgdw9l94x4415a07FTfQGFXKLe-k0hto5w242jwcUbSVsJn2RkSmN8iPPpGWqVHMRidins5FlMYZg4CUuLMd8sAE9fUbjDeM5vP0RXBbz385e-OglfyZN4maOuiSiFFCL7gbwGSRLIVssEiC6HIHkjA_048iJQSv_VStA76suOjDrNzUkEmrOJ1YdS0AxEsYdMHX3JhIu6ZR4wnOldZ4Vv7Qo9y_LLkuY2iKXNldybglnXs58uvoaQkLd93eBPR8AuMGS3vk_ShVx3bA3o00biBg0aOPSn9K-ucjlMtMRHAV2DXK4lgodXybn3NecHzjZCZmVjl_0YBdQEEk8ErPUF6DSnjb62aOQSrhlTv3yygQzcuDtOo8xfYuY2ge3guPwEexusahCrVJYD1RchrtXFqMyM1dTkfmTwkgmUQy_ejf3ggK5lKgiYt_hnXW7YSLl_B_7swjarp7hioNmm1dRR7Vei5nSrHwGtrXE9_xAi9wEGhYIABIS5Gi7H_0GUmM_RfD-vd85VyTRYAE
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.163.210 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-163-210.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 289fd13144c198be7addf711b6a9f3e93ae88968a7b15fe18374a560a28c7194

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
content-encoding: gzip
x-server-name: app14.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/ Frame 5675 3 KB
1 KB 6ms
6ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5120f35e394e169ac0839405dbd6e680163a4e02f060f5a6a833ebfacf35d966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 05:52:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 762
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1344
x-xss-protection: 0
server: cafe
etag: 10107448882299530629
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 05:52:47 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5675 122 KB
37 KB 33ms
19ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

sffe /

Resource Hash

eb35e2fc6b44a1ba314358847a3ecffb044ac056ff0b374ec17856062cc75ee3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37846
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1632957210746890"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 07 Oct 2021 06:05:29 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/ Frame 5675 14 KB
6 KB 7ms
6ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211005/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85d8dd4789aef864dde1bea614b5ceec78e9d19c30cc2a14b4a358fa63df8ace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:02:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 170
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6206
x-xss-protection: 0
server: cafe
etag: 15755272758842173338
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 06:02:39 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5675 0
0 24ms
24ms Image
text/html 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQtaVJvzl5SpRj1ZnWm_N-HeCkj_Rpj_iNjz0mDQOl_HatzbhnBwkgQQQ2IJEwzHVFa_IhZImvMs9Js8KdbM_0WNOMJtA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.23.100 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: mil04s23-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5675 42 B
63 B 27ms
27ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DsidYMRn6ouMMK3FN0tyzcHZ3jiV3wzZXgHs0dSlvS-TxsNRZh2OL67qsffCJ2uJQ6k1XEoJb9Rb5YkN7R3WTFb_wj3avvuDa04LXK2CFBvkPCMSQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DFAE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEiEu95ZyGTK4V8tGLttxl4&google_cver=1

43 B
894 B

12ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEiEu95ZyGTK4V8tGLttxl4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_pMxDynVcYueWptAEwAQ&v=APEucNWA030qHkUh_F6I7vphHm0wlTD5AN8SGxIV56bIxmtaBrsO11NLYl5ZD0qcdSoWvFLjtq0VBxEqLGm8EQfdHyS7UJzi4w
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 07 Oct 2021 06:05:29 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEiEu95ZyGTK4V8tGLttxl4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame DFAE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YV6OKBc7oZl4R0PHHFdvlQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEiEu95ZyGTK4V8tGLttxl4&google_cver=1

43 B
894 B

15ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEiEu95ZyGTK4V8tGLttxl4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_pMxDynVcYueWptAEwAQ&v=APEucNWA030qHkUh_F6I7vphHm0wlTD5AN8SGxIV56bIxmtaBrsO11NLYl5ZD0qcdSoWvFLjtq0VBxEqLGm8EQfdHyS7UJzi4w
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 07 Oct 2021 06:05:29 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEiEu95ZyGTK4V8tGLttxl4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame DFAE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEG0JSpoMAFRywRL3-wgnZ2c&google_cver=1

43 B
1008 B

14ms
13ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEG0JSpoMAFRywRL3-wgnZ2c&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CO_pMxDynVcYueWptAEwAQ&v=APEucNWA030qHkUh_F6I7vphHm0wlTD5AN8SGxIV56bIxmtaBrsO11NLYl5ZD0qcdSoWvFLjtq0VBxEqLGm8EQfdHyS7UJzi4w

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
X-Proxy-Origin: 216.131.114.169; 216.131.114.169; 867.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 1041564e-afa9-4cb5-b729-82cd34cbff01
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEG0JSpoMAFRywRL3-wgnZ2c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFAE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQ4NDY1MjQ3MjkwNjU1MjIzMg%3D%3D

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQ4NDY1MjQ3MjkwNjU1MjIzMg%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
X-Proxy-Origin: 216.131.114.169; 216.131.114.169; 867.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 178adfdb-3ea5-4c12-becd-af1b10591909
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQ4NDY1MjQ3MjkwNjU1MjIzMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5675 41 KB
15 KB 8ms
7ms Script
text/javascript 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Az_DjG-LyobvdBuVdHMsN1jIgOHr9hGZsyFmLyPtyYSvNZpMJ0CfV4HbIeSUqMCgNu1DTnjh6HGX5z-FCpOA9C_hNdy_aHnxBINfZKZ_VKEAboYGRFngBaemH6TBetatHVeytOGpA78vJ1fNPYeHN-kvvzNA&dbm_d=AKAmf-AgXt-C11unfohydcIMhwrLAK3klWLzhS7HRWZRvmsMFgGbQJG5iEYWKZePFLOjdLADDwNXbObzy7ZJdqraWaAEdSvqxv3Xx0AnwUuCEFmsLT6gRP7jgELlDXUXJA0cCXt0YhNu3aoG_goGrKYZP7QWq7AkLMN5-ihiuVsVHveAR14nIGlI5IxqrnIUExTOENmTebp4MiOS_qja4FrZus4wasCklra48bOpjUCCyqFPPzJSU8faWp8vyRaQEbi5ebw9irNwTWhdYYPQyk5_Ma3s_43xxjv8o7-RmK5lG5In6QJB_bTzPwC2PyohTL814khfdh3q6-9Iu8mU8G5w96XWZxHDrT8ov2CZl1Z12mC_J-vLhHbe9tBGx9hKZNtb_iuhuk0_MjQGdWwxA2UMv9X-hx27B03ThwCJI90YUpAMHbxZLI6OzOEzLZDeHTfCw1u7XH0tjmPvZVJxtlpA71vxsIHwN136vz0eOAdbR5ttHM5fMqVBvSDfIUCIPIxk3Ts8t6OH-cUyX0oWezudNRZM4s91XygGC7PCqQKRPNyzHggBsXPrzMoVJiJKZGwrEQXptTbzQq-kcNB3npcI83odmoptYsrtKD0cwGO8c7louTwtegRoVBywmuttAA1HiQI4DEpD5nPPvQ8YFpIs_iBhUCmdXMG5Ldc0m4bxyzbROwLl902EuJRs-tofqzSnpYsh9c5et_KhA5ZV0CV5DPxJi_mi9vnT0IEbbCsrjAkwb4V74jWhg81CJN64c-4dW_yhE_TkY9S6668nTDjo3ajh2aUhs9ZGuxUWd2d3dXAf2PwwlEwzPy-lvMXBSVmRhvaR5tv8g-1-NZHupi58lFzoXfceTs2tvky7L5cSgO-90FOaLemy1jhIBvAuwRVe_UCQtVorQq8Vtt_ZZF_J_qpnyuq8xHI3_g8JYQBKEQCd0g8kNhXU1SrqAE9UwM2sf2pay-zxZt981vhMRW2X4mpI5_b9qzjA79fy_fp1t59CcSmKMadMzl80WBDRRLjnb-Ldt5dTdV4wVYbInwHrXeyqtFyoI7jliT8lc3elvfYrvgS5F7UZraewUIRh5I-Y_le-k9R4TuWWWdloHds5JMdnbXAgocxZSH01-XOnxS1GbMk0Yt1TIrEx193r0_REefgZHXtV6p4mugyrvsBnk-Oijz2TrSaq75q71b0rhN7CTBQoPY0FhCHkVsP9Qs9ecUYQ5B_8SW7vEH_Tm1ksNO7aWUH2yjuXtsuWYTCFw2NC1AoF1pWX9jwyrdpZPQus6u4RumzIlGIPXRiqaio0zhD2krrdWmJSDRwvNVe7PI99-GT0ljFyoB02Pj0YAU2dg5vJwKb9b0wD9B_wwy6MyEKVHEQOTJbyHIE2PRFQCEbpJoythcjBU0t7Xem9rCxqtrI-0nFL9qTz6W0Of74ZcIb-wPXbHrcx9cJCy9DUi9RBLH805qz-tExYGDfHKtM0d-r3Ilz4n_SolhpoUIqjc4n7JxlVpeN6VKCaZpAVOeG3KK0N4bGH8diomoSkOYmWoy8m2JnMbsKF42ptBY5hZuey_RPmAxp_qcCV0trQLy1BuNUfYxFEyL7c_emOhEluyahUpyaZgL_4FfY1PhhViF_0OhQA74UOobDSdqUobIprk1skQU69SEVeWfJKtWGtmijvw1GMY2juqgC_x1OZWcI4wl6ha6HHdq7UvbBEa-1n_hp56piCimosX4cKW_o-rBUVoqPNuWtVFkBHy0OjN93F6Q26u5X7fRMz-Ihyn2Ly4Y_IUdnNgVkdnA1DPjKWJL_RfBLnR-K9OaBG39ir-xCIgIKo1g129oRXOBSKf0QQMpdnt8qBfnunwuWWBCqw4_PADjOmivpY7r4g4A8-JB2NgBzUZNWr2XLAJ0pQfSmvd4k6UBuRs09KtlEa82wiwoRUbcYaDpTyX5Mw6YUKDh2i1D9y01oDin5Bx-KT-st1XcjWjHxSPTPxre1TxGrU1_G478niS3QmzJvbO5qXL6E-HlcfA5qJ9IrCNqcLt12Tn1z6Dp2sSM09_v3PSk55uTsOdrlXP780M7Smxqh1uQ_Uychcjaw8KngcXAFd1ITckJHYHxxN3scJ59HGozql45vekAaFzj_inYhvodfh6iUpJm8ZMUYgDHJBu-jZlKM-IR0iGZTPNCl8JLTN6ggrmXuaQHfhWfjNxuOHriGep2wpNzouuU-0BXWxEbn22T10OxyrVYvFU_CmuNQeFNpi7MECTBNMaGNHMhi8DZK6jjyxl4tsGqH29a3uppM7-Xwi55YhxxGofBp8bP_1aXSAd0e4K91QY61KlHHC0rgOlDIn0TfhIQ5joTo0OeBled-x21TodM3PXGwxGnOuGvh6QE5MkXGCN7ZgXniSJWmjJwBYjNVgqkiww0XnT1Ka4h2ydx7qIbI81ufDAOS_W6X6kukN31oPz8vliuIh-sjXKBAz88vMPiRaIu47BFs9zBn1BH6V78q7bikvFFCV-LYRi5Iu1ZosvUmaVb5_KMvikifUUUHrDPrAfzCNRHvSPDd9z1Q9IzCnWR6bJYvGdyDB13KrzG1v0B7hzul5GY1ZUFjW5m0EUg&cid=CAASEuRoux_9BlJjP0Xw_r3fOVck0Q&rfl=2%2Chttps%253A%252F%252Fthiennhienkythu.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 04:39:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5171
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 07 Oct 2022 04:39:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2A0A 22 KB
8 KB 7ms
6ms Document
text/html 142.250.186.33
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Thu, 07 Oct 2021 04:39:19 GMT
expires: Fri, 07 Oct 2022 04:39:19 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 5170
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 uoJ82QSyBbq_FXH5zff91I1FpHA-XwZ_JVg0ka7Wlv0.js Show response
pagead2.googlesyndication.com/bg/ Frame 2A0A 35 KB
13 KB 10ms
10ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/uoJ82QSyBbq_FXH5zff91I1FpHA-XwZ_JVg0ka7Wlv0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba827cd904b205babf1571f9cdf7fdd48d45a4703e5f067f25583491aed696fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 17:27:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45466
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13468
x-xss-protection: 0
last-modified: Mon, 04 Oct 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 06 Oct 2022 17:27:43 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 5675
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/821867/57401168/xbbe/creative/adj?p=APEucNUpXO7xgWxWskfsBQhFhrN3Ds83nQ7uTmvdXm4juYtcAh5SWeI&d=CnkAoCZ_4Gup8rPpXt2JhYDmYW5JqIJCPx0AjJvYDybtX12rvvmi9dVrfIpcQSyr...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUpXO7xgWxWskfsBQhFhrN3Ds83nQ7uTmvdXm4juYtcAh5SWeI&d=CnkAoCZ_4Gup8rPpXt2JhYDmYW5JqIJCPx0AjJvYDybtX12rvvmi9dVrfIpcQSyrWqaEDGsoxWxGYXm7flABcSdVq...

