Submitted URL: http://ncmhcso.org/
Effective URL: https://ncmhcso.org/
Submission: On June 18 via manual from JP

Summary

This website contacted 43 IPs in 8 countries across 55 domains to perform 427 HTTP transactions. The main IP is 2606:4700:3030::ac43:d657, located in United States and belongs to CLOUDFLARENET, US. The main domain is ncmhcso.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 21st 2020. Valid for: a year.
This is the only time ncmhcso.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 81 2606:4700:303... 13335 (CLOUDFLAR...)
1 143.198.248.63 14061 (DIGITALOC...)
1 2600:9000:211... 16509 (AMAZON-02)
2 2600:9000:21f... 16509 (AMAZON-02)
1 205.185.216.42 20446 (HIGHWINDS3)
3 2606:4700::68... 13335 (CLOUDFLAR...)
28 2a00:1450:400... 15169 (GOOGLE)
10 2a00:1450:400... 15169 (GOOGLE)
3 151.101.65.195 54113 (FASTLY)
6 30 2a02:6b8::1:119 13238 (YANDEX)
13 2a00:1450:400... 15169 (GOOGLE)
1 213.174.135.24 39572 (ADVANCEDH...)
2 2a00:1450:400... 15169 (GOOGLE)
1 18.196.233.38 16509 (AMAZON-02)
35 142.250.185.66 15169 (GOOGLE)
1 198.54.121.248 22612 (NAMECHEAP...)
1 213.174.135.25 39572 (ADVANCEDH...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 61 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
20 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
11 2a00:1450:400... 15169 (GOOGLE)
10 151.101.1.195 54113 (FASTLY)
1 144.76.128.227 24940 (HETZNER-AS)
1 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
2 4 2001:678:cb4:... 56396 (TURN)
4 57 216.58.212.130 15169 (GOOGLE)
1 2 2620:116:800d... 16509 (AMAZON-02)
1 1 185.29.133.52 30419 (MEDIAMATH...)
3 34.96.105.8 15169 (GOOGLE)
3 3 213.155.156.181 1299 (TELIANET ...)
3 3 37.157.2.236 198622 (ADFORM)
5 2a00:1450:400... 15169 (GOOGLE)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2 151.101.114.49 54113 (FASTLY)
2 2 35.186.193.173 15169 (GOOGLE)
5 5 72.251.244.141 29791 (VOXEL-DOT...)
2 2 185.64.190.78 62713 (AS-PUBMATIC)
3 3 99.86.242.34 16509 (AMAZON-02)
15 2a00:1450:400... 15169 (GOOGLE)
1 2a02:fa8:8806... 41041 (VCLK-EU-SE)
2 2 85.114.159.118 24961 (MYLOC-AS ...)
4 4 2a00:1288:110... 34010 (YAHOO-IRD)
4 4 35.227.252.103 15169 (GOOGLE)
4 4 213.19.147.44 26120 (RHYTHMONE)
3 76.223.111.131 16509 (AMAZON-02)
4 4 66.155.71.150 13768 (COGECO-PEER1)
1 1 35.190.0.66 15169 (GOOGLE)
4 4 52.58.194.104 16509 (AMAZON-02)
1 1 185.86.138.120 201081 (SMARTADSE...)
1 1 169.50.137.190 36351 (SOFTLAYER)
4 4 3.64.28.223 16509 (AMAZON-02)
2 2 18.194.4.26 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 64.4.253.237 11643 (EBAY)
1 104.75.89.51 16625 (AKAMAI-AS)
2 2 69.173.144.138 26667 (RUBICONPR...)
1 3.230.12.180 14618 (AMAZON-AES)
1 1 3.126.56.137 16509 (AMAZON-02)
427 43
Apex Domain
Subdomains
Transfer
105 doubleclick.net
googleads.g.doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
471 KB
89 googlesyndication.com
pagead2.googlesyndication.com
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
tpc.googlesyndication.com
629 KB
81 ncmhcso.org
ncmhcso.org
2 MB
32 gstatic.com
fonts.gstatic.com
www.gstatic.com
encrypted-tbn0.gstatic.com
encrypted-tbn3.gstatic.com
encrypted-tbn1.gstatic.com
642 KB
25 yandex.ru
mc.yandex.ru
72 KB
23 googletagservices.com
www.googletagservices.com
831 KB
14 google.com
adservice.google.com
www.google.com
959 B
10 jampartizan.com
bk.jampartizan.com
12 KB
10 googleapis.com
fonts.googleapis.com
7 KB
5 yahoo.com
pr-bh.ybp.yahoo.com
ups.analytics.yahoo.com
3 KB
5 m6r.eu
tracking.m6r.eu
3 KB
5 2mdn.net
s0.2mdn.net
665 B
5 yandex.com
mc.yandex.com
2 KB
4 bidswitch.net
x.bidswitch.net
2 KB
4 3lift.com
eb2.3lift.com
2 KB
4 sitescout.com
pixel-sync.sitescout.com
2 KB
4 openx.net
rtb.openx.net
1 KB
4 turn.com
ad.turn.com
r.turn.com
2 KB
3 adsrvr.org
match.adsrvr.org
793 B
3 smaato.net
s.ad.smaato.net
1 KB
3 adform.net
c1.adform.net
2 KB
3 de17a.com
d5p.de17a.com
1 KB
3 blismedia.com
tr.blismedia.com
363 B
3 zx-adnet.com
cdn.zx-adnet.com
20 KB
3 jsdelivr.net
cdn.jsdelivr.net
10 KB
3 optad360.io
cmp.optad360.io
get.optad360.io
451 KB
2 rubiconproject.com
pixel.rubiconproject.com
926 B
2 sportradarserving.com
a.sportradarserving.com
1 KB
2 unrulymedia.com
sync.targeting.unrulymedia.com
1 KB
2 1rx.io
sync.1rx.io
1 KB
2 adition.com
dsp.adfarm1.adition.com
1 KB
2 pubmatic.com
image6.pubmatic.com
1 KB
2 ctnsnet.com
gcm.ctnsnet.com
880 B
2 everesttech.net
sync-tm.everesttech.net
833 B
2 tribalfusion.com
a.tribalfusion.com
s.tribalfusion.com
1 KB
2 quantserve.com
cms.quantserve.com
798 B
2 google.de
adservice.google.de
330 B
1 advertising.com
sync.adaptv.advertising.com
14 B
1 ebaystatic.com
secureir.ebaystatic.com
549 B
1 ebayadservices.com
www.ebayadservices.com
558 B
1 simpli.fi
um.simpli.fi
711 B
1 smartadserver.com
ssbsync.smartadserver.com
459 B
1 travelaudience.com
ads.travelaudience.com
612 B
1 dotomi.com
dclk-match.dotomi.com
104 B
1 mathtag.com
sync.mathtag.com
816 B
1 stat-rock.com
serving.stat-rock.com
95 KB
1 wpushsdk.com
js.wpushsdk.com
3 KB
1 allthebestsofts.com
allthebestsofts.com
53 KB
1 consensu.org
stat.optad360.mgr.consensu.org
286 B
1 nawpush.com
na.nawpush.com
363 B
1 cstwpush.com
cst.cstwpush.com
60 KB
1 ro3.biz
ro3.biz
20 KB
0 impdesk.com Failed
pix.impdesk.com Failed
0 wbtrk.net Failed
um.wbtrk.net Failed
0 netmng.com Failed
google2waycm.netmng.com Failed
427 55
Domain Requested by
81 ncmhcso.org 1 redirects ncmhcso.org
59 tpc.googlesyndication.com 1 redirects ncmhcso.org
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
tpc.googlesyndication.com
googleads.g.doubleclick.net
securepubads.g.doubleclick.net
57 cm.g.doubleclick.net 4 redirects ncmhcso.org
googleads.g.doubleclick.net
35 securepubads.g.doubleclick.net get.optad360.io
securepubads.g.doubleclick.net
ncmhcso.org
cdn.zx-adnet.com
www.googletagservices.com
28 pagead2.googlesyndication.com ncmhcso.org
www.googletagservices.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
securepubads.g.doubleclick.net
25 mc.yandex.ru 4 redirects ncmhcso.org
23 www.googletagservices.com securepubads.g.doubleclick.net
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
cdn.zx-adnet.com
googleads.g.doubleclick.net
20 fonts.gstatic.com fonts.googleapis.com
13 googleads.g.doubleclick.net pagead2.googlesyndication.com
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
bk.jampartizan.com
12 www.google.com 1 redirects 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
10 bk.jampartizan.com ncmhcso.org
10 fonts.googleapis.com ncmhcso.org
googleads.g.doubleclick.net
9 www.gstatic.com googleads.g.doubleclick.net
5 tracking.m6r.eu 5 redirects
5 s0.2mdn.net googleads.g.doubleclick.net
5 mc.yandex.com 2 redirects ncmhcso.org
4 x.bidswitch.net 4 redirects
4 eb2.3lift.com 4 redirects
4 pixel-sync.sitescout.com 4 redirects
4 rtb.openx.net 4 redirects
4 pr-bh.ybp.yahoo.com 4 redirects
3 match.adsrvr.org googleads.g.doubleclick.net
3 s.ad.smaato.net 3 redirects
3 c1.adform.net 3 redirects
3 d5p.de17a.com 3 redirects
3 tr.blismedia.com googleads.g.doubleclick.net
3 cdn.zx-adnet.com ncmhcso.org
cdn.zx-adnet.com
3 cdn.jsdelivr.net ncmhcso.org
get.optad360.io
2 pixel.rubiconproject.com 2 redirects
2 a.sportradarserving.com 2 redirects
2 sync.targeting.unrulymedia.com 2 redirects
2 sync.1rx.io 2 redirects
2 dsp.adfarm1.adition.com 2 redirects
2 image6.pubmatic.com 2 redirects
2 gcm.ctnsnet.com 2 redirects
2 sync-tm.everesttech.net 2 redirects
2 cms.quantserve.com 1 redirects googleads.g.doubleclick.net
2 r.turn.com ncmhcso.org
2 ad.turn.com 2 redirects
2 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com securepubads.g.doubleclick.net
2 adservice.google.com securepubads.g.doubleclick.net
2 adservice.google.de securepubads.g.doubleclick.net
2 get.optad360.io ncmhcso.org
get.optad360.io
1 ups.analytics.yahoo.com 1 redirects
1 sync.adaptv.advertising.com googleads.g.doubleclick.net
1 secureir.ebaystatic.com googleads.g.doubleclick.net
1 www.ebayadservices.com 1 redirects
1 encrypted-tbn1.gstatic.com googleads.g.doubleclick.net
1 encrypted-tbn3.gstatic.com googleads.g.doubleclick.net
1 encrypted-tbn0.gstatic.com googleads.g.doubleclick.net
1 um.simpli.fi 1 redirects
1 ssbsync.smartadserver.com 1 redirects
1 ads.travelaudience.com 1 redirects
1 dclk-match.dotomi.com googleads.g.doubleclick.net
1 s.tribalfusion.com ncmhcso.org
1 a.tribalfusion.com 1 redirects
1 sync.mathtag.com 1 redirects
1 serving.stat-rock.com get.optad360.io
1 js.wpushsdk.com cst.cstwpush.com
1 allthebestsofts.com ncmhcso.org
1 stat.optad360.mgr.consensu.org get.optad360.io
1 na.nawpush.com cst.cstwpush.com
1 cst.cstwpush.com ncmhcso.org
1 cmp.optad360.io ncmhcso.org
1 ro3.biz ncmhcso.org
0 pix.impdesk.com Failed googleads.g.doubleclick.net
0 um.wbtrk.net Failed googleads.g.doubleclick.net
0 google2waycm.netmng.com Failed googleads.g.doubleclick.net
427 68

This site contains links to these domains. Also see Links.

Domain
www.cookiesandyou.com
az.ncmhcso.org
be.ncmhcso.org
bn.ncmhcso.org
ca.ncmhcso.org
cs.ncmhcso.org
da.ncmhcso.org
el.ncmhcso.org
es.ncmhcso.org
et.ncmhcso.org
ga.ncmhcso.org
fa.ncmhcso.org
fi.ncmhcso.org
fr.ncmhcso.org
hi.ncmhcso.org
hr.ncmhcso.org
hu.ncmhcso.org
hy.ncmhcso.org
id.ncmhcso.org
is.ncmhcso.org
it.ncmhcso.org
iw.ncmhcso.org
ja.ncmhcso.org
ka.ncmhcso.org
ko.ncmhcso.org
kk.ncmhcso.org
ky.ncmhcso.org
lb.ncmhcso.org
lo.ncmhcso.org
lt.ncmhcso.org
lv.ncmhcso.org
ms.ncmhcso.org
mr.ncmhcso.org
nl.ncmhcso.org
no.ncmhcso.org
pl.ncmhcso.org
pt.ncmhcso.org
ro.ncmhcso.org
ru.ncmhcso.org
sk.ncmhcso.org
sl.ncmhcso.org
sq.ncmhcso.org
sr.ncmhcso.org
sv.ncmhcso.org
te.ncmhcso.org
tg.ncmhcso.org
th.ncmhcso.org
tl.ncmhcso.org
tr.ncmhcso.org
uk.ncmhcso.org
ur.ncmhcso.org
uz.ncmhcso.org
vi.ncmhcso.org
zh.ncmhcso.org
af.ncmhcso.org
am.ncmhcso.org
bs.ncmhcso.org
ceb.ncmhcso.org
co.ncmhcso.org
cy.ncmhcso.org
eo.ncmhcso.org
eu.ncmhcso.org
fy.ncmhcso.org
gd.ncmhcso.org
gl.ncmhcso.org
gu.ncmhcso.org
ha.ncmhcso.org
haw.ncmhcso.org
hmn.ncmhcso.org
ht.ncmhcso.org
ig.ncmhcso.org
jw.ncmhcso.org
km.ncmhcso.org
kn.ncmhcso.org
ku.ncmhcso.org
la.ncmhcso.org
mg.ncmhcso.org
mi.ncmhcso.org
mk.ncmhcso.org
ml.ncmhcso.org
mn.ncmhcso.org
mt.ncmhcso.org
my.ncmhcso.org
ne.ncmhcso.org
ny.ncmhcso.org
pa.ncmhcso.org
ps.ncmhcso.org
sd.ncmhcso.org
si.ncmhcso.org
sm.ncmhcso.org
sn.ncmhcso.org
so.ncmhcso.org
st.ncmhcso.org
su.ncmhcso.org
sw.ncmhcso.org
xh.ncmhcso.org
yi.ncmhcso.org
yo.ncmhcso.org
zu.ncmhcso.org
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-21 -
2021-10-20
a year crt.sh
ro1.biz
R3
2021-05-11 -
2021-08-09
3 months crt.sh
*.optad360.io
Amazon
2020-12-17 -
2022-01-15
a year crt.sh
cstwpush.com
R3
2021-05-22 -
2021-08-20
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
upload.video.google.com
GTS CA 1O1
2021-05-17 -
2021-08-09
3 months crt.sh
covid19-dashboard.ivod.at
GTS CA 1D4
2021-05-17 -
2021-08-15
3 months crt.sh
mc.yandex.ru
Yandex CA
2021-02-27 -
2021-08-09
5 months crt.sh
*.gstatic.com
GTS CA 1C3
2021-05-24 -
2021-08-16
3 months crt.sh
na.nawpush.com
R3
2021-04-20 -
2021-07-19
3 months crt.sh
stat.optad360.mgr.consensu.org
R3
2021-05-24 -
2021-08-22
3 months crt.sh
allthebestsofts.com
Sectigo RSA Domain Validation Secure Server CA
2020-12-02 -
2022-01-02
a year crt.sh
js.wpushsdk.com
R3
2021-05-07 -
2021-08-05
3 months crt.sh
*.google.de
GTS CA 1C3
2021-05-24 -
2021-08-16
3 months crt.sh
*.google.com
GTS CA 1C3
2021-05-24 -
2021-08-16
3 months crt.sh
www.google.com
GTS CA 1C3
2021-05-24 -
2021-08-16
3 months crt.sh
app.shoplister.club
GTS CA 1D2
2021-04-20 -
2021-07-19
3 months crt.sh
serving.stat-rock.com
R3
2021-04-18 -
2021-07-17
3 months crt.sh
*.turn.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2021-03-31 -
2022-03-31
a year crt.sh
*.quantserve.com
DigiCert SHA2 High Assurance Server CA
2020-10-02 -
2021-10-07
a year crt.sh
tr.blismedia.com
GTS CA 1D4
2021-05-01 -
2021-07-30
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-05-17 -
2021-08-09
3 months crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018
2019-06-19 -
2021-08-31
2 years crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2021-03-18 -
2022-04-19
a year crt.sh
www.ebay.com
DigiCert TLS RSA SHA256 2020 CA1
2021-04-22 -
2022-04-27
a year crt.sh
*.v.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2021-05-24 -
2021-11-17
6 months crt.sh