61 KB
20 KB

54ms
46ms

Script
text/javascript

74.125.71.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUpXO7xgWxWskfsBQhFhrN3Ds83nQ7uTmvdXm4juYtcAh5SWeI&d=CnkAoCZ_4Gup8rPpXt2JhYDmYW5JqIJCPx0AjJvYDybtX12rvvmi9dVrfIpcQSyrWqaEDGsoxWxGYXm7flABcSdVqhTn2EryqjuJwr4zH7N4XPBDNWpS1pc-DK_e5xfGutNpb7BADZ1UFOeBRHfxsstirg4FEF_2gq6pEpkTAKAmf-Cf0q3chQTKdKOhPQhW1OQKmhcJyr_7ZDmQ-8eDKDS5H8Wha2Dz81ynjJZovwTxg0P_e-lQSlsFGaXvXampC_qQ69EKBBVQHdsI1WBdmCH82MQWiJbP5jfQhUGEkOkj_zKUkYSB8tcDhroKO325c0afextgRCysgHhTXyojlTcOtj6_RyKarTwK3xzc0hsDzdSwTtKc2BtPPiKnRvOg67UZNszonnD5wz7BG5v4PI90ggc8xX21lHTR22F0_Zgt0xc-0Qx9PooImapQrzfNuBiPlKCCYSlmGYGjnjl7knAFk14JvDcTvLc3GtYWwW9PkdIL4iGo2uVsXXKBkOuKkyZm4Rh-qv_4woRTu8DvY88sIxl7bXlqonsLsJHu5MzsRfF9yYvasAxMnQLEkA-hRcVsLbxQWO4ELRRFGh1GlezszIicjv-zk9nm47ivvQMaR-43aCiCgQR5x_rOxQK6HJxo_lStdckls-8b-9QPxlwkIAwaWLaIfg46Vaow3YGsdu67Nzrm1XZSrRRXznfVRFObK9-gxjAGIqGDzK7KMcTdi4885DY-kzrEr0LkizaZ4UNitCNWn0UndF3FP8ZPo3MXlkHB4sPZsubG6x46irdbG7iS3T8oZaZn1gSFW9pUL8Xl5DMy-FZpV0sUQy-9G9vwWMGtQ77sQUGeZNTXjge2tfayXbcHIpOSQMfaJ0CVXlWKe6k_mnbnprrwsIhZSYR5xuDshYirZGtzrpKk2Y7tTsntt98CPDQW_JP0LXfdG2v0J5Bfaa5QfOHdN6OVQ5b1Cqdj4zmMkF0Y4WiffvbAse2z4mZgCAbsOSqXWax5S467dVHQIU0-qyC2IBhQuK-EYx3b3REbBpi92uNy25VP3CMowwSORJvMtRQ4o3J9ivLzs6afV6A18qllTScZFp25M_ryXfQr6x34a3N3n4Sc3VzoQnHlJSCPbA1I9mVFJ72X0ns4uPG2AKtsMmf77eFeThfCS4yhq_0b0MHul5IBCTVZUWACnp9LU-4Bo7yH6tfaYQzFS8ApivL0Thup_KA64fg3r5fpp7fAFdFFO0im4kvvs0GMc_W_Ey9l_lJCAIAcMQHe-OYq9dccAhsHptJBHfeh1s4_SehiRO4IfJQpkcdLnqu8E6F2Tc7x2SbvJWnpQbo1LZScHSFKPqpzffnD3JvW9VUgRGY8vrrDMDYOmEySvlJlTDEB0WvUZ93CsXa2TMp9bLdziGOy5etdJqQZRRP1VlQQQLXqrwRMMy--S5UUIz0FuH6zdssetGnzjZPRFHBA37zEwFo5QaFFlc_DE_bCxpmCNnqgeIkRvR6tcb9J1Ect_zsPrAaWgj4UheCsc-YSu06LZf9TND2UBFW2zDbnE86QZONpM6P8Oc4UdlYHVNpznwfb84ChHeTzMBGY-r-yqB7AK6oArKzot4_qRSD14gCiG35Y3-5zzoupNINiMCxwYQr0GVxU-e7jXYdNW_d-Q9OYeaJ1j0lBe-24aXG4L0JZ1LvROVvRrvlldKybwPqsrfwbWgF_YEpclr9Te2adF5eYIJKht78IhdLqfZqGCeJ8bNyI3WpgacgJnTZa6hjRCzxOHyCbOA4yCRC1S2IurTI5jLTOL6W8jVROtNwoyIMyU9TXNlUmI6uj76Zrud74zh_EdEeirE0HH6iPbcuquLuAcXa3SvkghSj2K5ncFJWxEfxbsmLVaYhEMhXP1Kds9cy1be72S64c8latdyFflFgatjS1rIHLvzJCSk17_cwct-KQeG3Q153Q8d2u3AUPRF9OhrJQnWKN-4ppVtg_4l_gPD74ij__xWuUTkeZDQ82R-T9CgtNlbXWKwgOef9ttpNPtALV2J7dRgHNxvysTuErzAd2dw4nz1m7CbNkYbxvf_53b_EdbXP23Cl4aThx5lavcepwrOJ4JIm-Zu6dBJWEnyzuk4_O5t9q3-xHnBhvImrdrY7kmMD-ETTqsWWEZbP14ll3CoMRwmlndAW4nfVNZw2eu5Q5PJrWMn3BIiKKwSjzM48vzXD0u1R2bytCt6bTHWqIkPmtaFnrKEHuayo90ujh8cy5dDq0KRVhGjkSHFfOHA-G6cpyos7_Hru34jHX23qQSxgcy4c6r4K-7dMHjf8orinPbrqVP1lSNk6mofzNAkN61tRnBbgzl2pcfS41KPPYawVWj2clVy61a7tAaGGvDFJO0ygk3Dm9xXkEV4PHrRjsZzGNVsksnBOFUth4PwXKDKoB-Fb5uO-eoYHEfLWz9D6D8z0QHslAP0q_XdL3qZt8-Z-KcnqVsbxYfvfq3eUHe602O1dBA-HUClLmE1ispQ2cx4W4XcvF_pyJ_4KQ_rBYmHaZFRq4AIimOIcit-yZC6_E0T8GG19IxSq3shbzy3rAyz46CWK92Q74K1-2eQ_5iUPFqOWc6pN1eVQ8zPnoceHhAoZN6jZ4_40Wr_kCjCmLTWonIYuiXaz0nzTkiFw_YlCSBPpN2Bxkq0lgRzZWQmdUtLeXyHd6VOfHtBXf1WLmYHimsGJi4LeKL1yAkj8kxDGX4abDHmaW47RdMmd40jTVmSTNL8EjwZWET-Y3pR1xPWC0kmqx-DPwseoD2fbwx_ax4eAtNCC-nR6_B7MYHlaO8u5jkH4F5lxrqe0ivuJC8zm4UOkYodgqoMQnAPh-lA0dTJFupYnnbhDo7cZ2VBROkvlhWuwNbD4oMRN4lnIAvy-6qxXTTw8TdC9gWgtbNxOpXWU0zzeQZCnBbCi7iaIcTMvl4v_7i3A1IJCzbeTNOCgQpTJQgdw9l94x4415a07FTfQGFXKLe-k0hto5w242jwcUbSVsJn2RkSmN8iPPpGWqVHMRidins5FlMYZg4CUuLMd8sAE9fUbjDeM5vP0RXBbz385e-OglfyZN4maOuiSiFFCL7gbwGSRLIVssEiC6HIHkjA_048iJQSv_VStA76suOjDrNzUkEmrOJ1YdS0AxEsYdMHX3JhIu6ZR4wnOldZ4Vv7Qo9y_LLkuY2iKXNldybglnXs58uvoaQkLd93eBPR8AuMGS3vk_ShVx3bA3o00biBg0aOPSn9K-ucjlMtMRHAV2DXK4lgodXybn3NecHzjZCZmVjl_0YBdQEEk8ErPUF6DSnjb62aOQSrhlTv3yygQzcuDtOo8xfYuY2ge3guPwEexusahCrVJYD1RchrtXFqMyM1dTkfmTwkgmUQy_ejf3ggK5lKgiYt_hnXW7YSLl_B_7swjarp7hioNmm1dRR7Vei5nSrHwGtrXE9_xAi9wEGhYIABIS5Gi7H_0GUmM_RfD-vd85VyTRYAE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.71.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wn-in-f156.1e100.net