This page contains 45 frames:

Primary Page: https://ncmhcso.org/
Frame ID: 8B2325C7A183D768967D75FEE8B19E7F
Requests: 150 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210616/r20190131/zrt_lookup.html
Frame ID: 33D159DB5758438991327D3BD1F1BEEC
Requests: 1 HTTP requests in this frame

Frame: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E76C21F618241EA6AFC29522CC0A060A
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Frame ID: 855BAF205990CC9367D6023E738BF4A6
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: D35F1282E27CF71D53D44CE8FDED242F
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpw0z-4I09KZh89J9OaE3xeMH-jUVSfA9Xv1QB_WUp9doSYFPD6YcLuSvU_Z1pD6r0_No98zX2iBjU0Fs8ZlTziVYUx28LqExAQ9pq2aRBBq9wErhymVsD3AkXRPoRhqzLeXQpTISuXFGh_bkrqHpn-vapBLuNyPIgqYJ-tYqpoNpmMhG0EtjSeuNQXWbh6JqRSNqHtaagaeStsxcIEcgs73m3PEhYUSfHazSS52hqAlCDqDqb8RuHJtY1yMsCc55dyudt7We1bhuxegTXkT81tfY&sai=AMfl-YSaCAZ1hXeqHvCMEbZXhe-UjGku2Jjts2hKovnYggb6aGi1IY6T-HU-l-ZrKh0ODZ7bA9FiUj10D36QupTRfzET-TdS84tuiHXk-eZ2fXGIQCx6CDTGT0s01oHbIPm2&sig=Cg0ArKJSzKURXOSdKGHtEAE&urlfix=1&adurl=
Frame ID: 2C79047828CEF148FDA7780D226B8838
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGprM0w5g8Bm2IiOYVv_-q85YuXfuR0wcYwP0bR-uDio9W_NlAKV1zp-4DSjE35zVknPR-Bynyud5il2fWwCLvmYm7aLhsxFPnlkR-KzEK8AxzpTWyE3_IAvwQKnzMBvuCeGwV8qySJ-eR4B2vQ3R90dj6TRoKdPWn86WQhqvmSuf5HGkF1bZYsAK8I6OWb0N6PK54kH1OKV-FEhu1nlX5pX97oCHCLvExHls_EO6SDwuSJM7GaYcGcdjT-n3vEzWJaYYTYC_WPSMJn4mPFo0YiSM&sai=AMfl-YRoG9DjC0IKd3DVmFBvZDdGM_Rs3jI6VC4pGWhS6duqMZyYVKuwHh_AXLcJk6BXhLZgea5C9n32SR6h04H4MIP_SwJhX6cIPysd0h3A1DcPlqlAw9ZTsnPPUc0AefOh&sig=Cg0ArKJSzMDcNR6V3hduEAE&urlfix=1&adurl=
Frame ID: 874CFC9CC19A79C04E88174FF31A6ABC
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstzv1a0rBwFbmPXgEYRTvoLrqabYCBxPrh3OtV_AjZDHfY_iTuYKk26RcPuybCCKInq053YweAFFfNupL0LPoN5zo72QvotcYf1Nk2INvhBbSG2owco9dgpnAvjXz9WDCPgegSM3HvpTRU9ppi1-2ChP2nG8R1xByW-aFZDk8vpzMYwqhvq2GDAqBIsHh1CptyG9rDFrIRHjRR-8RcLjdr_1HtYDvFFZlguSodkr6s2qdjWWI54lIkaXBfNNld-zDDN-Sz-U8o9fQlZf7VXchNzIhM&sai=AMfl-YQb8OhNIwlKTfltWwLVLZrRCejJCJ4FNiTP6oNhQQUUnKXW8KciH8d2apaCl1MRhRaljykF1BoSUrOWxIYOeaGSU4h7UKJSPQMzHfJKf6kY_5AUlrVu2upyDweAUJH9&sig=Cg0ArKJSzPUQxJU4Fet0EAE&urlfix=1&adurl=
Frame ID: 0AC10C19E8DF2F1D38DECD087A1082E8
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstxvKtwIwd2ECvex_TClBSs_O2S4GjBW6Hz7zLGyq4qs5wYNS7WVtG42ZUWlAVOQZ27ChpzYkREKbkcHnxgwc2SZcB_Q6DAaRXMCyt59YtnRpCEQUBycnITnIkHaNxm-P3cDn_6Sr33axMF4aKjlTuX3mVPu6XMK9g9vjgkwbUK_KTV0Xml9uhq1bsJ5aVUyTU1J420ABtMSX9xdfDyUFSxESI6UGF8kXW-JOgu_Sg8_22zqZm_TQFPajNCUDG4OikWkN27V5ZNN-CIMI9hCiMqKyw&sai=AMfl-YR1UktU8oIYmaxLOyZ6TyTf5mjo5MgNuROZMJb37EW7bhgcDtiha-8yWZTr3ONGRCMSiy0RedoElzSXpTtUJP-2Lm_mTlVzowWb7mvbaex-4Q5B6JITwUXcsf_ar27e&sig=Cg0ArKJSzPbQCxHHXuqXEAE&urlfix=1&adurl=
Frame ID: 5D4656B3889FF6C9DBDD14E2412D44C6
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstrrI_DcOl19WDmz4MlXrJaq60nvHwn-VMdV1_jhqvxylTQ-0-WtnZDqanqBPGck_VgHo4x2giSBW2u_AG5CzdNWtEIcxGRW6gJiwI7XmtuTH0EJu5ZminGI8IXvERWQ6vXc6ZrQtWumb6tEwnMLbOMrDzy6bKfxWOwmchapflCVN2SoC6viJXNAKv_DYmb6opa1g_nxo5N2rIZyKyOUHe6-8-S3dv1GkMFQnK6VhNKbjQVADMCjPivI6hihmEl1sTLpcKaZ2B1zYX2cZk3k3gQpyOgOgiy5Q&sai=AMfl-YSehfeqFOa219k3P1w6P13bsmJyXsb26gqrk1K4GFKynikiCVaGyjGQ8yJbtOoOLOgz2SEI4zQSfVXaiVxtExfMk2iWXv-2kvNyX3INAkNVynmZIbvH4EoDj-Vh3xDu&sig=Cg0ArKJSzBilgILuMw33EAE&urlfix=1&adurl=
Frame ID: 0BBAD2068391FFF7D4D656E988686E0A
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvrCQLGFyMmtR2OPFcyldFRULNP7Htp0msS0IeUpoMXHy3TNEwhAxXqtKxw6AIxue_NZ_Xv1bVkTaUh0ka8OmqfEZAOt-FCjDUjnke5NGhVMf5twRkUAOK0oNb5psoxvIabz_xJgtcgz-P7FIh8G5mB4QG8PZpMZOgnOnO9NGMa5_N9mDs9T_yF-zAyHaB7nQ-ryHSxEfgO8DAiiD5TR2BZ3R2SI1nT2rHt63CksSfRO7jtOpXXzEcapN4VsubzjYrMU4rE2v-WapSFqzGcQZhX8hw&sai=AMfl-YRF2V5dKVb88ouOz6-Z7LxCXt53jRbB5cmBkX-ZhQ7BD0rIHVj5BEDee6buP1J9Q30z0-ypRmeFRnqHIP6XxPuUWsVTbuWbKWJg5Utv3MWX0GWpO-f0RhLz_yHgx3fH&sig=Cg0ArKJSzI21_GDo4WfQEAE&urlfix=1&adurl=
Frame ID: 9B9C4C5453E902B13B603C3C5F72AC8C
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPH3sbH6D3uKTFCV70ahFnA6edUJuHV7FLxij6TkKtzCLU8Bf4Jx_jZImnZnFPT4Jk8ZUqwmcAaQ51NUr-d6VVw-cNjBBR2gNpZD_ya9pVawrn0pfRdVkV9yTkzrkAVDw5md4k7l2NAWQosOqXYr5_PBQXJ0o8qvr8TyHuG91S_uDPZ5c7BarkY-jDFZ8HniVf0R32BxMiPLEvc7LRZ5uW3i4ZK8rcbjLLrVfSo6cjArm2t2-cBl-QzwVLIcDkoZZajetg7S-_kE2vXLTX79lYb79rvgNfvQ&sai=AMfl-YSGIg2snXS9Gi8qrkd5IEURQKtwy-ZYLPHh-V_QoJWgQItEels5kZgbwhuApOBBMIM_mm7KcdFt_Yq5sCg7zmD7IEPO9aTJqOwss7gjBXY8Dx1uKAn4gOLkty7sPIgj&sig=Cg0ArKJSzHHz7knBMax9EAE&urlfix=1&adurl=
Frame ID: 2E4A235FDCFD21F10DBED6915BB27786
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVQiCa0pwzXz1SidhK1nTwdp8OgiyCjpuETPXgiCiKVMRUf-H-4q9hkoV_ymKkTK5j2UnGxTkUtuGhkDL9D1U-Rr20PrTUEU--5CGY_10YX3VKca_Kq2WMhOxLskrB_rmGEF4Qjcj0OxBfJCFvwPxi6hjl1UawfW9jqmoLxc9u4f3FQYOQgBnKkToOa74wCgUyZXRIOAHLs_BOrXu5ehqAMW3JxXMGlI-QMw816PQ8zeFsFiXt5IoTNHksgakEAIzr1dBDEX5pjDnoBPVoDLyNg24&sai=AMfl-YTsZeMlFNnkGte_jZ8ypzEqi5wFXHXikzsKsh2bvKa9s-yrEpJ5zfRs4bDGeOKGWCsjFMAzXqTKIdgzmXVT5IuV3uyqI-B-Y5hA_Alok5LCJMPamo3S7zzq35IRJoI&sig=Cg0ArKJSzMiTt11-GtFIEAE&urlfix=1&adurl=
Frame ID: 570DFC5313869BAC3120849690DCD599
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvK2sx6Cx3mZm_d_6bTj-mDKPskD2m18WTWqjBMlKKOCCsw_mRkLSg0rn5UP4BGRa8TuQW-fu3UqVpkisN0DcF3J4XGIKMCutKtRfbFiuC_pRYgffBz3kEa8RiYr_bpIa7AtjJau2PTPPekBftdmmTskedwvq7YtZZvSNbPE5437du6Koi6pXuNzmTNfguctCFku8x2fVPRobl0zH0Wav4MOtgFvSQKacrgzyyCVkh_e8YG4gRFjDPM2BtbhLX0o35S1hYCf1JixYXZaviCRVNnRcuT6SB6iw&sai=AMfl-YTLGvPh09l5TEJqyPRE2Vwp5y6iifZAluKradV-pxM3wdcl_jFxAZCHk7-Uz1EJG29TN9NwXHaNMbzUfyo4SfqHlVDqn1VGwfSE23KMHxvm_4eYybJHlHfALIDMfJo&sig=Cg0ArKJSzGWFSTM66ia5EAE&urlfix=1&adurl=
Frame ID: D60E7FFD484FBA49EF0743F900995BAD
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskamVtwxS0PST3RLSqDV8YQHR4yBKsgKFudBbNLpGnZECp4WOAkNE8MbehqJbqEKi-h9IJmMj002Lfem13UYxmWxB7bvptcjwhzFfky_mT8A5Oki4DeKd1Ic8hw38XEclHYyKXIGaRxlvs1ZCWsoLQEumDI0S8nlDZ8ujH3Xyh_B9b6Z0wrGubqnvB6UpHiNVue2secM7X32i0UnpW8tLCJjzsLxn5Br9MaDHRQdGJpoT7ti86_Yk56J5czbaz9kYKJXiMIPVzq6_MIHJ1IelIIM8&sai=AMfl-YQ9csnXFgvaDZ80aEtA3GJg9gkjIz12xngtPBloVP4iZkirAST0wBUdb0ZGjHyWMvoon9PXY2WoOJsa6zUaAyY0PlGXFP34Y-iWU5l7IL7x5u6HxMuPvFIeK06zSXw9&sig=Cg0ArKJSzPnLW5d5eYqYEAE&urlfix=1&adurl=
Frame ID: 0685A8DD58969631AA64429BF3E8DC4C
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Frame ID: 4FB409451970555FD307BDCC65162470
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Frame ID: 63E0FD3B3E5D5F458BEC1A24669695BC
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Frame ID: 0B578D6014267FB65B7A1BC10DE1FAD4
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Frame ID: CF5814F3BEAD12864D11A786106ECE84
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Frame ID: 786C2D1B81016E17D5A980CD5ECC1992
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Frame ID: D58DDC8DDF1794ED66381D731610E7C1
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Frame ID: 6A454A803FB1BB0B7063777497EF6273
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Frame ID: 276BE50D72E95F93BFC98B37EFE338C6
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Frame ID: 215652B08857E80F1A6BAA9541C7CBC0
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Frame ID: 0058922BCF961B72F19A55C8A12F8C79
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B26281D310B4C8344F5A57033A20E49C
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 7665D90B8400785F5AD2209EFEE14569
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: 183DE4D8F8BD407871A451FB460765A5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 832C32C2D4A515FBC8DBE95F1BA3DD96
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2F02608D45B145F93D42C24EA65A4A88
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 32516878D7BA3EF9ADF0B83A8EC4204C
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: 7D8D7EF18296C4EF6720493E694DC89E
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 49B36A703132755140DB750050F7787A
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: 6973D03B7F5ACD4D6FD6F017F6C55F4C
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: C3000A61DC91E9CC8A060CC53C5A0C11
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E23D45E8DE798206DBB4B1A22BBDCBE2
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: A9C3A693DB3B50D5BC4AD56D273ED2EE
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6AD9FDA18B9DC4719801EE27B8E4A3E6
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: D1975DA88D15753D3937B9C28FDADDCF
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: ACA6D405B57F8981B437E6212297D8BF
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: D10EE9341D246BAC8C9C5EAAC51E886A
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: 4AA10902448D68FBF0FAB4F775C52780
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Frame ID: 2610361D48EB317955F745AF3B455981
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Frame ID: 1FE89863B373D7C477E5EE347CF6CD6C
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 212DD0B9AC50C08926B545678BB66597
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://ncmhcso.org/ HTTP 301
    https://ncmhcso.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i