Software

cafe /

Resource Hash

120045e1f3d653cc9f855b1a7614837f97e816ffdca9ba6816d7461059e7cf56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20033
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
x-server-name: app18.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUpXO7xgWxWskfsBQhFhrN3Ds83nQ7uTmvdXm4juYtcAh5SWeI&d=CnkAoCZ_4Gup8rPpXt2JhYDmYW5JqIJCPx0AjJvYDybtX12rvvmi9dVrfIpcQSyrWqaEDGsoxWxGYXm7flABcSdVqhTn2EryqjuJwr4zH7N4XPBDNWpS1pc-DK_e5xfGutNpb7BADZ1UFOeBRHfxsstirg4FEF_2gq6pEpkTAKAmf-Cf0q3chQTKdKOhPQhW1OQKmhcJyr_7ZDmQ-8eDKDS5H8Wha2Dz81ynjJZovwTxg0P_e-lQSlsFGaXvXampC_qQ69EKBBVQHdsI1WBdmCH82MQWiJbP5jfQhUGEkOkj_zKUkYSB8tcDhroKO325c0afextgRCysgHhTXyojlTcOtj6_RyKarTwK3xzc0hsDzdSwTtKc2BtPPiKnRvOg67UZNszonnD5wz7BG5v4PI90ggc8xX21lHTR22F0_Zgt0xc-0Qx9PooImapQrzfNuBiPlKCCYSlmGYGjnjl7knAFk14JvDcTvLc3GtYWwW9PkdIL4iGo2uVsXXKBkOuKkyZm4Rh-qv_4woRTu8DvY88sIxl7bXlqonsLsJHu5MzsRfF9yYvasAxMnQLEkA-hRcVsLbxQWO4ELRRFGh1GlezszIicjv-zk9nm47ivvQMaR-43aCiCgQR5x_rOxQK6HJxo_lStdckls-8b-9QPxlwkIAwaWLaIfg46Vaow3YGsdu67Nzrm1XZSrRRXznfVRFObK9-gxjAGIqGDzK7KMcTdi4885DY-kzrEr0LkizaZ4UNitCNWn0UndF3FP8ZPo3MXlkHB4sPZsubG6x46irdbG7iS3T8oZaZn1gSFW9pUL8Xl5DMy-FZpV0sUQy-9G9vwWMGtQ77sQUGeZNTXjge2tfayXbcHIpOSQMfaJ0CVXlWKe6k_mnbnprrwsIhZSYR5xuDshYirZGtzrpKk2Y7tTsntt98CPDQW_JP0LXfdG2v0J5Bfaa5QfOHdN6OVQ5b1Cqdj4zmMkF0Y4WiffvbAse2z4mZgCAbsOSqXWax5S467dVHQIU0-qyC2IBhQuK-EYx3b3REbBpi92uNy25VP3CMowwSORJvMtRQ4o3J9ivLzs6afV6A18qllTScZFp25M_ryXfQr6x34a3N3n4Sc3VzoQnHlJSCPbA1I9mVFJ72X0ns4uPG2AKtsMmf77eFeThfCS4yhq_0b0MHul5IBCTVZUWACnp9LU-4Bo7yH6tfaYQzFS8ApivL0Thup_KA64fg3r5fpp7fAFdFFO0im4kvvs0GMc_W_Ey9l_lJCAIAcMQHe-OYq9dccAhsHptJBHfeh1s4_SehiRO4IfJQpkcdLnqu8E6F2Tc7x2SbvJWnpQbo1LZScHSFKPqpzffnD3JvW9VUgRGY8vrrDMDYOmEySvlJlTDEB0WvUZ93CsXa2TMp9bLdziGOy5etdJqQZRRP1VlQQQLXqrwRMMy--S5UUIz0FuH6zdssetGnzjZPRFHBA37zEwFo5QaFFlc_DE_bCxpmCNnqgeIkRvR6tcb9J1Ect_zsPrAaWgj4UheCsc-YSu06LZf9TND2UBFW2zDbnE86QZONpM6P8Oc4UdlYHVNpznwfb84ChHeTzMBGY-r-yqB7AK6oArKzot4_qRSD14gCiG35Y3-5zzoupNINiMCxwYQr0GVxU-e7jXYdNW_d-Q9OYeaJ1j0lBe-24aXG4L0JZ1LvROVvRrvlldKybwPqsrfwbWgF_YEpclr9Te2adF5eYIJKht78IhdLqfZqGCeJ8bNyI3WpgacgJnTZa6hjRCzxOHyCbOA4yCRC1S2IurTI5jLTOL6W8jVROtNwoyIMyU9TXNlUmI6uj76Zrud74zh_EdEeirE0HH6iPbcuquLuAcXa3SvkghSj2K5ncFJWxEfxbsmLVaYhEMhXP1Kds9cy1be72S64c8latdyFflFgatjS1rIHLvzJCSk17_cwct-KQeG3Q153Q8d2u3AUPRF9OhrJQnWKN-4ppVtg_4l_gPD74ij__xWuUTkeZDQ82R-T9CgtNlbXWKwgOef9ttpNPtALV2J7dRgHNxvysTuErzAd2dw4nz1m7CbNkYbxvf_53b_EdbXP23Cl4aThx5lavcepwrOJ4JIm-Zu6dBJWEnyzuk4_O5t9q3-xHnBhvImrdrY7kmMD-ETTqsWWEZbP14ll3CoMRwmlndAW4nfVNZw2eu5Q5PJrWMn3BIiKKwSjzM48vzXD0u1R2bytCt6bTHWqIkPmtaFnrKEHuayo90ujh8cy5dDq0KRVhGjkSHFfOHA-G6cpyos7_Hru34jHX23qQSxgcy4c6r4K-7dMHjf8orinPbrqVP1lSNk6mofzNAkN61tRnBbgzl2pcfS41KPPYawVWj2clVy61a7tAaGGvDFJO0ygk3Dm9xXkEV4PHrRjsZzGNVsksnBOFUth4PwXKDKoB-Fb5uO-eoYHEfLWz9D6D8z0QHslAP0q_XdL3qZt8-Z-KcnqVsbxYfvfq3eUHe602O1dBA-HUClLmE1ispQ2cx4W4XcvF_pyJ_4KQ_rBYmHaZFRq4AIimOIcit-yZC6_E0T8GG19IxSq3shbzy3rAyz46CWK92Q74K1-2eQ_5iUPFqOWc6pN1eVQ8zPnoceHhAoZN6jZ4_40Wr_kCjCmLTWonIYuiXaz0nzTkiFw_YlCSBPpN2Bxkq0lgRzZWQmdUtLeXyHd6VOfHtBXf1WLmYHimsGJi4LeKL1yAkj8kxDGX4abDHmaW47RdMmd40jTVmSTNL8EjwZWET-Y3pR1xPWC0kmqx-DPwseoD2fbwx_ax4eAtNCC-nR6_B7MYHlaO8u5jkH4F5lxrqe0ivuJC8zm4UOkYodgqoMQnAPh-lA0dTJFupYnnbhDo7cZ2VBROkvlhWuwNbD4oMRN4lnIAvy-6qxXTTw8TdC9gWgtbNxOpXWU0zzeQZCnBbCi7iaIcTMvl4v_7i3A1IJCzbeTNOCgQpTJQgdw9l94x4415a07FTfQGFXKLe-k0hto5w242jwcUbSVsJn2RkSmN8iPPpGWqVHMRidins5FlMYZg4CUuLMd8sAE9fUbjDeM5vP0RXBbz385e-OglfyZN4maOuiSiFFCL7gbwGSRLIVssEiC6HIHkjA_048iJQSv_VStA76suOjDrNzUkEmrOJ1YdS0AxEsYdMHX3JhIu6ZR4wnOldZ4Vv7Qo9y_LLkuY2iKXNldybglnXs58uvoaQkLd93eBPR8AuMGS3vk_ShVx3bA3o00biBg0aOPSn9K-ucjlMtMRHAV2DXK4lgodXybn3NecHzjZCZmVjl_0YBdQEEk8ErPUF6DSnjb62aOQSrhlTv3yygQzcuDtOo8xfYuY2ge3guPwEexusahCrVJYD1RchrtXFqMyM1dTkfmTwkgmUQy_ejf3ggK5lKgiYt_hnXW7YSLl_B_7swjarp7hioNmm1dRR7Vei5nSrHwGtrXE9_xAi9wEGhYIABIS5Gi7H_0GUmM_RfD-vd85VyTRYAE
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 26C7 80 KB
21 KB 455ms
7ms Script
application/javascript 18.66.122.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 511019
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 7b314c2b827b3a655861e27775634208.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA60-P2
content-type: application/javascript
x-amz-cf-id: rKS_JrW55pVC3REF8oNRlRC39bNcETckLtk6BWksYuLSVDrgEhiaSw==

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame 5675 43 B
301 B 532ms
89ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=821867&asId=a0c5bd6f-8bb6-5399-86e9-83a45a4e3bfa&tv=%7Bc:qkQEA2,pingTime:-3,time:48,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:17%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:48,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B43~0%5D,as:%5B43~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sL8fr86+11%7C12%7C131*.821867-57401168%7C1311%7C13121%7C1411%7C1412%7C1413%7C15,idMap:131*,rmeas:1,rend:0,renddet:IMG.us%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
X-Server-Name: dt36.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame 5675 43 B
301 B 529ms
88ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=821867&asId=a0c5bd6f-8bb6-5399-86e9-83a45a4e3bfa&tv=%7Bc:qkQEA3,pingTime:-6,time:49,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:49,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B44~0%5D,as:%5B44~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sL8fr86+11%7C12%7C131*.821867-57401168%7C1311%7C13121%7C1411%7C1412%7C1413%7C15,idMap:131*,rmeas:1,rend:0,renddet:IMG.us%7D&tpiLookup=ao:thiennhienkythu.com*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
X-Server-Name: dt52.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame 5675 43 B
301 B 521ms
88ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=821867&asId=a0c5bd6f-8bb6-5399-86e9-83a45a4e3bfa&tv=%7Bc:qkQEAd,pingTime:-2,time:59,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:213,beZ:214,mfA:216,cmA:217,inA:217,inZ:220,prA:220,prZ:225,si:232,poA:233,poZ:257,cmZ:257,mfZ:257,loA:263,loZ:264,ltA:272,ltZ:272%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:17%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:59,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B54~0%5D,as:%5B54~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sL8fr86+11%7C12%7C131*.821867-57401168%7C1311%7C13121%7C1411%7C1412%7C1413%7C15,idMap:131*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,sinceFw:39,readyFired:false%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
X-Server-Name: dt43.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A0A 0
20 B 30ms
30ms Image
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BAtrvKY5eYa_7CYuJ7_UPqpCAoA4AAAAAOAHgBAI&bg=!rq2lrenNAAYiB-bNIgc7ACkAdvg8WgSnru7abir4L4dYDimWGJ1WcBA4Xk-C3OkmrM6_gCzSTn8F4gIAAACsUgAAAApoAQeZAujV4DzaOIPMptvHmXZJvcHuyqr0Pas4Qv1GFETB3z5nDKPho6mPNCHeMjcNFSRGfFSgrTNldnCXAWQDo-b4zibWATbXBqW_O24R6AXt1vBLxwWJYHNkzI8aMi3ZTbiku3uhSI6s80Cx8I1NEMf_CcrPnbvjB7VxPPBqokr6b67Bczfo_Nv-eXQFrzM9kNSN7UGne2wKOSDMr_j1q6fauKE_n_2YuUuQktX5Q--d9eJLzr0-4Mqo_0B3OlfiDUorfRK752af6pTge24QqNgSX-MIbkbEhIOS-4eFaxGKuhX90fxRNiR-4bqFFyeUTJrJ1HfMIsgGXkyCen1TnUzW33zBWuih8Z1jHggT8axnExB0PLW8d8jiXPSPVxCYT-yJX3oeGnN2Rsbra7YCQ3IencarR9eyT9qtkur8kvcsRHjPuwH0MN9VyET0VqzFSxv6Q7UEKr19NEpD2kkwXFj_w_o92MYioDGVAxq23QxiIFtEse05IO3KYH4WdiieYmnW_tn5T0z2-y1dJ9ONkG5dWuEYUI7ZQMo2toyX7ENAFXHJNdefM7S_vUH1i4zR2lFrY06dBheu8N9CvPJQEscDpsAjFdcIWR-jL0yknh8Cwgc_WIzEcmxr_lwiquf7DKiQrO5ALVZpDOOcsiHAF41qzRCBjfp-_S84wSYbiTwjrRh0-qubD1Pmn1I54UsQP8uCt5PRrbslWPg8jamqC-nIxaGspqnIRJKVVHeyma9epj8IrEQ1EpMWu4y2vFfXBYaCguw2N4l_fZYjPJcqbuvi8j82BIq97x3zedNpNLeJSve_IJnpsq0Uugd4t_1Z3KiCGRReyVkpOO0Sw8IC9wMIVWwP7smdvBFd0Mx07SbK0-mAbfyLpWcHejyK3uPM-eZwzm_rzVx0-T8Crx2Y3yvL25tV5p5GNbqabReoE_Az1DGtgkK8H1TUDnE7hSA7cnsxcwYV3Uc0LM9IjVEBBADrUPyYctVUjS-biuY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 5675 106 KB
37 KB 22ms
8ms Script
text/javascript 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 14:55:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54615
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 07 Oct 2021 14:55:14 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/elements/html/ Frame 5675 8 KB
3 KB 7ms
6ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/821867/57401168/xbbe/creative/adj?p=APEucNUpXO7xgWxWskfsBQhFhrN3Ds83nQ7uTmvdXm4juYtcAh5SWeI&d=CnkAoCZ_4Gup8rPpXt2JhYDmYW5JqIJCPx0AjJvYDybtX12rvvmi9dVrfIpcQSyrWqaEDGsoxWxGYXm7flABcSdVqhTn2EryqjuJwr4zH7N4XPBDNWpS1pc-DK_e5xfGutNpb7BADZ1UFOeBRHfxsstirg4FEF_2gq6pEpkTAKAmf-Cf0q3chQTKdKOhPQhW1OQKmhcJyr_7ZDmQ-8eDKDS5H8Wha2Dz81ynjJZovwTxg0P_e-lQSlsFGaXvXampC_qQ69EKBBVQHdsI1WBdmCH82MQWiJbP5jfQhUGEkOkj_zKUkYSB8tcDhroKO325c0afextgRCysgHhTXyojlTcOtj6_RyKarTwK3xzc0hsDzdSwTtKc2BtPPiKnRvOg67UZNszonnD5wz7BG5v4PI90ggc8xX21lHTR22F0_Zgt0xc-0Qx9PooImapQrzfNuBiPlKCCYSlmGYGjnjl7knAFk14JvDcTvLc3GtYWwW9PkdIL4iGo2uVsXXKBkOuKkyZm4Rh-qv_4woRTu8DvY88sIxl7bXlqonsLsJHu5MzsRfF9yYvasAxMnQLEkA-hRcVsLbxQWO4ELRRFGh1GlezszIicjv-zk9nm47ivvQMaR-43aCiCgQR5x_rOxQK6HJxo_lStdckls-8b-9QPxlwkIAwaWLaIfg46Vaow3YGsdu67Nzrm1XZSrRRXznfVRFObK9-gxjAGIqGDzK7KMcTdi4885DY-kzrEr0LkizaZ4UNitCNWn0UndF3FP8ZPo3MXlkHB4sPZsubG6x46irdbG7iS3T8oZaZn1gSFW9pUL8Xl5DMy-FZpV0sUQy-9G9vwWMGtQ77sQUGeZNTXjge2tfayXbcHIpOSQMfaJ0CVXlWKe6k_mnbnprrwsIhZSYR5xuDshYirZGtzrpKk2Y7tTsntt98CPDQW_JP0LXfdG2v0J5Bfaa5QfOHdN6OVQ5b1Cqdj4zmMkF0Y4WiffvbAse2z4mZgCAbsOSqXWax5S467dVHQIU0-qyC2IBhQuK-EYx3b3REbBpi92uNy25VP3CMowwSORJvMtRQ4o3J9ivLzs6afV6A18qllTScZFp25M_ryXfQr6x34a3N3n4Sc3VzoQnHlJSCPbA1I9mVFJ72X0ns4uPG2AKtsMmf77eFeThfCS4yhq_0b0MHul5IBCTVZUWACnp9LU-4Bo7yH6tfaYQzFS8ApivL0Thup_KA64fg3r5fpp7fAFdFFO0im4kvvs0GMc_W_Ey9l_lJCAIAcMQHe-OYq9dccAhsHptJBHfeh1s4_SehiRO4IfJQpkcdLnqu8E6F2Tc7x2SbvJWnpQbo1LZScHSFKPqpzffnD3JvW9VUgRGY8vrrDMDYOmEySvlJlTDEB0WvUZ93CsXa2TMp9bLdziGOy5etdJqQZRRP1VlQQQLXqrwRMMy--S5UUIz0FuH6zdssetGnzjZPRFHBA37zEwFo5QaFFlc_DE_bCxpmCNnqgeIkRvR6tcb9J1Ect_zsPrAaWgj4UheCsc-YSu06LZf9TND2UBFW2zDbnE86QZONpM6P8Oc4UdlYHVNpznwfb84ChHeTzMBGY-r-yqB7AK6oArKzot4_qRSD14gCiG35Y3-5zzoupNINiMCxwYQr0GVxU-e7jXYdNW_d-Q9OYeaJ1j0lBe-24aXG4L0JZ1LvROVvRrvlldKybwPqsrfwbWgF_YEpclr9Te2adF5eYIJKht78IhdLqfZqGCeJ8bNyI3WpgacgJnTZa6hjRCzxOHyCbOA4yCRC1S2IurTI5jLTOL6W8jVROtNwoyIMyU9TXNlUmI6uj76Zrud74zh_EdEeirE0HH6iPbcuquLuAcXa3SvkghSj2K5ncFJWxEfxbsmLVaYhEMhXP1Kds9cy1be72S64c8latdyFflFgatjS1rIHLvzJCSk17_cwct-KQeG3Q153Q8d2u3AUPRF9OhrJQnWKN-4ppVtg_4l_gPD74ij__xWuUTkeZDQ82R-T9CgtNlbXWKwgOef9ttpNPtALV2J7dRgHNxvysTuErzAd2dw4nz1m7CbNkYbxvf_53b_EdbXP23Cl4aThx5lavcepwrOJ4JIm-Zu6dBJWEnyzuk4_O5t9q3-xHnBhvImrdrY7kmMD-ETTqsWWEZbP14ll3CoMRwmlndAW4nfVNZw2eu5Q5PJrWMn3BIiKKwSjzM48vzXD0u1R2bytCt6bTHWqIkPmtaFnrKEHuayo90ujh8cy5dDq0KRVhGjkSHFfOHA-G6cpyos7_Hru34jHX23qQSxgcy4c6r4K-7dMHjf8orinPbrqVP1lSNk6mofzNAkN61tRnBbgzl2pcfS41KPPYawVWj2clVy61a7tAaGGvDFJO0ygk3Dm9xXkEV4PHrRjsZzGNVsksnBOFUth4PwXKDKoB-Fb5uO-eoYHEfLWz9D6D8z0QHslAP0q_XdL3qZt8-Z-KcnqVsbxYfvfq3eUHe602O1dBA-HUClLmE1ispQ2cx4W4XcvF_pyJ_4KQ_rBYmHaZFRq4AIimOIcit-yZC6_E0T8GG19IxSq3shbzy3rAyz46CWK92Q74K1-2eQ_5iUPFqOWc6pN1eVQ8zPnoceHhAoZN6jZ4_40Wr_kCjCmLTWonIYuiXaz0nzTkiFw_YlCSBPpN2Bxkq0lgRzZWQmdUtLeXyHd6VOfHtBXf1WLmYHimsGJi4LeKL1yAkj8kxDGX4abDHmaW47RdMmd40jTVmSTNL8EjwZWET-Y3pR1xPWC0kmqx-DPwseoD2fbwx_ax4eAtNCC-nR6_B7MYHlaO8u5jkH4F5lxrqe0ivuJC8zm4UOkYodgqoMQnAPh-lA0dTJFupYnnbhDo7cZ2VBROkvlhWuwNbD4oMRN4lnIAvy-6qxXTTw8TdC9gWgtbNxOpXWU0zzeQZCnBbCi7iaIcTMvl4v_7i3A1IJCzbeTNOCgQpTJQgdw9l94x4415a07FTfQGFXKLe-k0hto5w242jwcUbSVsJn2RkSmN8iPPpGWqVHMRidins5FlMYZg4CUuLMd8sAE9fUbjDeM5vP0RXBbz385e-OglfyZN4maOuiSiFFCL7gbwGSRLIVssEiC6HIHkjA_048iJQSv_VStA76suOjDrNzUkEmrOJ1YdS0AxEsYdMHX3JhIu6ZR4wnOldZ4Vv7Qo9y_LLkuY2iKXNldybglnXs58uvoaQkLd93eBPR8AuMGS3vk_ShVx3bA3o00biBg0aOPSn9K-ucjlMtMRHAV2DXK4lgodXybn3NecHzjZCZmVjl_0YBdQEEk8ErPUF6DSnjb62aOQSrhlTv3yygQzcuDtOo8xfYuY2ge3guPwEexusahCrVJYD1RchrtXFqMyM1dTkfmTwkgmUQy_ejf3ggK5lKgiYt_hnXW7YSLl_B_7swjarp7hioNmm1dRR7Vei5nSrHwGtrXE9_xAi9wEGhYIABIS5Gi7H_0GUmM_RfD-vd85VyTRYAE&adsafe_url=https%3A%2F%2Fthiennhienkythu.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fthiennhienkythu.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-1828578781656677%26output%3Dhtml%26h%3D250%26adk%3D287205637%26adf%3D3380645095%26pi%3Dt.aa~a.282655012~rp.4%26w%3D310%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1633586728%26rafmt%3D1%26to%3Dqs%26pwprc%3D9278575066%26psa%3D0%26format%3D310x250%26url%3Dhttps%253A%252F%252Fthiennhienkythu.com%252F%26flash%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.%26dt%3D1633586728567%26bpp%3D2%26bdt%3D850%26idt%3D2%26shv%3Dr20211004%26mjsv%3Dm202109290101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D15c01a7e15d9d503-2218fa7be9ca008a%253AT%253D1633586728%253ART%253D1633586728%253AS%253DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q%26prev_fmts%3D0x0%26nras%3D2%26correlator%3D1069728112185%26frm%3D20%26pv%3D1%26ga_vid%3D2019392783.1633586728%26ga_sid%3D1633586728%26ga_hid%3D1757043831%26ga_fc%3D0%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_java%3D0%26u_nplug%3D3%26u_nmime%3D4%26adx%3D995%26ady%3D1277%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D31062422%26oid%3D2%26pvsid%3D1361001907429351%26pem%3D393%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3DKC9enG6Le3%26p%3Dhttps%253A%2F%2Fthiennhienkythu.com%26dtd%3D15&adsafe_type=bd&adsafe_jsinfo=,id:a0c5bd6f-8bb6-5399-86e9-83a45a4e3bfa,c:qkQEzy,sl:outOfView,em:true,fr:false,thd:1,mn:app14ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,br:c,abv:na,an:n,oam:0,scm:publ1,nbld:0,mtim:2,fm:sL8fr86+11%7C12%7C131*.821867-57401168%7C1311%7C13121%7C1411%7C1412%7C1413%7C15,idMap:131*,ex:e2,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:18,oid:9291bce4-2734-11ec-afe8-02c390e9b11a,v:19.8.248,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67cf5c21bfc71ee46210832792237e4a6ccd99e5c7bc198b046a38c9167fd0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:01:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 220
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3128
x-xss-protection: 0
server: cafe
etag: 3658073882064373855
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 06:01:49 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/ Frame 5675 23 KB
9 KB 7ms
6ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211005/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b4cc12ccd09adacbf7695b7ae68d146a6b9bfa7a2058dbd4e58f31c14ec5e7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:01:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 222
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9203
x-xss-protection: 0
server: cafe
etag: 15223966529599630443
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 21 Oct 2021 06:01:47 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DD19 1 KB
754 B 8ms
8ms Document
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 06 Oct 2021 08:58:57 GMT
expires: Thu, 07 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 75992
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 5675 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f37b9022a4e37f0ac1ffc526cc49a990e25d9c6f15b37f1c37d8276815e0a97