Page Statistics

427
Requests

98 %
HTTPS

44 %
IPv6

55
Domains

68
Subdomains

43
IPs

8
Countries

5018 kB
Transfer

9875 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ncmhcso.org/ HTTP 301
    https://ncmhcso.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 99
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9308._pRA-Qp5HRl8X6t2YAbro8s0pPK_Zwh9U1uH4qRcf_5yQZn2TzyGC_NcOAEcm_cK.KFWP3_sA9zgkTzGrZQpBFm3gCPw%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9308.dqeMWlL31peyaI6qcauzu6-RqtcGGjxmvNJ7-dTfhWzGNiLrDJpaZqiPsSUhD7H4UAjX1HpOv1lIRrZD6AldRQ%2C%2C.T9k0IHmZxqZvq0aUGGaW15TikzA%2C
Request Chain 108
  • https://mc.yandex.com/watch/68669068?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A265%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A1122216682099%3Ahid%3A608800334%3Az%3A120%3Ai%3A20210618084632%3Aet%3A1623998793%3Ac%3A1%3Arn%3A467724967%3Au%3A1623998793655043633%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1623998792298%3Ads%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1623998793%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso HTTP 302
  • https://mc.yandex.com/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A265%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A1122216682099%3Ahid%3A608800334%3Az%3A120%3Ai%3A20210618084632%3Aet%3A1623998793%3Ac%3A1%3Arn%3A467724967%3Au%3A1623998793655043633%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1623998792298%3Ads%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1623998793%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso
Request Chain 128
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 133
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.1247365385282313 HTTP 302
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.1247365385282313
Request Chain 135
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.12186898214948472 HTTP 302
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.12186898214948472
Request Chain 137
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.5326471905817924 HTTP 302
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.5326471905817924
Request Chain 236
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHAfvJOm_RBiTq569KLQlcI&google_cver=1&google_push=AYg5qPJNQdU6hiy5RznQWgkUafO0jF6oBcDpqyLJC15AZsbhq63AJYHOfPD8ZV43sQDwds_typM--eCB_jDAC83MHd8TiqXDgUQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjc4NDIxNDA5MzI5MDU2MTg0Ng== HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm=&google_sc=&google_hm=Mjc4NDIxNDA5MzI5MDU2MTg0Ng==&google_tc= HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
Request Chain 238
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEDuWImcPXDEjG7XNlObjivU&google_cver=1&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY&google_tc=
Request Chain 240
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEDOajEUU8ETD67QqOB8O4q4&google_cver=1&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_qorRk HTTP 302
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEDOajEUU8ETD67QqOB8O4q4&google_cver=1&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_qorRk HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_qorRk
Request Chain 241
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBDMoYTEQYLlcVCCJJVCbD8&google_cver=1&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRoOM-V1b30Tt0f-A9ElPHQ HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEBDMoYTEQYLlcVCCJJVCbD8&google_cver=1&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRoOM-V1b30Tt0f-A9ElPHQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRoOM-V1b30Tt0f-A9ElPHQ
Request Chain 247
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEDsQQvewgT5SajDHyrDwpFE&google_cver=1&google_push=AYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDsQQvewgT5SajDHyrDwpFE&google_cver=1&google_push=AYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Request Chain 248
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_cver=1&google_push=AYg5qPKfg_aIT8dPx3OGR3_vrgCK4iQoobNdOk3KXIZHZI7Du1hCfi9et_PAOqY_aNA5mwXSqN37kzbUKHpbbRzmDqz0s1yD1Dg3 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_push=AYg5qPKfg_aIT8dPx3OGR3_vrgCK4iQoobNdOk3KXIZHZI7Du1hCfi9et_PAOqY_aNA5mwXSqN37kzbUKHpbbRzmDqz0s1yD1Dg3
Request Chain 249
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHc3PwHYk_qgs097nsbhhso&google_cver=1&google_push=AYg5qPKGvOobMfGem_sgael6h5tuVw_c8HAPypxvG0peprRYZGRBfIfuyrL7blPRX7kSS737ZW8zKgvAr7Veu2_lClMlSbGNoAlk HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPKGvOobMfGem_sgael6h5tuVw_c8HAPypxvG0peprRYZGRBfIfuyrL7blPRX7kSS737ZW8zKgvAr7Veu2_lClMlSbGNoAlk&google_hm=rSH-4C1iSX2uF-QuSC74M-8
Request Chain 250
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ9IIcoa4GrwUaBxgaNMsaHuGbPE8ckET3_RUvD92 HTTP 302
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ9IIcoa4GrwUaBxgaNMsaHuGbPE8ckET3_RUvD92&checkcookies=true HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ9IIcoa4GrwUaBxgaNMsaHuGbPE8ckET3_RUvD92
Request Chain 251
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEMF-veGaFPhNEvs2wx9kGIk&google_cver=1&google_push=AYg5qPLJVvvt9eGsBuPiA8LdSLWXBT6k5aXeOEU6ixYVGHqHmFAnVaupyvQhXf8IRZ5mSI-Y4YBB0z8GBNVthZ9QP4Y2gGY_Fw HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEMF-veGaFPhNEvs2wx9kGIk&google_cver=1&google_push=AYg5qPLJVvvt9eGsBuPiA8LdSLWXBT6k5aXeOEU6ixYVGHqHmFAnVaupyvQhXf8IRZ5mSI-Y4YBB0z8GBNVthZ9QP4Y2gGY_Fw&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=j30vgfmlTD6bpHrbp2Atzw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLJVvvt9eGsBuPiA8LdSLWXBT6k5aXeOEU6ixYVGHqHmFAnVaupyvQhXf8IRZ5mSI-Y4YBB0z8GBNVthZ9QP4Y2gGY_Fw
Request Chain 252
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE&s=184023&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE
Request Chain 253
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKPX6EJH_bkqAe4tHQzvSjo&google_cver=1&google_push=AYg5qPJmjr0mW0syTG3KGkXhu_pM8rX3o8J80u6H2KqCiGmziJ1H24oHIr0KmoghHdVg5OdKJqxAmST_5eUgF7QC80w9gFl3PZOY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJmjr0mW0syTG3KGkXhu_pM8rX3o8J80u6H2KqCiGmziJ1H24oHIr0KmoghHdVg5OdKJqxAmST_5eUgF7QC80w9gFl3PZOY
Request Chain 286
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMMXtvkugCQDiyo4yxs9gQU&google_cver=1&google_push=AYg5qPKvYiiOVIuXGtEGrL2dhsHv78X-JVtIp53OPdbwy6296hoQMIfvVtzbglvgwGlZ-kQ3ZWLKWCSh0YQI0pD6OiaiOqivpmHF HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKvYiiOVIuXGtEGrL2dhsHv78X-JVtIp53OPdbwy6296hoQMIfvVtzbglvgwGlZ-kQ3ZWLKWCSh0YQI0pD6OiaiOqivpmHF&google_hm=1NABKF7ctBNApUPskCF22A
Request Chain 288
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESECgVRX6N6zsLYiy_mQd8txk&google_cver=1&google_push=AYg5qPLFxuarojKl4YbdMgUxApYG8TdxCDkf-oUaO6KEThR-AFP8nTLya9KecynfrrF0uOmnUS5WuNidN7MjmxeQZ43p4TEhu2U HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPLFxuarojKl4YbdMgUxApYG8TdxCDkf-oUaO6KEThR-AFP8nTLya9KecynfrrF0uOmnUS5WuNidN7MjmxeQZ43p4TEhu2U
Request Chain 289
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPJBBhpTnPNg0ef4ixB6kNHG-r21BXOVVRDyE4tnp69KLYxf8BaSez02sJoQ5jhHlCkbhcBJgXrlG3HF73ydMkQX0pxxXsSG HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJBBhpTnPNg0ef4ixB6kNHG-r21BXOVVRDyE4tnp69KLYxf8BaSez02sJoQ5jhHlCkbhcBJgXrlG3HF73ydMkQX0pxxXsSG&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Request Chain 290
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu HTTP 302
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu&ox_sc=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu&google_hm=u-W4KiAIy8QwakUuezdY1w==
Request Chain 291
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKPX6EJH_bkqAe4tHQzvSjo&google_cver=1&google_push=AYg5qPLw7_pdlwNmNHOC3F-Jn1DUUXhbpk9HiwVXGBs4-V64PaSKNFS-duUnnU-CPsKvUUcWd8XTQpW4IhL7dK6mJQbqUc0mdr7v HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLw7_pdlwNmNHOC3F-Jn1DUUXhbpk9HiwVXGBs4-V64PaSKNFS-duUnnU-CPsKvUUcWd8XTQpW4IhL7dK6mJQbqUc0mdr7v
Request Chain 292
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEIpwbIahxwhzyV8hKJHSzEE&google_cver=1&google_push=AYg5qPLmp7_BieMAnwVY_amA_kCeKi4MTYvdZHijbau5GYsRxDmJPvp_fGh3kJs-xLkAJ7uydjyqlnQwEEKkWmJS965EJukxTTyV HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-2b67f067-5b25-414e-85df-81e86d5318c5-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPLmp7_BieMAnwVY_amA_kCeKi4MTYvdZHijbau5GYsRxDmJPvp_fGh3kJs-xLkAJ7uydjyqlnQwEEKkWmJS965EJukxTTyV%26google_hm%3DAytn8GdbJUFOhd-B6G1TGMU HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLmp7_BieMAnwVY_amA_kCeKi4MTYvdZHijbau5GYsRxDmJPvp_fGh3kJs-xLkAJ7uydjyqlnQwEEKkWmJS965EJukxTTyV&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
Request Chain 315
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHAfvJOm_RBiTq569KLQlcI&google_cver=1&google_push=AYg5qPIiNG530GBDQ6QsofofGBfEslkmEnCzdAXJNGOes6c83ShcHWuJc9KOxQ4aoKoc5oDXUx5oLvawPtwSk0b3_lL_j0JnAniq HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjc4NDIxNDA5MzI5MDU2MTg0Ng== HTTP 302
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
Request Chain 317
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPJmHTKjhcpiCEjD_c73H0gUTMuGTYPtW3fN2B9Vo6dStkyydfs8JQ4WRka2iebRlGcWiVNj7y_uyLFyViU8fcdVeBxd3k1t HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPJmHTKjhcpiCEjD_c73H0gUTMuGTYPtW3fN2B9Vo6dStkyydfs8JQ4WRka2iebRlGcWiVNj7y_uyLFyViU8fcdVeBxd3k1t HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
Request Chain 319
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKPX6EJH_bkqAe4tHQzvSjo&google_cver=1&google_push=AYg5qPK9j4ukHEjwBUsfN_XsOoyvhlgUqzhiOAep0mMhvE8MbDlkA4YnzGp28dmLdZNOWilMEfHWN7zfPJLhzUwRz8wH5foupAw1Lw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK9j4ukHEjwBUsfN_XsOoyvhlgUqzhiOAep0mMhvE8MbDlkA4YnzGp28dmLdZNOWilMEfHWN7zfPJLhzUwRz8wH5foupAw1Lw
Request Chain 323
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESECgVRX6N6zsLYiy_mQd8txk&google_cver=1&google_push=AYg5qPKpYueY_QLFBjzCzPWNBuAYnDcjKjWtEVgGKPU06yuVhWwd-rq-Qez2dWud5jqrFa014IcmHmAL3UHLi3PgqvGBk3ZJFM7oMQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPKpYueY_QLFBjzCzPWNBuAYnDcjKjWtEVgGKPU06yuVhWwd-rq-Qez2dWud5jqrFa014IcmHmAL3UHLi3PgqvGBk3ZJFM7oMQ
Request Chain 324
  • https://ads.travelaudience.com/google_pixel?google_gid=CAESEMgdnrS2XMd7JeC9eflPJCs&google_cver=1&google_push=AYg5qPI6plVUh1pgzgPArIVwDBi9B2lZT2iC0f6maRJrc3Y-xagZAgzU83SXSwmRuqcIKYiEjr8MWPYguP1WiIL9UW2mUtRqlOTQfw HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=CtFVst2XR8WQD1BjV73c3g2&google_push=AYg5qPI6plVUh1pgzgPArIVwDBi9B2lZT2iC0f6maRJrc3Y-xagZAgzU83SXSwmRuqcIKYiEjr8MWPYguP1WiIL9UW2mUtRqlOTQfw
Request Chain 326
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKiJumA0u_HbFFBfkTvg-Yk5EyGYqj4ENlRJYTwE-yppn_EXfgBBcx9tFsXgQwr7gsG-pvOWxG03CxUVnbTWfNAlqCxEh3UFw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKiJumA0u_HbFFBfkTvg-Yk5EyGYqj4ENlRJYTwE-yppn_EXfgBBcx9tFsXgQwr7gsG-pvOWxG03CxUVnbTWfNAlqCxEh3UFw
Request Chain 328
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII&google_cver=1&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps_TPg HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps_TPg&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps_TPg
Request Chain 329
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEAzx1b9ZjZ_mPGvvII25Mv8&google_cver=1&google_push=AYg5qPKHk5ZGpkwe06SKYxFb3yxBMfx9BrEy7FcHsbU1jJ1TIfTY7hgoq72pwa-B7Wss33Dn7D6l0F3-JxA-b8VkCyLiFQHa7ibrHw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKHk5ZGpkwe06SKYxFb3yxBMfx9BrEy7FcHsbU1jJ1TIfTY7hgoq72pwa-B7Wss33Dn7D6l0F3-JxA-b8VkCyLiFQHa7ibrHw&google_hm=Njc3OTYxODY4ODgyMDQwMTgwMg%3D%3D
Request Chain 346
  • https://um.simpli.fi/gp_match?google_gid=CAESEP8gi1JMN_3Mu6KF7r4pAOs&google_cver=1&google_push=AYg5qPI1kWOXGDecxhbsJYYj7MrTST6ISZpYbmYYPRqqiTqjp1DTggwn97cG5NNkbMrNedGfJb9TWQk10kFId8W_9pIIBijVWOPN HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=9BE2451957054AD9AC79E95519088E6A&google_push=AYg5qPI1kWOXGDecxhbsJYYj7MrTST6ISZpYbmYYPRqqiTqjp1DTggwn97cG5NNkbMrNedGfJb9TWQk10kFId8W_9pIIBijVWOPN
Request Chain 347
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEK_5uRIQqXkTpZKKJNjB0KY&google_cver=1&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUHqN9rMzQ HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEK_5uRIQqXkTpZKKJNjB0KY&google_cver=1&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUHqN9rMzQ HTTP 302
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=07f1ce62-0aa4-4ee1-93cb-2d4496f46fb5&ssp=google HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUHqN9rMzQ&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
Request Chain 348
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPIZe1H8YKm_xGVv9hPGEsIq40VejX7kZJ2z2PzouyGvcNsZyBoTsOEwVYM4IVdojtMMaU9J6Wl0SxTDYLlf3FW4ynySZ6M HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPIZe1H8YKm_xGVv9hPGEsIq40VejX7kZJ2z2PzouyGvcNsZyBoTsOEwVYM4IVdojtMMaU9J6Wl0SxTDYLlf3FW4ynySZ6M&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Request Chain 349
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBDMoYTEQYLlcVCCJJVCbD8&google_cver=1&google_push=AYg5qPIEPiN-v3agmOviHfAgsvB847_jf-S5JW3o08OtvWGVJ5wwA_oKqt1-xxuHaxxN1r--vBsrQEf74rg5ZRichogkB8910zZT HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPIEPiN-v3agmOviHfAgsvB847_jf-S5JW3o08OtvWGVJ5wwA_oKqt1-xxuHaxxN1r--vBsrQEf74rg5ZRichogkB8910zZT
Request Chain 350
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps
Request Chain 351
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII&google_cver=1&google_push=AYg5qPLwAtFGl0iAaQN7e63EyFQbMxtVy31go5w0KQy6ybfjxoZV739KhEd5eWcoi2IgevLxwNaOIvyF1UC6_f8GLhrXg0V8HHY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPLwAtFGl0iAaQN7e63EyFQbMxtVy31go5w0KQy6ybfjxoZV739KhEd5eWcoi2IgevLxwNaOIvyF1UC6_f8GLhrXg0V8HHY
Request Chain 383
  • https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKD34sLimAEQgAkYgQkyCLhTVvxEnQYN HTTP 301
  • https://tpc.googlesyndication.com/simgad/2401371329490837093
Request Chain 388
  • https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-157687-884638-9&mkcid=4&mkevt=2&mpt=4187233676&ff18=mWeb&siteid=77&adtype=0&size=1x1&ipn=admain2&placement=529704 HTTP 301
  • https://secureir.ebaystatic.com/cr/mscdn/64e017fc0bf98153dd694dc97d24a1ac/view_pixel_1x1.gif
Request Chain 401
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_cver=1&google_push=AYg5qPLRIeRcvC6PbRA5EZPc9WEyuC5PtVd2D32Td6vMlGs9CiwzZmenfwOIj5YGQEvPPdHJUf2lQbBRYZ1_Ul5ZkQuIuBXZH0Y HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU14QlRBQUJwWG5zU0FCZw==&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_cver=1&google_push=AYg5qPLRIeRcvC6PbRA5EZPc9WEyuC5PtVd2D32Td6vMlGs9CiwzZmenfwOIj5YGQEvPPdHJUf2lQbBRYZ1_Ul5ZkQuIuBXZH0Y
Request Chain 402
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHc3PwHYk_qgs097nsbhhso&google_cver=1&google_push=AYg5qPIMI67bJ1Thh1B3_41StVBpOM8k62WFRFJFKDTu8lQmmaqMQMzaitV1sHaNS6B4-3e1yD-AO4Jb9xwxF1zQAlZP8gnaBRo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIMI67bJ1Thh1B3_41StVBpOM8k62WFRFJFKDTu8lQmmaqMQMzaitV1sHaNS6B4-3e1yD-AO4Jb9xwxF1zQAlZP8gnaBRo&google_hm=rSH-4C1iSX2uF-QuSC74M-8
Request Chain 404
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPKIHAXpPOZyB5hl5T0uQVXTRL_D9DQf__e9U-Dw7fN6UjLxaPMINSKK31zzZZsK_ALK1lLJIW9R1FepnZTfbhFgOPWtxGE HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKIHAXpPOZyB5hl5T0uQVXTRL_D9DQf__e9U-Dw7fN6UjLxaPMINSKK31zzZZsK_ALK1lLJIW9R1FepnZTfbhFgOPWtxGE&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Request Chain 405
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1
Request Chain 406
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEIpwbIahxwhzyV8hKJHSzEE&google_cver=1&google_push=AYg5qPLUmT4Ds9cyjaFW_sOBTX0uYulqGNGBMeNZ4gYeAvZBZ-RLUhsD9QKvFnIS1CTpEHfspX2f94rg0kjFJ731g8h8VXB8iuQ HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-2b67f067-5b25-414e-85df-81e86d5318c5-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPLUmT4Ds9cyjaFW_sOBTX0uYulqGNGBMeNZ4gYeAvZBZ-RLUhsD9QKvFnIS1CTpEHfspX2f94rg0kjFJ731g8h8VXB8iuQ%26google_hm%3DAytn8GdbJUFOhd-B6G1TGMU HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLUmT4Ds9cyjaFW_sOBTX0uYulqGNGBMeNZ4gYeAvZBZ-RLUhsD9QKvFnIS1CTpEHfspX2f94rg0kjFJ731g8h8VXB8iuQ&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
Request Chain 414
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPI_ktnjrNYThXxNwwHZJjN9GSgbpbWSQLViOL3bttOQh1LM-HaJDsvc9oThcQQigfC3Yl4MC8ZBgbkYc3HX_Bg4x2OlFVgKwg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
Request Chain 415
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEK_5uRIQqXkTpZKKJNjB0KY&google_cver=1&google_push=AYg5qPL8hSGghH8NSPUjVN9t8bmAVaPk5r3WD5MeIf9zqnLfSoKdfMa7buP_pWQLKHou90c2P6P5SL3WPplzHKGk_c4Ri3fM78Hv HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPL8hSGghH8NSPUjVN9t8bmAVaPk5r3WD5MeIf9zqnLfSoKdfMa7buP_pWQLKHou90c2P6P5SL3WPplzHKGk_c4Ri3fM78Hv&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
Request Chain 417
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPJuzMT88PylMBS3SnxhXjwNmumhimwV-WNDPFYsSBW6QA1qADATRPmXpKmANpuWBipKhfHt3NS8X3fr--om3X1SDdo01nLGXw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJuzMT88PylMBS3SnxhXjwNmumhimwV-WNDPFYsSBW6QA1qADATRPmXpKmANpuWBipKhfHt3NS8X3fr--om3X1SDdo01nLGXw&google_hm=u-W4KiAIy8QwakUuezdY1w==
Request Chain 418
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEE-CF40SPPPEOLJ-HF5OkPg&google_cver=1&google_push=AYg5qPLv-2VqzJB2lTUaa8PtFUNPBlim6D-gsYE6D3lCDI7Om6OKEjeR-5vGdN11yS4mgTPcSzEgHr2FkIb8_-rGacGd_rUs2Wvp9g HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDVzEtMTctNkRQNg==&google_push=AYg5qPLv-2VqzJB2lTUaa8PtFUNPBlim6D-gsYE6D3lCDI7Om6OKEjeR-5vGdN11yS4mgTPcSzEgHr2FkIb8_-rGacGd_rUs2Wvp9g
Request Chain 419
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w
Request Chain 420
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII&google_cver=1&google_push=AYg5qPIiJLJwZsZx9JvLiuOTjWIypv5ZDoapuwS47fyEwQ-pGt-mp84YsKYzIQitJGkOhwLH57qR7Db5CrS99G-WcQJbJiRhBMPj HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPIiJLJwZsZx9JvLiuOTjWIypv5ZDoapuwS47fyEwQ-pGt-mp84YsKYzIQitJGkOhwLH57qR7Db5CrS99G-WcQJbJiRhBMPj
Request Chain 424
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKCmI1WCRMbi0ttWH_1HahDu89haD3q4R9FmfHKGyOySu5w26SGL_xGtdlzNOzGqb3ExOs1b8KYWmDCQCkHaaUCpupFo_CV HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKCmI1WCRMbi0ttWH_1HahDu89haD3q4R9FmfHKGyOySu5w26SGL_xGtdlzNOzGqb3ExOs1b8KYWmDCQCkHaaUCpupFo_CV
Request Chain 426
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPLUms7GJt4BncAyDeIaMN3KEo2Te8BsSf0vih-uVfBEY9fl_dR_tu7j7U8Qx-T9gZazV3vWd-OJlr4sBDFMFvJfePHXhrc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLUms7GJt4BncAyDeIaMN3KEo2Te8BsSf0vih-uVfBEY9fl_dR_tu7j7U8Qx-T9gZazV3vWd-OJlr4sBDFMFvJfePHXhrc&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Request Chain 427
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPL2UNAWsUAWd1ijobXIqaTq4WPpf_EbVCeDr9kB1EBLqhtdm1-F-UCuM_fDrUI7OZZ7yXfyswhkCfBUQw3w7QEmmvVE39Fo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL2UNAWsUAWd1ijobXIqaTq4WPpf_EbVCeDr9kB1EBLqhtdm1-F-UCuM_fDrUI7OZZ7yXfyswhkCfBUQw3w7QEmmvVE39Fo&google_hm=u-W4KiAIy8QwakUuezdY1w==
Request Chain 428
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1
Request Chain 429
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJyLzJSzJcVqCLSJqCTaklg&google_cver=1&google_push=AYg5qPIBaIEAlm5VULc5zDj-9A91nfiH41VJCMERCEU8o2M3Mkc7MQpnKhxANHJJREf-4u-OmcedwuqsyEEQbZDLz03ng21ygHBr-Q HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1KcW5IVWVCRTJ1R0VfQ3dnQTZYZ2lNODZNOE43cnpEVn5B&google_push=AYg5qPIBaIEAlm5VULc5zDj-9A91nfiH41VJCMERCEU8o2M3Mkc7MQpnKhxANHJJREf-4u-OmcedwuqsyEEQbZDLz03ng21ygHBr-Q
Request Chain 434
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPLMqVUAB6G7duIOuZK-5rH4_gzS6FNzhJGuH7-iYRZOnWcNn67UNgCSmmzmrA1lVr_cw6OkqOSKn6Esiw3_R8cADW6M3DGkiw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
Request Chain 435
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPLUu_cqQrSO6Z9rckcxohHALMq9z0X0nvqPJabDpwMNB0pH7IgajCG5zV_vZ0u75vqHfDjccIcikJilWAQjcFW8gRMJPQ27 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPLUu_cqQrSO6Z9rckcxohHALMq9z0X0nvqPJabDpwMNB0pH7IgajCG5zV_vZ0u75vqHfDjccIcikJilWAQjcFW8gRMJPQ27
Request Chain 436
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEDOajEUU8ETD67QqOB8O4q4&google_cver=1&google_push=AYg5qPJPbwMkqb80OHsNY-BRefE65g667i6IzxXsPei6C6_G7yzsji1XlXWRzyEAD3bkxPfFGpdybNHKC54ysTXrdZpSmAMStbKvsA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJPbwMkqb80OHsNY-BRefE65g667i6IzxXsPei6C6_G7yzsji1XlXWRzyEAD3bkxPfFGpdybNHKC54ysTXrdZpSmAMStbKvsA
Request Chain 437
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEE-CF40SPPPEOLJ-HF5OkPg&google_cver=1&google_push=AYg5qPKSPBttNTNmasMQ7HOu9VkJndsKuZ7RLn122TlKz6yfdNhLQrF9ze9AlS7NzjLhdH1uRaKh55wAbxeyfMZTK93MbO4u9g5jrg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDWDAtMjQtM0s5NQ==&google_push=AYg5qPKSPBttNTNmasMQ7HOu9VkJndsKuZ7RLn122TlKz6yfdNhLQrF9ze9AlS7NzjLhdH1uRaKh55wAbxeyfMZTK93MbO4u9g5jrg
Request Chain 438
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1