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 durly.js Show response
c.betrad.com/ Frame 5675 4 KB
2 KB 32ms
7ms Script
application/x-javascript 104.92.105.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.betrad.com/durly.js?;ad_wxh=300x250;coid=675;nid=156480;ecaid=6260004;26459188;6492655;313933996;%eexpi
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.92.105.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-105-51.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 06f777ff38a8dd1b7583e8323755ef6ed1c5ab41107894ed98792553e82097ba

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:29 GMT
content-encoding: gzip
last-modified: Wed, 14 Nov 2018 17:30:33 GMT
server: AkamaiNetStorage
etag: "2dfa8070bee860ca86deb1779cf87d3e:1542216642"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
access-control-max-age: 108000
accept-ranges: bytes
access-control-allow-headers: *
content-length: 1605

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 5 KB
2 KB 8ms
8ms Document
text/html 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97cc806ea499d012826b6dc2834ec58125940aa4ab10f753f5aab2baa18db86c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/10667973811766473475/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 2070
date: Mon, 04 Oct 2021 16:34:04 GMT
expires: Tue, 04 Oct 2022 16:34:04 GMT
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 221485
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5675 0
23 B 31ms
31ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssI43dA9VpNJpFhsazQ24NxZ8BNztgiw3TDq7xum1EtuuDJkYBDtARVzTj6HfWMXcdYqIucaw2cIQPsy0UW1QnQNzj86hFbxcZ-gWWvhebkiV0Li6b9iR8jdaeFqjjey9K-ZDIJ1VYg7j14ZN1Ak9GkPZYzZTGLJTRe9ER_jKGoUdbGyr8ICAOeAfwuoWjaiSLuxQ&sai=AMfl-YRFPJZU45eNMrN0TUaCjqnozHTqCTTryZ3iAQNIsFsVkZwvnff9P-m7LS3qo7wc5X7A3-dsDvtpdxbVwiNUhfM8MQlvDLBe6OCjiuQPuVNvz0Z1gk8YUDvej62y&sig=Cg0ArKJSzDgsYvuBwWvZEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=55&cbvp=1&cstd=53&cisv=r20211005.98752&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 07 Oct 2021 06:05:29 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK /
d.agkn.com/pixel/2387/ Frame 5675 43 B
662 B 75ms
9ms Image
image/gif 18.192.155.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/2387/?ct=US&st=&city=0&dma=0&zp=&bw=3&che=3211901040&col=26459188,6492655,313933996,506939591,157980379
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.192.155.173 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-192-155-173.eu-central-1.compute.amazonaws.com
Software: Apache-Coyote/1.1 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK 61025
stags.bluekai.com/site/ Frame 5675 62 B
329 B 208ms
152ms Image
image/gif 104.89.42.102
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/61025?phint=event%3Dimp&phint=aid%3D6260004&phint=pid%3D313933996&phint=cid%3D26459188&phint=crid%3D157980379&phint=format%3Ddisplay&phint=sid%3D6492655
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.42.102 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-42-102.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 07 Oct 2021 06:05:30 GMT
X-N: S
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
BK-Server: de6d
Content-Type: image/gif

GET
H2 200 v1
p.tvpixel.com/com.snowplowanalytics.iglu/ Frame 5675 43 B
387 B 309ms
101ms Image
image/gif 52.4.125.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.tvpixel.com/com.snowplowanalytics.iglu/v1?schema=iglu:com.dataplusmath/display_impression/jsonschema/1-0-0&aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&cb=3211901040&pub_id=6492655&adv_id=6260004&adv_nm=&c_id=26459188&c_nm=&pl_id=313933996&pl_nm=&ad_id=506939591&ad_nm=157980379&width=&height=&u_id=&u_ip=&app_id=&app_nm=&dvc_typ=&dvc_id=&dvc_lat=&us_privacy=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.125.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-125-51.compute-1.amazonaws.com
Software: akka-http/10.1.12 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
server: akka-http/10.1.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
content-length: 43

GET
H2

200

p2
sb.scorecardresearch.com/ Frame 5675
Redirect Chain

https://sb.scorecardresearch.com/p?c1=3&c2=34402982&c3=26459188&c4=157980379&c5=313933996&c11=6492655&c13=300x250&c16=dcm&cj=1&rn=3211901040&gdpr=&ax_fwd=1&gdpr_consent=&ax_ty=d&c6=11472
https://sb.scorecardresearch.com/p2?c1=3&c2=34402982&c3=26459188&c4=157980379&c5=313933996&c11=6492655&c13=300x250&c16=dcm&cj=1&rn=3211901040&gdpr=&ax_fwd=1&gdpr_consent=&ax_ty=d&c6=11472

64 B
328 B

10ms
10ms

Image
image/gif

143.204.98.125
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=3&c2=34402982&c3=26459188&c4=157980379&c5=313933996&c11=6492655&c13=300x250&c16=dcm&cj=1&rn=3211901040&gdpr=&ax_fwd=1&gdpr_consent=&ax_ty=d&c6=11472
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-125.fra50.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: sRpd2vhxfrLyPhdA0eSIS4W6izZVyp4QtfW2Zwde578AJlOs19LReA==

Redirect headers

date: Thu, 07 Oct 2021 06:05:30 GMT
via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/p2?c1=3&c2=34402982&c3=26459188&c4=157980379&c5=313933996&c11=6492655&c13=300x250&c16=dcm&cj=1&rn=3211901040&gdpr=&ax_fwd=1&gdpr_consent=&ax_ty=d&c6=11472
content-length: 209
x-amz-cf-id: EC_7XGH02SnInovHQ_1xi5PvsCzbknYMp5969fItMyyiW82VwDeMxQ==

GET
H2 200 dpixel
cms.quantserve.com/ Frame DD19 35 B
463 B 56ms
9ms Image
image/gif 91.228.74.226
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFk3w42oAOiaKFXstLxY3ao&google_cver=1&google_push=AYg5qPKROLmQwCEhmkrbM8WG4l0cWeNhP_3LYaPDko0GG--lMsOk9Lt2okYG13xMNJJlLYYqauFVKljrwD8CR4r-XSpxBusyG5M

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.226 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:30 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD19
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEJPGDQQWp2Yp5tA-uIBBQY0&google_cver=1&google_push=AYg5qPLIu0Yy3ipBlWk-eo52pRW75Cpy_nZLfGkMlsC6saK8lKIiHMKp5Lh6B3PsX3NdTSELalsBuNtRdRGDMG16murbnLeb0Q
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLIu0Yy3ipBlWk-eo52pRW75Cpy_nZLfGkMlsC6saK8lKIiHMKp5Lh6B3PsX3NdTSELalsBuNtRdRGDMG16murbnLeb0Q&google_hm=Q0FFU0VKUEdEUVFXcDJZcDV...

170 B
193 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLIu0Yy3ipBlWk-eo52pRW75Cpy_nZLfGkMlsC6saK8lKIiHMKp5Lh6B3PsX3NdTSELalsBuNtRdRGDMG16murbnLeb0Q&google_hm=Q0FFU0VKUEdEUVFXcDJZcDV0QS11SUJCUVkw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:29 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLIu0Yy3ipBlWk-eo52pRW75Cpy_nZLfGkMlsC6saK8lKIiHMKp5Lh6B3PsX3NdTSELalsBuNtRdRGDMG16murbnLeb0Q&google_hm=Q0FFU0VKUEdEUVFXcDJZcDV0QS11SUJCUVkw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD19
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEOu6Oji2TKgn09cw_g5JhK0&google_cver=1&google_push=AYg5qPLqlCjbZUe3gdRioJUnMbuvdmo3ivoUBr0gIEeVYruoO88ecbLfHIS2Ud-axB-yVUWhZkoHuD2A7IuV3In8fqM4r3RLqcI
https://rtb.openx.net/sync/dds?google_gid=CAESEOu6Oji2TKgn09cw_g5JhK0&google_cver=1&google_push=AYg5qPLqlCjbZUe3gdRioJUnMbuvdmo3ivoUBr0gIEeVYruoO88ecbLfHIS2Ud-axB-yVUWhZkoHuD2A7IuV3In8fqM4r3RLqcI&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLqlCjbZUe3gdRioJUnMbuvdmo3ivoUBr0gIEeVYruoO88ecbLfHIS2Ud-axB-yVUWhZkoHuD2A7IuV3In8fqM4r3RLqcI&google_hm=fy3lJA94zAU1WrfSS-4-DQ==

170 B
193 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLqlCjbZUe3gdRioJUnMbuvdmo3ivoUBr0gIEeVYruoO88ecbLfHIS2Ud-axB-yVUWhZkoHuD2A7IuV3In8fqM4r3RLqcI&google_hm=fy3lJA94zAU1WrfSS-4-DQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:29 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLqlCjbZUe3gdRioJUnMbuvdmo3ivoUBr0gIEeVYruoO88ecbLfHIS2Ud-axB-yVUWhZkoHuD2A7IuV3In8fqM4r3RLqcI&google_hm=fy3lJA94zAU1WrfSS-4-DQ==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 3poa8iv0gepk6aqhln9hum5q2i2il0bi