427 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ncmhcso.org/
Redirect Chain
  • http://ncmhcso.org/
  • https://ncmhcso.org/
99 KB
15 KB
Document
General
Full URL
https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9207452e3e668f1e46a60b6a611bbc9c1628a76fea71a8883f76ff5206fa8621
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ncmhcso.org
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-type
text/html; charset=UTF-8
x-frame-options
SAMEORIGIN
cache-control
max-age=86400
expires
Sat, 19 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
access-control-allow-origin
*
x-xss-protection
1; mode=block
cf-cache-status
DYNAMIC
cf-request-id
0abf781ab20000dfcf3f192000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vEr%2FoYLgiX8Wqyys2kgWVy5wRHbDPuXAJl9b0Wh1MQk6KHz20KWHs3TFwYtCq1w4D0yJovB8YynqY8wAkjEfYkHV%2FOf1D6tCBJcLACtc9B9%2F567q9KR2KeIkP8IJOF8R8G8cO8g%3D"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
66128fa448e8dfcf-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

Date
Fri, 18 Jun 2021 06:46:32 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
max-age=3600
Expires
Fri, 18 Jun 2021 07:46:32 GMT
Location
https://ncmhcso.org/
cf-request-id
0abf781a7b00002bc6fd029000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=RKJgkVvpLgIaP9kro6uF9Uafq5sRJf8trNma3ZRYALGzEcYe1hd0bpiNkVdyccP7R8Klq%2F3Tg1xP8hFjxBhLJnaLnNlcXKltMdL9UfW5W5%2BvtV2TZhHV78C0fKmVIidInZ4UiHw%3D"}],"group":"cf-nel","max_age":604800}
NEL
{"report_to":"cf-nel","max_age":604800}
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
66128fa3ffac2bc6-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
/
ro3.biz/
20 KB
20 KB
Script
General
Full URL
https://ro3.biz/?pu=g5qtmmzqme5ha3ddf4ztonrr
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.198.248.63 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
3471d510569e6fc1f5f6e4e2d80ae9d9061eb9e65bf1ea418225e43334aecd16
Security Headers
Name Value
Content-Security-Policy img-src https: data:; upgrade-insecure-requests
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 18 Jun 2021 06:46:32 GMT
server
nginx
content-security-policy
img-src https: data:; upgrade-insecure-requests
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=UTF-8
701e95e6-7737-482a-9dc2-06280155425a.min.js
cmp.optad360.io/items/
497 B
833 B
Script
General
Full URL
https://cmp.optad360.io/items/701e95e6-7737-482a-9dc2-06280155425a.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211a:9800:6:b871:4f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd7680f0d4768bf17b38b5834d7671e6e456d9655b4ae3cb39186d1fcd93f5c2

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 00:24:38 GMT
via
1.1 4fcd504c9be280bceae32e94ae54e04e.cloudfront.net (CloudFront)
last-modified
Mon, 12 Apr 2021 08:54:56 GMT
server
AmazonS3
age
23534
etag
"7acdc116a0830ba0aef5e087010246ba"
x-cache
Error from cloudfront
content-type
application/javascript
x-amz-cf-pop
VIE50-C2
accept-ranges
bytes
content-length
497
x-amz-cf-id
Ei3lLhOerANZjHTIqjSe-UgLHRTKVZ8JYRg_Bor6ATUhbQCbnse_8Q==
plugin.min.js
get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/
251 KB
70 KB
Script
General
Full URL
https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8e00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
16726b76043e97235cf0b1f6cc92e799194b324647636f5da5867e9641e422bd

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:34:16 GMT
content-encoding
gzip
last-modified
Wed, 07 Apr 2021 11:04:17 GMT
server
AmazonS3
age
737
etag
W/"58f0e2d6b2f64adb42f6d8b868ba8d14"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 a32f966fc5896281eb3de44fd8f57d40.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
fsaI-fCi4IU9_r1wVfHF86kM2rOjqfzjN8ZO-bi8VXl62aAXOQYwiw==
adManager.js
cst.cstwpush.com/static/
59 KB
60 KB
Script
General
Full URL
https://cst.cstwpush.com/static/adManager.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.42 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
4f7b6c826559e7a9fdd87aa3dab65d9032e27f9677e2c894bf8add376af093e6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 18 Jun 2021 06:46:32 GMT
Connection
Keep-Alive
Last-Modified
Tue, 25 May 2021 14:27:38 GMT
x-amz-meta-s3cmd-attrs
atime:1621952841/ctime:1621952841/gid:0/gname:root/md5:f7f10698b0e6bb748101b0917e29d311/mode:33188/mtime:1621952770/uid:0/uname:root
x-amz-request-id
tx00000000000006864e3dd-0060cc3530-fb33aff-fra1a
etag
"f7f10698b0e6bb748101b0917e29d311"
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1623998792.dop243.fr8.t,1623998792.cds225.fr8.shn,1623998792.cds225.fr8.c
Content-Type
text/plain
Cache-Control
max-age=504
x-rgw-object-type
Normal
strict-transport-security
max-age=15552000; includeSubDomains; preload
Accept-Ranges
bytes
Content-Length
60434
cookieconsent.min.css
cdn.jsdelivr.net/npm/cookieconsent@3/build/
5 KB
1 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.css
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd0d0b6e50ff01ff2f3a9a70d7cfb66a7c6cb9acf7a566325568be6d3bd31fc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
23036
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781aed00004a8c1e8e8000000001
x-served-by
cache-fra19172-FRA
timing-allow-origin
*
server
cloudflare
etag
W/"135e-3nthfC1sCV/yhiNebPZMMo2hpL8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
66128fa4a9404a8c-FRA
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
135 KB
48 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5f3ea9dda31c4f06f4a3ea880793f42de1a7b9b35047998872169aef3f9e15f3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
48872
x-xss-protection
0
server
cafe
etag
4842954625908305269
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 18 Jun 2021 06:46:32 GMT
style.min.css
ncmhcso.org/template/rubik/css/
25 KB
4 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/style.min.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1698abe528bb1f8e76991814a09aacb0ec7247d421ed2e4ff8f00e3fb1275712
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/style.min.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119773
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781aff00004dbe880f2000000001
last-modified
Mon, 29 Mar 2021 13:27:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"643a-5beacd6c04d03-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uqAZMucqsg01LAQGEhevk5hhJECzGH7qtg4fLu7B2NjOyDIl4FpfBJVfV%2BDZ3v01tyNXHb6njIr6c9FpiIAFL5RZxULYhgFHOF3706QunP1VrACp%2FaLI0e3IG%2B4rllk2cvOhWmg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c9074dbe-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
styles.css
ncmhcso.org/template/rubik/css/
2 KB
1 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/styles.css?ver=5.1.1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ad2fcb328295f1199d593adaba909f3eea790f695554ac3c1da7aa009fc0e0d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/styles.css?ver=5.1.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119773
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afd00004dbea72b5000000001
last-modified
Mon, 29 Mar 2021 13:27:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"695-5beacd6bf4361-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=9LxfpbU5n%2Bv5PII1iMdornKUHj5jqGXt8BmAQCoCNEtiExvVstAHA7Xz7YVk564%2FFLkWf3fB6VmD4g5S3qsnnAzt3K9K3BYq1kww9WDvpHNJdOe6TTA2TAgCe%2BR668RWd1r3u74%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8f34dbe-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
shortcode.css
ncmhcso.org/template/rubik/css/
8 KB
2 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/shortcode.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6299ceb6ce9c971a58efb0bd1fe66a5eb96317a0dd675a608d7a1c12ec11fc7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/shortcode.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119773
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afd00004dbed0937000000001
last-modified
Mon, 29 Mar 2021 13:27:09 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1fcd-5beacd6bd013d-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=C7ndRswfltbs%2BqwTvmOppqL0BJUiQuTtGW8bm3zHmmLBSTcCIK25fuHUWAjJlvPe98gosGmp%2FVCS1752EEJwTShO6c0skEWyq2DYyOnDBcpLOEg%2FOSvykG%2FAJp%2FCTFDdK9kn4c4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8f64dbe-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
bootstrap.css
ncmhcso.org/template/rubik/css/
36 KB
6 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/bootstrap.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3320c0d7115359837e0643f49b0828132df3424cedbb4b32428297dde2cf6c66
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/bootstrap.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119773
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afe00004dbe80058000000001
last-modified
Mon, 29 Mar 2021 13:27:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"91ab-5beacd675a719-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wlXcKMB3A%2FDGSSzYr0BZpGb1KkKdHdNNJSRs%2BHotMY6fxPSyD2Lylqbp0Osl3HHdm1MkfThQZWgehmr6KClBU4Sbwh6WPppqYMY%2BAb4zBokEiBTs9OtM8QD%2FLq874bmxjW75beE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c9024dbe-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
font-awesome.min.css
ncmhcso.org/template/rubik/css/
30 KB
7 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d3ed5e7e4c4aafe8c1f5d004e7eee33b5887117d2125848352a2cda86dd7ed0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/font-awesome.min.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119773
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afe00004dbe981b3000000001
last-modified
Mon, 29 Mar 2021 13:27:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"78e2-5beacd686dd79-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Lx8hqOflkeN%2BXhBvAHKh8JWTegWuu5twnn0RMGPUh35xaMzVou5CiEpE1d3%2BoUiuyOULwVxSklNMbeE9u0fCBjJTpt9LAmGR8DenKugpdOOKYeBcmkiniPKQIcQN4xB2IjLr0EY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c9044dbe-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
external.css
ncmhcso.org/template/rubik/css/
58 KB
8 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/external.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2935547d3f71917ad204c10123bc6c14bc037d3814b760d50a7540cc0ef6734
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/external.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119773
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781aff00004dbeaa114000000001
last-modified
Mon, 29 Mar 2021 13:27:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"e889-5beacd684ca35-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=g9%2F3IWop3mcNmCHwDsn7zcyPJzlzv3nzcvAPLTfhzttBNrXlbRO5iIZ%2FKnuS8c1cORH3dFdpQHwaUoHkhdit8qbIYphKVk3PvHwTa7QxK%2B5B%2BSZbj60u352%2BgJwzaKm5BeYU7wM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c9094dbe-FRA
expires
Wed, 30 Jun 2021 21:30:19 GMT
bkstyle.css
ncmhcso.org/template/rubik/css/
243 KB
35 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/bkstyle.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b51b115bd237a8ddd57dfcba97289c21e011e73888f1bbff4dfc7a6046ea245
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/bkstyle.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119772
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afe00004dbeaf21f000000001
last-modified
Mon, 29 Mar 2021 13:27:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3cc29-5beacd676b0bb-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ztZRVRE8JFqtuHTHeYfRoIwKaqPQfQoY0aWVS9akecTKbPC3E%2BksEAgqCCsBoCtSo5eI%2F9Z24amayNOs447cPnpak7olTkxdZt%2B85h%2F5i4d0KEGFLBh3SXgqmiGcirZNb0GxvJY%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8fd4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
css_1110.css
ncmhcso.org/template/rubik/css/
931 B
902 B
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/css_1110.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7dfdeeab3d7d536feca8c4d4ba7c7487eb380ae350cb6df273f88047519c404a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/css_1110.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119772
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afd00004dbe9897f000000001
last-modified
Mon, 29 Mar 2021 13:27:05 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3a3-5beacd67af683-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bK2JE21YfGnHUJ%2FVB9Z83UwABLU2iOZTbC7YSgZ2fuuY93GqFEpvrfOnHoANwCi1nQi87j4EHtTREqsgqMHZG7eZYJ3Rmy9zb6q1pWlRJofPGZCffJEjTqtZ8VJCAUcRDyP3Uxk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8fa4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
responsive.css
ncmhcso.org/template/rubik/css/
66 KB
8 KB
Stylesheet
General
Full URL
https://ncmhcso.org/template/rubik/css/responsive.css?ver=5.0.6
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9066d3560e4855d5ad6b44ce3e5413931c24bcd03921ece8f582a947d632194d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/responsive.css?ver=5.0.6
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119772
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afe00004dbee5950000000001
last-modified
Mon, 29 Mar 2021 13:27:10 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"109e1-5beacd6bf4361-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=6KIu5oxne43MLKG2EhlFHefPOZ5B%2FBdypP4SFhHPBTnYrcK%2FwOvZRHOc%2B9fWJKvCM%2FVLsPYqBTBeD8R%2FDmWjHD%2B9SqIHxMPWwSX%2BP9c8FH%2B%2FNuwEDmAZ2bsRL8KfXyMNQ7o4bbU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8fe4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
css
fonts.googleapis.com/
27 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2d1affae24db39c09d9df7afaa24f8c1fcbcad374d03acbc8d273744ba985252
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 06:35:30 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:32 GMT
jquery.js
ncmhcso.org/template/rubik/js/
95 KB
33 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.js?ver=1.12.4
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.js?ver=1.12.4
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119772
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afc00004dbe838bc000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"17a6a-5beacd6e190e0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=tP9R7OP4USTcu1AUBzjH9VNfFZUA95WnH7SPItCpEjmZwEhCabu2WpFOssSAwjmOCSUJWJfuptosvNoPWvNTKvORFLIMI%2BowqNo7nF0XESNd%2B6UX6zG57fY80%2BJqUGP5l1M6Rb0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8f04dbe-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
jquery-migrate.min.js
ncmhcso.org/template/rubik/js/
10 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery-migrate.min.js?ver=1.4.1
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119772
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781afc00004dbebbb46000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2748-5beacd6dc5117-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zKaJwVQlM0289rGvoPJv6dCRtX%2BDBodVB2YcUGeNpA7pEheAGCi%2FwloeMIiMHshaS%2F90lmtHuGrHdPRW4vJLP0b8rerhqbOaB1gH112k%2FsCx1jvjHSklg670HUTNN%2FeEb2d%2F%2FHg%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa4c8eb4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:20 GMT
smrcp_19121001.js
cdn.zx-adnet.com/adx/
144 KB
19 KB
Script
General
Full URL
https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3701da754cd5a0bc28caf5540c9d07c59164f08cfc5a3fb57ffc4864ce97abe5
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998793.559026,VS0,VE170
etag
"5b3dfee603f4fa43f768bcdb3f5f4a2cdce1c019b73ecbe79f7cb0d0ca77d787-br"
x-served-by
cache-fra19142-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600,public
date
Fri, 18 Jun 2021 06:46:32 GMT
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive
content-length
19503
x-cache-hits
0
transthyretin-amyloid-cardiomyopathy-attr-cm-symptoms-treatment-and-more.webp
ncmhcso.org/img/health/
54 KB
54 KB
Image
General
Full URL
https://ncmhcso.org/img/health/transthyretin-amyloid-cardiomyopathy-attr-cm-symptoms-treatment-and-more.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
922dd843a18f8aa35e5dad2f1c3992348ea31501a6293efd1ace1bafcebb7d89
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/transthyretin-amyloid-cardiomyopathy-attr-cm-symptoms-treatment-and-more.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
54874
cf-request-id
0abf781b6900004dbed72b2000000001
last-modified
Mon, 29 Mar 2021 12:36:57 GMT
server
cloudflare
etag
"d65a-5beac2327e01e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VLRo4JroO1sdFNtH5dsR4MAZKk9TbrwhXgr3sSzM45XU3IYpdvOOFH17WAwWusvM31lgK4uXoPle1U%2Bu6tQjvfnMpwmKc%2FCfbYluMawRztURiqMPw%2B7gt7nl20WO21izUY%2FakOE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54ae84dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
behandling-af-kroniske-smerter.webp
ncmhcso.org/img/healths/
16 KB
16 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/behandling-af-kroniske-smerter.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b41345163e513f8480e8661c9f357a8ffc355bc3956aeae8550f88e342686ad
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/behandling-af-kroniske-smerter.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
16202
cf-request-id
0abf781b6900004dbeb92cd000000001
last-modified
Mon, 29 Mar 2021 13:05:46 GMT
server
cloudflare
etag
"3f4a-5beac8a38aed4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jxhL7VGBX%2FE6%2Bzis2hVO3Zcakpr3%2By%2FMUtxlftvpVghXKmUwsdJDLWCvZS2tubeQAt1YTdVo2hZRxVFQA9errK5x8j%2B6GDMcprkz78P52kBOLkA%2FWFv7spP4M2PL6Kf1BniY%2FoQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54aeb4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
yaz-vs.-loryna.webp
ncmhcso.org/img/health/
19 KB
19 KB
Image
General
Full URL
https://ncmhcso.org/img/health/yaz-vs.-loryna.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
584218e6c2fcaae5dabd9a106e287fd6552525344a9a77e44da2348e3fedf045
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/yaz-vs.-loryna.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
19234
cf-request-id
0abf781b6900004dbe981be000000001
last-modified
Mon, 29 Mar 2021 12:46:42 GMT
server
cloudflare
etag
"4b22-5beac4607e1d2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HnkxIKLmj%2BV%2FTs1ashsV9lCNSRDx2d%2FE8jqP%2BqARLNYCLedbk7FS9nF852FTZ4N1bqurzm0d2ULF82Oxe1Top1i8r%2B9MzH086p29zUF%2Fb2OYiaGygsxV55iZJmfHgBbab7ASDZk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54aec4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
graviditet-uden-for-livmoderen.webp
ncmhcso.org/img/healths/
25 KB
26 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/graviditet-uden-for-livmoderen.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a68cdf7ed2a4b33b54c6d8870af0568ce47c2f59de3ad12b2280e2563b187f92
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/graviditet-uden-for-livmoderen.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
25910
cf-request-id
0abf781b6a00004dbebe9ac000000001
last-modified
Mon, 29 Mar 2021 13:12:11 GMT
server
cloudflare
etag
"6536-5beaca129f4fc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LEYbJRC8jM6acFSjYZU7NKlxKK6EnnrRRvPqBi6C3%2FGGEfa%2BABLj8549DyNUDKltE3l9r%2FE7PDdm4OY9oT1RPPxwDfr0w5ITa%2BSZNCO39U1bBCkRRurq9xrR%2BoZFzdAUhN1uFGc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54aed4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
10-delicious-recipes-to-lower-your-a1c-levels-5.webp
ncmhcso.org/img/health/
31 KB
31 KB
Image
General
Full URL
https://ncmhcso.org/img/health/10-delicious-recipes-to-lower-your-a1c-levels-5.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6de7e21adc53c992531c56726a8f1249a96dc887acc4e253e416613095d11fd7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/10-delicious-recipes-to-lower-your-a1c-levels-5.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
31521
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
31350
cf-request-id
0abf781b6a00004dbedf0ea000000001
last-modified
Mon, 29 Mar 2021 11:56:09 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7a76-5beab9144fdb1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Psdi1hI2uF2uIcMExmWG96D5jjIdgOZ85ATnAGAskB7ibMp0ejL%2BuwKktuoMR%2FimN7OyJQA8nejbUH%2FuBGdpUoRiPUjIEC%2FUznku20WN2jgciXrMsQ3K7r64P0O35QN9EKWMH5k%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54aee4dbe-FRA
expires
Thu, 24 Jun 2021 22:01:11 GMT
catheter-associated-uti-cauti.webp
ncmhcso.org/img/health/
24 KB
24 KB
Image
General
Full URL
https://ncmhcso.org/img/health/catheter-associated-uti-cauti.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d8f2e301e6747c7ad571691ee6a15f6540c7bc7a752447fea7fe7f66cb5b15d
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/catheter-associated-uti-cauti.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
24430
cf-request-id
0abf781b6b00004dbe6f089000000001
last-modified
Mon, 29 Mar 2021 12:08:50 GMT
server
cloudflare
etag
"5f6e-5beabbe9df7c6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=chuUTYeW6od1cwpGysKm7L19LL23BoVqSjqQHwW%2F6Vpx1qSZW%2BmZeXR1eMIHRCFE80DUL3EWtsntaCYJ%2BMvfFurXC59BlDg2Nq7IAlPknXmnACHaVzX6SlV7N8w9Jxa0TLFaXmY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54aef4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
how-to-cut-fingernails-1.webp
ncmhcso.org/img/health/
36 KB
36 KB
Image
General
Full URL
https://ncmhcso.org/img/health/how-to-cut-fingernails-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ccfe5660faed87e138eb618c9a44d36dcde7a647bacefd47d27fb9578ee7ab4
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/how-to-cut-fingernails-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
36650
cf-request-id
0abf781b6b00004dbeb1242000000001
last-modified
Mon, 29 Mar 2021 12:20:54 GMT
server
cloudflare
etag