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD19
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=pp7oaMScTQiDZ683Zd0lTg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
193 B

16ms
16ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=pp7oaMScTQiDZ683Zd0lTg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKsj_cs5lknCSkegIf0_fNoWdwnd6PsX8MHiICua-75cck15yexmgVQwiQ-zgpI8JRbrwmkJ6kWK7HITb5KKQJdpcQuIA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=pp7oaMScTQiDZ683Zd0lTg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKsj_cs5lknCSkegIf0_fNoWdwnd6PsX8MHiICua-75cck15yexmgVQwiQ-zgpI8JRbrwmkJ6kWK7HITb5KKQJdpcQuIA
date: Thu, 07 Oct 2021 06:05:28 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DD19
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKyo4ut6tswOcNaCcwq1dXU&google_cver=1&google_push=AYg5qPIwiS5mv3Seac6-w_V4Mjy30OaCoHLxjn9-Ryq-c6IsgV1prdHRPF7Co7Hm6399Ur_ts03...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VHSkNaWlgtMTktSlJE&google_push=AYg5qPIwiS5mv3Seac6-w_V4Mjy30OaCoHLxjn9-Ryq-c6IsgV1prdHRPF7Co7Hm6399Ur_ts03C9T4Kt7Ry3JyUG3u_sJ5kUI8

170 B
193 B

18ms
18ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VHSkNaWlgtMTktSlJE&google_push=AYg5qPIwiS5mv3Seac6-w_V4Mjy30OaCoHLxjn9-Ryq-c6IsgV1prdHRPF7Co7Hm6399Ur_ts03C9T4Kt7Ry3JyUG3u_sJ5kUI8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VHSkNaWlgtMTktSlJE&google_push=AYg5qPIwiS5mv3Seac6-w_V4Mjy30OaCoHLxjn9-Ryq-c6IsgV1prdHRPF7Co7Hm6399Ur_ts03C9T4Kt7Ry3JyUG3u_sJ5kUI8
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame DD19
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YV6OKBc7oZl4R0PHHFdvlQAABHYAAAIB&google_gid=CAESEB5XYEkU_RvDMwZC8i3j1LI&google_cver=1&google_push=AYg5qPKd1n5oXbl378BN_oDp6J7qeZDQkwq7K...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame DD19 0
44 B 742ms
243ms Image
text/plain 52.68.53.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEM7zvq6m-ucmrq-OVuKjdTo&google_cver=1&google_push=AYg5qPIPOh3Nu0OPx_jgIpQ4RWroRg4jcZlwUQKJSDLivvv9sl9O3W779G9trN0aIax3x2pZ6AE2EcppTeG1bfWq3nIcs9gzwLY
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.53.67 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-53-67.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
server: awselb/2.0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DD19 0
14 B 19ms
18ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JO41RvNzkfAHcgmWhD7hErf469Ol7wAqNzKwnu6yiASMRkI3AXLHJHNZOkzGt8HW3QwbAb

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:29 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4A1B 42 B
64 B 32ms
31ms Fetch
image/gif 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv7JU53-KIY1TMgXZvXaqT76lId1NQXMUGr_mOQVzkKfUllabBDQ-lL6WKppy43PFAk9SS6eevC3kyi-ujWIexJzQVdDcHeeB84sHxrh1UpxDRN1pk&sai=AMfl-YSxayWfMSs3PYehyi8YKxAqg37toGTbuUh-pUl_lgm09kNcUkPGnT34iD2EmWSi8sCVgMQHmPVSfrCr&sig=Cg0ArKJSzGj2RFY5ooqIEAE&cid=CAASBORo13o&id=lidar2&mcvt=1006&p=0,0,90,728&mtos=324,825,1006,1076,1076&tos=324,501,181,70,0&v=20210929&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3046330951&rs=2&met=mue&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1633586728668&rpt=197

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 07 Oct 2021 06:05:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 7 KB
2 KB 8ms
7ms Stylesheet
text/css 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a2-16-186-58.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

7c1ea550f8dc01f79bd5b5bef3a239fd3106a75e7ffc913ac5e1a847b9aa52b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 18:10:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215706
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1920
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 18:10:23 GMT

GET
H2 200 sfa7jox.css
use.typekit.net/ Frame BB19 3 KB
941 B 237ms
194ms Stylesheet
text/css 2.16.186.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/sfa7jox.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

474db2da8bc8c29e602c4a979e105c9c3e3998dfa2ee414f8aa9f40c52992177

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
date: Thu, 07 Oct 2021 06:05:30 GMT
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 709

GET
H2 200 head.load.min.js Show response
cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/ Frame BB19 4 KB
2 KB 44ms
12ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a642da827ad3fb5b4bd419082f0b6da9e60654433368a9d3cb829058ba19f28

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1843190
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1704
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:30 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e76-11fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ftbdjAjXLAL8ICcNMXAjZar8l1i9D5Smyn7XeoRdFlNc4YSnLlwckmoLISA6V6qqAY%2F4L71vXQSrjPXJ5Jf3hUZV4gJyKLnqaIyxQ%2BfNnBNSkLgmkRw2PcuR1z1EAg3Ha5G8rrQp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69a4f026af2f4dca-FRA
expires: Tue, 27 Sep 2022 06:05:30 GMT

GET
H2 200 ba.js Show response
c.evidon.com/geo/ Frame 5675 41 KB
12 KB 44ms
7ms Script
application/x-javascript 104.111.244.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/geo/ba.js?r181114
Requested by: Host: c.betrad.com
URL: https://c.betrad.com/durly.js?;ad_wxh=300x250;coid=675;nid=156480;ecaid=6260004;26459188;6492655;313933996;%eexpi
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.111.244.187 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-244-187.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 72bd223dadfcc3fe7e65d1d107fe61d98649ad7cf9f220a869c2e048b0aeab1a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: gzip
last-modified: Wed, 14 Nov 2018 17:29:11 GMT
server: AkamaiNetStorage
etag: "b5d7c697ff1dc525401c112149d1a74f:1542216553"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
access-control-max-age: 108000
cache-control: max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
content-length: 12438

GET
H2 200 4.gif
c.evidon.com/a/ Frame 5675 43 B
335 B 43ms
8ms Image
image/gif 104.111.244.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.evidon.com/a/4.gif
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.111.244.187 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-244-187.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: de3a7ca2f8ae592aae2652335b755b0d0b65df663dda8776387cae7339b76d64

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: gzip
last-modified: Thu, 15 Apr 2010 17:07:29 GMT
server: AkamaiNetStorage
etag: "65786c291a4603aa5150a1884452838d:1271351254"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,OPTIONS,POST
content-type: image/gif
access-control-allow-origin
access-control-max-age: 108000
cache-control: max-age=432000
accept-ranges: bytes
access-control-allow-headers: *
content-length: 53

GET
H2 200 156480.js Show response
c.evidon.com/a/n/675/ Frame 5675 1 KB
900 B 7ms
7ms Script
application/x-javascript 104.111.244.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/a/n/675/156480.js
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/geo/ba.js?r181114
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.111.244.187 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-244-187.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c27a498ccfcb5709066b3483425bf7049bdee8afc79168063fe270d291b24b4e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: gzip
last-modified: Fri, 24 Sep 2021 17:37:19 GMT
server: AkamaiNetStorage
etag: "6888e4e1a05cb3922a99afb9f8f9cca1:1632505039.072886"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
access-control-max-age: 108000
cache-control: max-age=600
accept-ranges: bytes
access-control-allow-headers: *
content-length: 604

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ Frame 5675 43 B
301 B 87ms
87ms Image
image/gif 104.244.36.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=821867&asId=a0c5bd6f-8bb6-5399-86e9-83a45a4e3bfa&tv=%7Bc:qkQEM7,pingTime:-10,time:797,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS84OS4wLjQzODkuNzIgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1633586730151%7C%7Cd4ad9aee60dc7989f3fab3e8e5c98339%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7Cc3615724ab41b3c74b64fbf626a4619e%7C%7C9730c437b570c817533b9aa8d8517706%7C%7C532a9300586f642b6ab4515872425d77%7C%7C1ea2e52372460b8e3f8f23d63b5646e1%7C%7C03d9fcb2e0fbe33b34ac1f9d15c5194c%7C%7C1629390669%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1828578781656677&output=html&h=250&adk=287205637&adf=3380645095&pi=t.aa~a.282655012~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1633586728&rafmt=1&to=qs&pwprc=9278575066&psa=0&format=310x250&url=https%3A%2F%2Fthiennhienkythu.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633586728567&bpp=2&bdt=850&idt=2&shv=r20211004&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D15c01a7e15d9d503-2218fa7be9ca008a%3AT%3D1633586728%3ART%3D1633586728%3AS%3DALNI_MYMlZU4PnDEEWQXcQhmU5l8LRqf7Q&prev_fmts=0x0&nras=2&correlator=1069728112185&frm=20&pv=1&ga_vid=2019392783.1633586728&ga_sid=1633586728&ga_hid=1757043831&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=995&ady=1277&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062422&oid=2&pvsid=1361001907429351&pem=393&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=KC9enG6Le3&p=https%3A//thiennhienkythu.com&dtd=15
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.36.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: nyidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 07 Oct 2021 06:05:30 GMT
X-Server-Name: dt36.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 p.css
p.typekit.net/ Frame BB19 5 B
181 B 27ms
7ms Stylesheet
text/css 104.111.215.74
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=sfa7jox&ht=tk&f=31141.31144.31145.31147&a=73710875&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/sfa7jox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.215.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-74.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://use.typekit.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
last-modified: Thu, 05 Nov 2020 13:49:42 GMT
server: nginx
etag: "5fa402f6-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H3 200 sapient_main.js Show response
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 4 KB
1 KB 8ms
7ms Script
application/x-javascript 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/sapient_main.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd7a32fecdb0bc4671eb889485a8c1b99a71f0d6cb104840ba68bf2e7cea7f20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 16:34:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 221470
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1394
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 16:34:20 GMT