"8f2a-5beabe9c315fb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=S5y50ILF7ZBARpmBlA%2B7J0QFKPPaFM%2FSadiGbNt%2BUeU4sI52XJRSVg%2BzvOYtl0sR4CcWRsq%2FUsahRqSwdymRhCDudqm7p3%2B5iMrhpzDVWJ2Bnx%2BjY8F2OGCHG0Fo7nr1ShPvmZM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54af14dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
innovative-treatment-could-slow-down-alzheimers-disease
ncmhcso.org/img/about-everything/
335 B
335 B
Image
General
Full URL
https://ncmhcso.org/img/about-everything/innovative-treatment-could-slow-down-alzheimers-disease
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cffcb70abd2e9d0c7cd49a445c6d3a47d51540fef262470b60d2fb01b6fac11e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/innovative-treatment-could-slow-down-alzheimers-disease
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=aumLORwic%2BkVpQ%2FWWYkh53rbexKzvubrAu6dp70zT%2F2vcx0C3XE3k8hs7guZyoZkslsoKBbbNKd7KyKDFt2vCuy0jOUqDW8Xz2%2B7CwujP0iHoIyvp9ETkghPnyDphMsZpp6ieEQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cf-ray
66128fa54af34dbe-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6c00004dbe9f323000000001
hvis-jeg-har-pcos-og-gerne-vil-vre-gravid-hvad-skal-jeg-gre.webp
ncmhcso.org/img/healths/
52 KB
52 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/hvis-jeg-har-pcos-og-gerne-vil-vre-gravid-hvad-skal-jeg-gre.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14ab28f58601b3c2eac7f8c3d435e1798f7e66351902b43d9fd42c08004084d5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/hvis-jeg-har-pcos-og-gerne-vil-vre-gravid-hvad-skal-jeg-gre.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
52848
cf-request-id
0abf781b6c00004dbe73063000000001
last-modified
Mon, 29 Mar 2021 13:13:13 GMT
server
cloudflare
etag
"ce70-5beaca4dffefd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=jRU3YdPtDOmvBCp6%2F%2F8ahzdD5bvhGKCo%2FbZtn1idMJEYNFSfFTNhun6QynJTAd89rufFIlxztEOs7a2JIH2QRBqkiLB%2BO2Sya8jd7rHpJLzvMFaNBtdFyFV6TxxjONk1Itw54O4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54af64dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
organic-brain-syndrome.webp
ncmhcso.org/img/health/
9 KB
10 KB
Image
General
Full URL
https://ncmhcso.org/img/health/organic-brain-syndrome.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ddf07c5edc3bcaab290fa6573348dac0fe4e00a05fd23e18f18af86800382cb7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/organic-brain-syndrome.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
9220
cf-request-id
0abf781b6d00004dbede3d8000000001
last-modified
Mon, 29 Mar 2021 12:26:18 GMT
server
cloudflare
etag
"2404-5beabfd162f27"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=61VVp7dyOaDtVvaVquUVAKjS%2FMaBRcE1pmDZHF5SwxqI0TPNNGGKo34vnzBsodsbIdzZxsozzBkDKIw%2FPEzXZj4ewxGGrwNfmwe%2F%2BRppo7tKG14FBzYO4rstvRSM4u27y%2FSjb00%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54af94dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
everything-you-need-to-know-about-premature-aging-1.webp
ncmhcso.org/img/health/
35 KB
35 KB
Image
General
Full URL
https://ncmhcso.org/img/health/everything-you-need-to-know-about-premature-aging-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1f5a91a6b037e43e2ccf1c86a35ad4ce0ede7b1a099989b5d8c125697b231a7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/everything-you-need-to-know-about-premature-aging-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
EXPIRED
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
35622
cf-request-id
0abf781b6f00004dbec2a23000000001
last-modified
Mon, 29 Mar 2021 12:13:22 GMT
server
cloudflare
etag
"8b26-5beabced891f6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TG%2FrFIGz4HknnLAuC5u6BDVT3Qz%2Bplpl9%2FcJVH%2FshV1W4lwFlN%2BrOUytn40T3wLUGfzuYRcOvD9b8YUs18L%2FgBrpZjg%2F9F0j5N7BZ4tNFpEYFdkOtoxuU5xArJxcNZvayf35K3E%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54afc4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
aging-changes-in-the-breast.webp
ncmhcso.org/img/health/
39 KB
40 KB
Image
General
Full URL
https://ncmhcso.org/img/health/aging-changes-in-the-breast.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
65e10049ad2c80610615e5e07e5f5f2b0723fcb0a4e12cae9e76b2811bf3d6ab
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/aging-changes-in-the-breast.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
8640
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
40158
cf-request-id
0abf781b7000004dbed8336000000001
last-modified
Mon, 29 Mar 2021 12:05:46 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"9cde-5beabb3a691ed"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=mb38ZyqyOslJ0PG85TGRBtSt%2Byy7auuokGlcEnE1LbSI7uG8nUb5mn%2BRdL%2BTfeZGMb3GbKQs4xCfmvCWhPMoiS24XpFdHsx1%2BB5nbxZyghBt7osIAvR6C%2BnTqJckMrIV590%2BL7w%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b004dbe-FRA
expires
Fri, 25 Jun 2021 04:22:32 GMT
cara-menghilangkan-bibir-hitam-agar-makin-percaya-diri-1.webp
ncmhcso.org/img/health-care/
32 KB
33 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/cara-menghilangkan-bibir-hitam-agar-makin-percaya-diri-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
878f39ff62a28e531c2a969d703530e5b0ca8fcde0cae4e8e527d8f114eb6313
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/cara-menghilangkan-bibir-hitam-agar-makin-percaya-diri-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
32918
cf-request-id
0abf781b7000004dbe9898d000000001
last-modified
Mon, 29 Mar 2021 12:50:45 GMT
server
cloudflare
etag
"8096-5beac54821b46"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=k48HvwksYq%2B3%2BF5tOwt40INni9dA1F6DepxG5NorEkjY6hdcq50Rm7k0xUWL9u9T5ILAaxn4C%2BN6YJVV%2BKVg3ZiqZ8zR6Z6Eqd7oaYYyOg8ct4uqE6Be5%2FgvE4ztCdqztUz5NsU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b044dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
diabetes-and-gluten-what-you-need-to-know.webp
ncmhcso.org/img/health/
26 KB
27 KB
Image
General
Full URL
https://ncmhcso.org/img/health/diabetes-and-gluten-what-you-need-to-know.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d0265cf1535665ef0520aeee9fdd5300259676f138659d2a8ba184e2c3daba6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/diabetes-and-gluten-what-you-need-to-know.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
26708
cf-request-id
0abf781b7100004dbee595b000000001
last-modified
Mon, 29 Mar 2021 12:09:58 GMT
server
cloudflare
etag
"6854-5beabc2a9c3f1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bvsvT%2F0vARKjcmSNMR1gxtbFJ5irX9fmqH%2F86%2BGwuCZJsNdJ0G2JxlvSwTTkFr2rbMR3Dss%2Fjpbp62zwptLMdKBcuhEZ88%2FWdNVUoEa5bu0nxIKG35yVB9OLf7o0R3bdB0bnYog%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b074dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
5-gentle-yoga-poses-for-menopause-6.webp
ncmhcso.org/img/health/
30 KB
31 KB
Image
General
Full URL
https://ncmhcso.org/img/health/5-gentle-yoga-poses-for-menopause-6.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63077d68ac600d27ff532213a2ff2d7cbac91a8ecc6bef645580b81f36d6d09b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/5-gentle-yoga-poses-for-menopause-6.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
30674
cf-request-id
0abf781b7100004dbe7d807000000001
last-modified
Mon, 29 Mar 2021 11:59:12 GMT
server
cloudflare
etag
"77d2-5beab9c287b4a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=d4RsgVgIBlmdI68ia8sp9jTzKi%2FwgMFIRNhM8Q5B8CZ9fMlNvgIRBI4xL0NotU6wzryaEhI3Fy2aRW4SGAHc8Kk0BXNZVJeRaT0QQq5YrQHKfekk5MJfiqDpwz3WhUqanmcCjRI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b0c4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
things-you-can-try-at-home-to-eliminate-bad-breath.webp
ncmhcso.org/img/health/
37 KB
38 KB
Image
General
Full URL
https://ncmhcso.org/img/health/things-you-can-try-at-home-to-eliminate-bad-breath.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
514d4d07f570ff4bc32cfa9a6465a572e5c6a609628489bbb113b2ea437b89a6
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/things-you-can-try-at-home-to-eliminate-bad-breath.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3277
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
38170
cf-request-id
0abf781b7400004dbee2019000000001
last-modified
Mon, 29 Mar 2021 12:36:19 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"951a-5beac20e4a2ca"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=92k8FrpHl10VgniSNgf6eLagHl3viJZt5sKICr2%2B3yYDMLbzRZDvScicuhPp31YfC4b1PGNujRJR4inFsKLk1EH%2BMReR%2BrLTpypdJ%2BULdx9vBeRRrYpvGD%2BiYkWqTOxfl%2Byk6gs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b114dbe-FRA
expires
Fri, 25 Jun 2021 05:51:55 GMT
ask-an-mbc-navigator-resources-to-guide-your-journey-2.webp
ncmhcso.org/img/health/
55 KB
56 KB
Image
General
Full URL
https://ncmhcso.org/img/health/ask-an-mbc-navigator-resources-to-guide-your-journey-2.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb4059d1c09dfbb1aff688bd355c8d8bdcd38bda65dfad288e971439cd0746ee
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/ask-an-mbc-navigator-resources-to-guide-your-journey-2.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101441
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
56464
cf-request-id
0abf781b7200004dbed72b3000000001
last-modified
Mon, 29 Mar 2021 12:06:28 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"dc90-5beabb632145a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bPrlVoyWXMFhdrCWBrF9KgzoOkgjgSGCBcGLYm8F%2BIc1Au%2BwM9t%2BMVC6TtDaKAlYy2EIDyDL0c3iwdDyvM%2Frk%2FIrQD%2FWT7eq1GtizhpVuL4V6fFLXg%2FR6NbGLM877nQd4FfdYZA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b134dbe-FRA
expires
Thu, 24 Jun 2021 02:35:51 GMT
taklukkan-tenggorokan-gatal-dengan-cara-ini-1.webp
ncmhcso.org/img/health-care/
22 KB
23 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/taklukkan-tenggorokan-gatal-dengan-cara-ini-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00d5fac3472ff8f0feeae7b36306de9131fbc957ffb69460daed498f28d5dad4
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/taklukkan-tenggorokan-gatal-dengan-cara-ini-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
22736
cf-request-id
0abf781b7300004dbe90253000000001
last-modified
Mon, 29 Mar 2021 13:03:28 GMT
server
cloudflare
etag
"58d0-5beac82046755"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=c29R9FTTSvyTsxeDehymEjWpqkas0x%2F9IbQtqOpfw1dMpGC7dOFKixUsMvF2rtR%2FDywiF07DeMe73LSZg8nU7cr85AOSvUpAZBOAix%2Bas9ww5vyhxoiu1d7IxlPrl1FHpITT87Q%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b154dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
can-babies-drink-cold-milk-1.webp
ncmhcso.org/img/health/
47 KB
48 KB
Image
General
Full URL
https://ncmhcso.org/img/health/can-babies-drink-cold-milk-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa164604cc5fe15185864c5ba789e8115bf4d0ee802e3db6d81747cf3d49d77c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/can-babies-drink-cold-milk-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
58608
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
48272
cf-request-id
0abf781b7400004dbe9f324000000001
last-modified
Mon, 29 Mar 2021 12:07:53 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"bc90-5beabbb361d89"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=pvBM1l%2FL8%2Bbj2aRFeO1CIxo58uH8qv3AvICCRq6V%2B9lbIqUTaGkjOsv8lAbZBTNQXvEb9iQl%2FfJC0PO7nD6uVVOyVo7pAMDndIc4U3ykRwjJDpAsgjbTRYDyxHvQoAbMB3VkU%2FE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b174dbe-FRA
expires
Thu, 24 Jun 2021 14:29:44 GMT
8-health-benefits-of-growing-a-beard.webp
ncmhcso.org/img/about-everything/
64 KB
64 KB
Image
General
Full URL
https://ncmhcso.org/img/about-everything/8-health-benefits-of-growing-a-beard.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e60ddc8776de90835dfa7f3606b17731961bc687b707600930f393e9da79f309
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/8-health-benefits-of-growing-a-beard.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
101216
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
65090
cf-request-id
0abf781b7500004dbebe9ae000000001
last-modified
Thu, 01 Apr 2021 17:52:15 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"fe42-5beece456a602"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=zNEIzx0yYtGGxhYFrTekdOXMwu3yTNNIjrzKo7Mi%2FhTJEYB7EVrDxbJGbpopDD2lAd526fZyx6RFFxCPoNz65%2BFKfQsrjk%2FC7BbdWRaWXY5Yx6Xeo3lsi59uV7zBFxL4Btm2drg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b224dbe-FRA
expires
Thu, 24 Jun 2021 02:39:36 GMT
manfaat-jus-seledri-bagi-kesehatan-1.webp
ncmhcso.org/img/health-care/
22 KB
23 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/manfaat-jus-seledri-bagi-kesehatan-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f96f665969d662ffa8b3a02b78c023c75d334aaabe15c69f14a262bb299e6cdf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/manfaat-jus-seledri-bagi-kesehatan-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
22438
cf-request-id
0abf781b7600004dbe753aa000000001
last-modified
Mon, 29 Mar 2021 12:57:31 GMT
server
cloudflare
etag
"57a6-5beac6cc3162d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=LSCZY4all%2BFZxv2o%2F3D%2Fx%2BOfB%2FeMaw7DN4C5UM81POPFcfzXnwiNbV1mTlUPVTVP0wBDFwEM0DHjomJx1O5DlsG9Yjv%2Fo%2FY5PTjhx13AtsKur0ZxgDQ6rAI8Zvy57fHllk%2FwAHY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b274dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
10-worst-diet-trends-of-2012.webp
ncmhcso.org/img/about-everything/
335 B
335 B
Image
General
Full URL
https://ncmhcso.org/img/about-everything/10-worst-diet-trends-of-2012.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cffcb70abd2e9d0c7cd49a445c6d3a47d51540fef262470b60d2fb01b6fac11e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/about-everything/10-worst-diet-trends-of-2012.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b7600004dbe7d808000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BeOXHIw0VI7OQxaIIFbBqNJ8FyfU2%2BOFeiCoMFymNxmfH0pEZ%2BcZjz5PtQCVVOnoQhh%2BUYuxwvMyUcgqzsjz3nseX2Pgo3Tu3N9RdN60QMEmTWKlUoc5wsN7d1ffAFJCmFeJ2Fg%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54b2f4dbe-FRA
sunflower-oil-for-hair-1.webp
ncmhcso.org/img/health/
51 KB
51 KB
Image
General
Full URL
https://ncmhcso.org/img/health/sunflower-oil-for-hair-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ae7c417360b14883ed8299a0f98a1bf6d6de5e01e1d10e4ced1c9ec1f174431
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/sunflower-oil-for-hair-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
51810
cf-request-id
0abf781b7700004dbea4b69000000001
last-modified
Mon, 29 Mar 2021 12:30:10 GMT
server
cloudflare
etag
"ca62-5beac0aefefc5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=w6Sg%2FdlbgfX7KomYY%2BN7E%2BGgI88tsVt%2F7yByyIedPk96BU7jjoPCk6usBIC%2BFECiFxz2dICA%2Fd0CDLXcJIC2ZRc8SINBE92kfe1S9fSUkS91TI5Dbo1qWBL1IknQe4%2FquWb7T8M%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b334dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
what-is-a-phyllodes-tumor.webp
ncmhcso.org/img/health/
43 KB
44 KB
Image
General
Full URL
https://ncmhcso.org/img/health/what-is-a-phyllodes-tumor.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de6a725d35b5a7d2e7227a060ab4f33fdb0d43fea2feab41cad0090065b5ee87
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/what-is-a-phyllodes-tumor.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
75586
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
44438
cf-request-id
0abf781b7800004dbe9898f000000001
last-modified
Mon, 29 Mar 2021 12:42:46 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"ad96-5beac37fc3171"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TiYZbkMp635WaN1b521C1iZFhNiXjb5GE8XjuacFpeaUfrFxyDwQ9pPBt9HXkVMoMAo%2FmuLznqNE5Pkh%2FGIH6x4gbF2TfN2GOY1aBep7yOloYmQRjVTxBJjIWiL9JQH9tmhJYos%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b394dbe-FRA
expires
Thu, 24 Jun 2021 09:46:46 GMT
what-you-need-to-know-about-oral-frenectomies.webp
ncmhcso.org/img/health/
43 KB
43 KB
Image
General
Full URL
https://ncmhcso.org/img/health/what-you-need-to-know-about-oral-frenectomies.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f243e94ce5c9fd76a729b6fe92cf92cb1073d09533de16f44bdc5779fa67be5e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/what-you-need-to-know-about-oral-frenectomies.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43524
cf-request-id
0abf781b7800004dbe97b3c000000001
last-modified
Mon, 29 Mar 2021 12:44:24 GMT
server
cloudflare
etag
"aa04-5beac3dd8e8f2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=01YmQmACZtfzyXMySROTG%2Bmyd97161CNaJfkKymwpFzZBtEAKCj1wvPtkAaBOl3sGbnu2r3x7ZXCXlPsD%2Ba5tr8o20%2Fl6RKUH8pX3xXSvYYreCxCjgtvF1qrGGw6vT7ZYDggs4M%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b3c4dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
tag.js
mc.yandex.ru/metrika/
218 KB
70 KB
Script
General
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
c6754c3241a18169afee078352f5e11c9c8eec97b9e2fb173f541ce2d07dd210
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
last-modified
Thu, 17 Jun 2021 09:26:05 GMT
etag
"60bf3bc8-114ef"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
70895
expires
Fri, 18 Jun 2021 07:46:32 GMT
what-is-hereditary-neuropathy.webp
ncmhcso.org/img/health/
29 KB
29 KB
Image
General
Full URL
https://ncmhcso.org/img/health/what-is-hereditary-neuropathy.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b7b9620533171544eeda31afef67b33b67dfb07c49d222f67a939ea8994f5bc
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/what-is-hereditary-neuropathy.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
29308
cf-request-id
0abf781b7900004dbecf847000000001
last-modified
Mon, 29 Mar 2021 12:43:07 GMT
server
cloudflare
etag
"727c-5beac393a516b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=kjmKoHY2bHvhE%2F3Ye30n485EbbK%2FJ6atrQH5ljLqA%2FJud93mZH%2B79X5JNmMWiiDsR%2BQZk8HzbLwVwTOTPagVRE%2BFRod%2FU2%2BRIHh30iqFOLKBsoUFaEfsLb3Jb8DWO2owcimgUzA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b404dbe-FRA
expires
Fri, 25 Jun 2021 06:46:32 GMT
does-drinking-mountain-dew-kill-sperm-1.webp
ncmhcso.org/img/health/
57 KB
58 KB
Image
General
Full URL
https://ncmhcso.org/img/health/does-drinking-mountain-dew-kill-sperm-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
07599490b624400bd1d6241e586826bfb6c647ec679a38b634c090b8ca4df5a0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/does-drinking-mountain-dew-kill-sperm-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
vary
Accept-Encoding
cf-cache-status
EXPIRED
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
58852
cf-request-id
0abf781b7a00004dbede3d9000000001
last-modified
Mon, 29 Mar 2021 12:10:30 GMT
server
cloudflare
etag
"e5e4-5beabc49d5a5b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iW%2BUxXUikD9vQtWrgmTkFdI8%2FYBttlYx4hvLvLR4%2F8ebe6sA3ditDKmmc428QbDgOYSx72fUzcfL0t8jAb1LN2xLu3NcMgRbrP67Gro4We5tNABJvk7gs%2F0uNi%2BHHwJGnm7xz8Q%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b444dbe-FRA
expires
Fri, 25 Jun 2021 06:46:33 GMT
pengertian-biduran-1.webp
ncmhcso.org/img/health-care/
36 KB
37 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/pengertian-biduran-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8451588baf1668bfbd2436a880bb172bd45995b1b1717c621ad0fce66c6c2431
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/pengertian-biduran-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
36830
cf-request-id
0abf781b7b00004dbe8005e000000001
last-modified
Mon, 29 Mar 2021 12:59:43 GMT
server
cloudflare
etag
"8fde-5beac749a5896"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=por3o2wCkQSp7rPiRYVQAyHBZDEATD2siWj7EfOq8BmpWwPOaDCOwuiFvYwyn2uEYQwje2umQoNnXapCcCiRzM%2BKx%2Fv6muuzB940hoD13w%2FcN7PczEV%2BYmBOxUnYCKe88NfKZsU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b464dbe-FRA
expires
Fri, 25 Jun 2021 06:46:33 GMT
whats-the-deal-with-emotional-affairs-1.webp
ncmhcso.org/img/health/
37 KB
38 KB
Image
General
Full URL
https://ncmhcso.org/img/health/whats-the-deal-with-emotional-affairs-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
540f7b2445ec148ae8799eb0a2c71655150085f238c05b705a41cc1110e78071
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/whats-the-deal-with-emotional-affairs-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
38220
cf-request-id
0abf781b7c00004dbeaf22b000000001
last-modified
Mon, 29 Mar 2021 12:45:13 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"954c-5beac40be72c3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bkH8Vh26mPflG9bu3p5avclOLZCF4cATtzh2auhnmolZeRzEqvTHVuskswEBOupdPMMp90yZQjwgexDFVvOhTCJZLpRsDTfdcAtqH2A7XGeZa4jIlLfzD7E0rBD0XysBxHFqCNU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b4d4dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
skal-jeg-vaccineres-mod-rabies-nr-jeg-skal-til-indien
ncmhcso.org/img/healths/
335 B
335 B
Image
General
Full URL
https://ncmhcso.org/img/healths/skal-jeg-vaccineres-mod-rabies-nr-jeg-skal-til-indien
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cffcb70abd2e9d0c7cd49a445c6d3a47d51540fef262470b60d2fb01b6fac11e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/skal-jeg-vaccineres-mod-rabies-nr-jeg-skal-til-indien
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=p1duW1kTIqC%2BIEScZn5jsg8ffo51Rg2uUFNNmlWVKTUAtYBbbdhvfRzbvr3Wep96IT%2FUnk8MjNxKdWvchFdxf6E5gxv3FBdA7JLi56uhfVHK6xaO37OJpTPUp%2FYBHpAD82%2F3WZk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cf-ray
66128fa54b534dbe-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b7d00004dbe83028000000001
5-langkah-yang-perlu-dilakukan-pasca-operasi-caesar-1.webp
ncmhcso.org/img/health-care/
29 KB
30 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/5-langkah-yang-perlu-dilakukan-pasca-operasi-caesar-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af79cc4f5e31ec619606c179a7daa85e8bf93e6612351f9f17dc85d9abc2b01e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/5-langkah-yang-perlu-dilakukan-pasca-operasi-caesar-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
29886
cf-request-id
0abf781b7d00004dbeac853000000001
last-modified
Mon, 29 Mar 2021 12:47:39 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"74be-5beac496f1009"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=r13WbirxZgFdm78R5dnlryN45IRvGTu%2BwKiPCt1SPaAgBgEiUnuRbZkpcCX0RTCVGakCDabnv3GsdX6PS%2BamYMKbxLw%2Bl%2FsR89%2FHLoy%2BgBM75XWPE1KIQSMoPJ9UASrE9UoqX9w%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b574dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
diskus-degeneration-i-ryggen-slidgigt-i-ryggen.webp
ncmhcso.org/img/healths/
23 KB
24 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/diskus-degeneration-i-ryggen-slidgigt-i-ryggen.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be69c01b37e29a140878d078a8714469fb3dbdfba78263786435d7452b797727
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/diskus-degeneration-i-ryggen-slidgigt-i-ryggen.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
23982
cf-request-id
0abf781b7f00004dbe8c8f4000000001
last-modified
Mon, 29 Mar 2021 13:10:41 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"5dae-5beac9bd1a1d5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZPK8k7hlKqi08zY6PvUbrIUS6cRNZtG3s3Bsoi%2Bf5dI5eackONNz4ZFAPQM0DcQ2FykmGcdyWodTdPH1MzMdY4UqlBGiiV1rVdqvLxWohbxgWICFdeZLGZAnmHfxcYN4sNzv79A%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b5b4dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
posterior-tibial-tendon-dysfunction-tibial-nerve-dysfunction.webp
ncmhcso.org/img/health/
41 KB
41 KB
Image
General
Full URL
https://ncmhcso.org/img/health/posterior-tibial-tendon-dysfunction-tibial-nerve-dysfunction.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2dfcce6fc5342373d58c0e96218713014c2295bd79ae21e3c57c65a2c3875089
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/posterior-tibial-tendon-dysfunction-tibial-nerve-dysfunction.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
41564
cf-request-id
0abf781b8100004dbe838ce000000001
last-modified
Mon, 29 Mar 2021 12:27:00 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"a25c-5beabff953d70"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=BTYOet%2BNQxE30pXBSNHj%2FHPzQs7ol0PQpTBpy9Xmr8rdx3Qb7BrZtrJLCEDr7CKzbBZ%2BQiBRaI0JnuW0EZUcvz2ezYudzhqMmfg2vqnCfVhJquX1byYvkFnf9JTyxaHOj0cSJmM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b674dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
growth-retardation-delayed-growth.webp
ncmhcso.org/img/health/
8 KB
9 KB
Image
General
Full URL
https://ncmhcso.org/img/health/growth-retardation-delayed-growth.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e62e6cf03b26f76f222534b9cf2b117416bd6ab63155b4c75082ac4f85f8f885
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/growth-retardation-delayed-growth.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
8450
cf-request-id
0abf781b8100004dbe8005f000000001
last-modified
Mon, 29 Mar 2021 12:14:42 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"2102-5beabd39cd1f8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=M0r1vYqq1IqsvUcIO5M7m7dgyqoZfW%2F9jCBAJUNwaV5M5Huoy8em9SUadmArpvZYhvaQ6YzY%2Bfk%2FqsmG3iUYMySpmhsKOyDn3rIkRkrliLQvO0PdJJ9kbwPzpyB%2FCKILNLlmtlI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b6b4dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
vitrectomy.webp
ncmhcso.org/img/health/
53 KB
54 KB
Image
General
Full URL
https://ncmhcso.org/img/health/vitrectomy.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ae6e6ff4c4401db42e1390127d2c3f9091c040e9da9951ceefb732b8a9dfffb
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/vitrectomy.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
54592
cf-request-id
0abf781b8200004dbe73067000000001
last-modified
Mon, 29 Mar 2021 12:38:00 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"d540-5beac26f47fb0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZGpc2bvBQCrGw1Ykf7gx8pCydXaf5FBxVuwZIkbmG52AnOXzWEjyKOPbM17oWAykErBwJ8S5IspYEoRVEQi0sGB1c%2F86Mu43oB%2FF3b3h9pe6iyirre7Th2fuAIzCU1C0Q15I4r8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b704dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
could-your-severe-pms-be-pmdd-1.webp
ncmhcso.org/img/health/
19 KB
19 KB
Image
General
Full URL
https://ncmhcso.org/img/health/could-your-severe-pms-be-pmdd-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
089be99a4be890d7b3eb928e17be081522aa228825e3724114cd820f9388d918
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/could-your-severe-pms-be-pmdd-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
18948
cf-request-id
0abf781b8300004dbecebe6000000001
last-modified
Mon, 29 Mar 2021 12:09:32 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"4a04-5beabc12013b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GXiAShwbW403bDM%2Fs7%2FKItGi3YbMHd1pB5u93TD2rbBeuUzJRc%2FKqCe%2FIqk2XHU%2F%2FydIvPHzIDZkFD3XnpY1xqriA2FHA0orGSPpgSAW%2FNcHYsAaDs3oOcGeTtNZtmoNPqh6TpA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b724dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
manfaat-pijat-payudara-setelah-melahirkan-1.webp
ncmhcso.org/img/health-care/
28 KB
29 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/manfaat-pijat-payudara-setelah-melahirkan-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8980459ddd1cffbe1aad115aeb932535bd1833ed712ce73f83add43dc4a068e3
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/manfaat-pijat-payudara-setelah-melahirkan-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
28574
cf-request-id
0abf781b8300004dbe753ac000000001
last-modified
Mon, 29 Mar 2021 12:57:39 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"6f9e-5beac6d348de1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=g8%2BYSY3dqV4KtCN1xnH6aNtrKWEUse5nHLZp%2B9eBVdre81uLX78hKZ1Bdp5vcenA%2BR96EU0wP%2BXbS3vUcqKRi2wPh9HyJKx%2FO1oRn4xK%2FPoCNh%2FLBDJlWnyL08%2F9rCTBH9uTSRc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b764dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
the-best-stethoscopes-and-how-to-choose-7.webp
ncmhcso.org/img/health/
22 KB
22 KB
Image
General
Full URL
https://ncmhcso.org/img/health/the-best-stethoscopes-and-how-to-choose-7.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe415f92f03acf72bf24f9b7e4a00011fd2a579adf046dd11679ed0ce383240a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health/the-best-stethoscopes-and-how-to-choose-7.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
22120
cf-request-id
0abf781b8400004dbe71a9b000000001
last-modified
Mon, 29 Mar 2021 12:32:38 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"5668-5beac13beb2d1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2F1N47u05oEgoP1yGGv3oXY5BKXYxL7ML4c7T2pkSJpvUxiLmNH1%2FZB82S2FjJBRWfz0Vf5y4KH4kcGJ%2BBMsyy04nvrZcMgNpy420atabHurf9vuBZ%2FBxqBmz%2Bc7xvJUmRrSMhWE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b794dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
nyt-fra-netdoktor.webp
ncmhcso.org/img/healths/
31 KB
32 KB
Image
General
Full URL
https://ncmhcso.org/img/healths/nyt-fra-netdoktor.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5c3ec736b7f9e61a32614127b05b952a269ad02ad3af342ab779df1a847a397
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/healths/nyt-fra-netdoktor.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6425
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
31938
cf-request-id
0abf781b8600004dbed833a000000001
last-modified
Mon, 29 Mar 2021 13:18:41 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"7cc2-5beacb86832c6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ahol0pF1DzcSZg03mWsSkTIvfv%2BQ%2F5AxED1xOwXA8XGB5CyuVVpbWQJHVmeG57HYN4VJcRik9%2FNp%2F2uR6WLX8LaXh8FUupDuFsaDW3xddeUzAm5tuml8vjAogGS7LvVU16Cgl7g%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa54b814dbe-FRA
expires
Fri, 25 Jun 2021 04:59:27 GMT
ketika-anak-demam-tinggi-orang-tua-sebaiknya-jangan-panik-1.webp
ncmhcso.org/img/health-care/
21 KB
21 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/ketika-anak-demam-tinggi-orang-tua-sebaiknya-jangan-panik-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
695cc4316d3c90325361db545d2985a492b17a59e1cec0fa7880bc6b68fb3b25
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/ketika-anak-demam-tinggi-orang-tua-sebaiknya-jangan-panik-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1333
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
21112
cf-request-id
0abf781b8900004dbeaa121000000001
last-modified
Mon, 29 Mar 2021 12:56:44 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"5278-5beac69eaac17"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=sNVbZTxoqQm7YVSulOahalSoDQljZ%2F6risjAyi1Hb9fNPh8XIHMFT1Qq%2FyfksbVDzGgxhJfkUT3qQ%2B%2FViFaxUlt%2FJ324%2BzS23MpGmhW7B84nn%2BianJnOB%2B48Wiy7TWFsK1M97rc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa5ab9f4dbe-FRA
expires
Fri, 25 Jun 2021 06:24:19 GMT
scripts.js
ncmhcso.org/template/rubik/js/
14 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/scripts.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/scripts.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b4f00004dbee31bd000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3868-5beacd6e2e8a3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=piwfcN2%2B63OTRTLxs7dUHoXLDV1pfkhIusJiRWbUiHE21ErHmXmRQajbdOxON9Kwf%2BObydgAqijNfkXcFvUN%2FLVQz415tRkpQwhMa1%2B6EbCihQs1nZYtACVkVefBmD4QcH49o3w%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a5e4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
shortcode.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/shortcode.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4433ff0f49844a27a31acc576d573f17fcff11480ff4c8abf0d17576dc4ffa17
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/shortcode.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b4f00004dbecebe0000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"625-5beacd6e384e4-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ldWUjnCUlktM5CIFKomvv2uvovWdJwInhpoosWzwxEkxWcI4aBouTnEmp327XC78uIrgYlzeCYay%2BlvggBn9m%2FyfaUJD76ZdBDN0GbVgqhgNwO57AKvMuTC3fw%2FJz6uI%2BW%2FraXA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a604dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
widget.min.js
ncmhcso.org/template/rubik/js/
7 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/widget.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38a448e9e03a9f64e7611b19af4bb8ec97fde2c708dc57ebbc7701be7ae3af08
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/widget.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b4f00004dbe9024f000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1afc-5beacd6e48e86-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VQ46NVFGd5R%2FkKycKIQGw0TyJY0buCnxrbYLPutjMmeQTYGkTVPb5tvsj2DHQr7qWPFeGmqgIVlvBdFvhk%2BzheyJpuyylptIIMnHVSganV1mihN05P8eE%2Bik0GyQAy9SUdYb32c%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a634dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
core.min.js
ncmhcso.org/template/rubik/js/
4 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/core.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/core.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5000004dbe9d114000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"fa0-5beacd6d1d183-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=6oQ2taXFLGoQNk3yklRa%2FM2bHzG1JG2n3Chh5savJoEHroiRjalH3AbpmUIb01fGdYtIXfAXOh5KwPIET9XcCTw57B34U3cFvXwP8U5iFr0kaIH%2Bne1LeGJJmLy1gAaY2WFe1YE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a644dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
tabs.min.js
ncmhcso.org/template/rubik/js/
12 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/tabs.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
429f6b7a5802c15145bddd69b400dae34b814eebd42ea1a32934c9a55a159391
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/tabs.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5000004dbebbb50000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2f4e-5beacd6e4bd66-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=C9d%2B8aXNEPbkoypbq4xLEzpL3973clHReZlT7%2FHtyidwJaS2GNCjCPh%2BLQJcPjb0HMs5%2BVLyAH74HaJZXraDUFxyWTsEfLFHtbJLo94Ly%2BfUPcGspsaGobBrVKlRoIwg1flUlGc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a654dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
accordion.min.js
ncmhcso.org/template/rubik/js/
8 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/accordion.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbde0ea9c50274448afdee811988867d3579169daff16b64bcb99ad1ee10905f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/accordion.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5000004dbeb92c9000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"2188-5beacd6d2db25-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=auzEDTctWuq2lBurwVyV4WglcAFd4CxrxfpAwaPWMrUQV5jcsESIGWmAhVQbGxAYWFUMq9jga4e%2Bzn5UJZ0IKhmeU6uv65VoPMxgXtsIxyOAq0H03zHMgSAkONoKv%2F5g531n9tc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a664dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
imagesloaded.min.js
ncmhcso.org/template/rubik/js/
8 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/imagesloaded.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
854d677b850907cd851eac7e3f02f05a1e056f05bd5563199c5d93044ff16840
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/imagesloaded.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5900004dbee31be000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1f3a-5beacd6da1e93-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=gMqf8xVjctCu48ZoWm6hQGbzyxjiNCXAc0QsOOu1nxTF4ruQ1z%2F0yX9F7Ei2oFE2R7vIq5zwrZJ114dH4Se9nSmWKTQjw4JY2EZhBn4iORMZn6GxUaMiSmlE5lVfE7xtPmc0LBI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a694dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
masonry.min.js
ncmhcso.org/template/rubik/js/
28 KB
9 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/masonry.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ca3e467b7d4d6b403aa4619019d9250b11449c8ee9c91c90bcbc9acdd64fea2
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/masonry.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5a00004dbeaa11c000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"711a-5beacd6df7d9c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=YrvyQ%2FX7RW6vAXaARJUyl0bk4Pio1sP2%2Fteem1K%2FgVub%2BYyqyRSpFoTPB%2BFayuvp35G4iE0lfTtMzoBQ2tDZUtq92gBoGayjLi3T0Sloxgn5qj4EY%2BaX4fve%2Fo5R0vQBmfbm%2B8w%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a954dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.masonry.min.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.masonry.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.masonry.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5a00004dbeb6259000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"71b-5beacd6dd1c38-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GOLod59ZRywXRsnef5gUlUHa6e9glGtWXNg%2FyxEsUhIhUvW%2BJTnmgHUfxNXD2Ywr9ysuc%2BMg7BzWaIA2MnYqvI5ALYHTph9gcIM%2FyjF4Yl6qRArgQkzvhZb1C6SiGiinv86