GET
H3 200 img_logo.svg
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 1 KB
601 B 8ms
8ms Image
image/svg+xml 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/img_logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81772a6dc0845a5249d42fc51bdb1e22d7dcee50773b789b0d3ae18df689af7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 06 Oct 2021 17:18:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46015
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 572
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 06 Oct 2022 17:18:35 GMT

GET
H2 200 l
use.typekit.net/af/630ec8/00000000000000003b9ae7f8/27/ Frame BB19 19 KB
20 KB 38ms
7ms Font
application/font-woff2 2.16.186.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/630ec8/00000000000000003b9ae7f8/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/sfa7jox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-58.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 324738d7c9a54434c1acd1010349541dd3234aa4d059190268110ce1017f5d02

Request headers

Referer: https://use.typekit.net/sfa7jox.css
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
server: nginx
etag: "db5e7f791427a2b305c5515f9678a0fdff37c0d8"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19728

GET
H3 200 sapient_util.js Show response
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 7 KB
3 KB 10ms
7ms Script
application/x-javascript 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/sapient_util.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4441f261b0f2883a8c5deb5294c15e79f3d2b9c290de00e5cd0c669e54306a4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 16:34:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 221466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2591
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 16:34:24 GMT

GET
H3 200 TweenLite.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/ Frame BB19 27 KB
10 KB 42ms
29ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/TweenLite.min.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

555e3bb894a81d951e881702b3715c04e40b327fbec9e1bfcea66f69492f1993

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2456997
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 9145
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-6d74"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6NLKTjjmeGXvRYKJGoP4C9aNaJ08t%2Ftk3xsqTrvt2K39uFpiYcZV7dC1O40c5%2FUwz7OuhvEq%2B4%2FOE3g251SpMt47oysnRgby7%2BbCf81VF%2FpxacO3KsBj97jsTuXMucyXHhZ2kHF7"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69a4f0285bfb4de8-FRA
expires: Tue, 27 Sep 2022 06:05:30 GMT

GET
H3 200 TimelineLite.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/ Frame BB19 13 KB
5 KB 36ms
23ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/TimelineLite.min.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee84db1f5f304547a1b594a3fc6caefb75a924403a9d1dc438382159be4e90a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 643036
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4378
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-3400"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X83GZBDPI3%2BbGbaeW02QGsAeCD%2FwWw0zHAY4kgiLSVlLjL2qI644UHtHckn50TsBGZvllM2IbbcvoOOWSpr%2Fn9t%2B%2Bvjn7wesF8Zu6xNnz%2BTRrT3euVzJYv63M94A5SbxB6SNuehQ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69a4f0285bfa4de8-FRA
expires: Tue, 27 Sep 2022 06:05:30 GMT

GET
H3 200 EasePack.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/easing/ Frame BB19 6 KB
3 KB 50ms
36ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/easing/EasePack.min.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a6cadfa76475c13f40dcf77cd4d97313ca8f416fde2021893fd87ee49db97a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1167532
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 1904
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-16cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s%2FhhVDRqxPP1L0LwzbVS5nUxJf8CvlIk759xF6jkENjQxk%2FpKx%2FzaZQtGeq30a%2BsybTT1kGGchlHsnmjrBxI2FYD6aO2Xy8mUq4JlUwwWBGdjrcp0J60poURKQF5TXKKiR%2BoDdrB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69a4f0285bfc4de8-FRA
expires: Tue, 27 Sep 2022 06:05:30 GMT

GET
H3 200 CSSPlugin.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/plugins/ Frame BB19 43 KB
15 KB 37ms
24ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/plugins/CSSPlugin.min.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c18e59e93eb33a02283c2c315cf4f25cb4f1cb19473a45a52f9e65c4e215796

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1161512
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 15028
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-aaa4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iikTrs3lS5UaL8kXc3E%2FXpcaDYzwChV076bkHPD7qYFn%2BNYS%2Fmk3sNz52QUe1%2Fb7A95REExfg9YdHFfpT5NuUPzNuMCKPe1GkHZO%2Fnex33xRQGo1UJUKPf8A1LouEYzugtDYygm9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69a4f0285bfd4de8-FRA
expires: Tue, 27 Sep 2022 06:05:30 GMT

GET
H3 200 CSSRulePlugin.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/plugins/ Frame BB19 2 KB
2 KB 43ms
30ms Script
application/javascript 104.16.19.94
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.1.3/plugins/CSSRulePlugin.min.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4134746487ee6ef220ac3d38bb213de9e003967065b9edc38e6d59402d1f1798

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 3573030
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 863
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-7b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EvJYb%2FIEaq4CUANnuIgbOpb9MbtEDxQqAsVo9%2F5SS1jruPwu%2BKUaPA1uyGXgF5rxCYYnDQW0XhPPZdNKK7hBe4f3q8HX%2BculUrGzn2c2H%2B%2Fx%2BuXY9KdxADNXF3KVg5QBDkmVAfoo"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 69a4f0285bfe4de8-FRA
expires: Tue, 27 Sep 2022 06:05:30 GMT

GET
H3 200 skin1.js Show response
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 6 KB
2 KB 8ms
7ms Script
application/x-javascript 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/skin1.js

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/headjs/1.0.3/head.load.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c301849be59a082a928ab1777e756a08c484e7f70c4000722dc562429f869e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 16:34:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 221460
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1786
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 16:34:30 GMT

GET
H2 200 l
use.typekit.net/af/20ad3a/00000000000000003b9ae7f7/27/ Frame BB19 19 KB
19 KB 7ms
6ms Font
application/font-woff2 2.16.186.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/20ad3a/00000000000000003b9ae7f7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/sfa7jox.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-58.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e2748b6eaeb1aa1c9c7d0ab81470b533e6c63d849f5d1571f822cda084933184

Request headers

Referer: https://use.typekit.net/sfa7jox.css
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 07 Oct 2021 06:05:30 GMT
server: nginx
etag: "2b3ed5bc45684eceddff49ec7083f42a8c89b80c"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19456

GET
H3 200 img_bg1.jpg
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 24 KB
24 KB 8ms
7ms Image
image/jpeg 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/img_bg1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebccad6c95c254234549b8cd5960a67e9947dd42dc32822eeafd37c2fbd69b22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 16:12:56 GMT
x-content-type-options: nosniff
age: 222754
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24344
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 16:12:56 GMT

GET
H3 200 img_card.png
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 17 KB
17 KB 8ms
8ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/img_card.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e11c95df1842787d45061b351028a007632ed1ca3985d6c5f08c8ee82b25b9dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 16:12:56 GMT
x-content-type-options: nosniff
age: 222754
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17573
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 16:12:56 GMT

GET
H3 200 img_replay.png
s0.2mdn.net/sadbundle/10667973811766473475/ Frame BB19 247 B
275 B 8ms
7ms Image
image/png 142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10667973811766473475/img_replay.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b970ee0cadcb8d9254f015a645946fd28ac57b4ecbaf751b89bd0ab5899ad114

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10667973811766473475/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 04 Oct 2021 16:12:56 GMT
x-content-type-options: nosniff
age: 222754
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 16:09:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 04 Oct 2022 16:12:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5675 0
23 B 31ms
31ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssI43dA9VpNJpFhsazQ24NxZ8BNztgiw3TDq7xum1EtuuDJkYBDtARVzTj6HfWMXcdYqIucaw2cIQPsy0UW1QnQNzj86hFbxcZ-gWWvhebkiV0Li6b9iR8jdaeFqjjey9K-ZDIJ1VYg7j14ZN1Ak9GkPZYzZTGLJTRe9ER_jKGoUdbGyr8ICAOeAfwuoWjaiSLuxQ&sai=AMfl-YRFPJZU45eNMrN0TUaCjqnozHTqCTTryZ3iAQNIsFsVkZwvnff9P-m7LS3qo7wc5X7A3-dsDvtpdxbVwiNUhfM8MQlvDLBe6OCjiuQPuVNvz0Z1gk8YUDvej62y&sig=Cg0ArKJSzDgsYvuBwWvZEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=468&vt=11&dtpt=413&dett=3&cstd=53&cisv=r20211005.98752&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: thiennhienkythu.com
URL: https://thiennhienkythu.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS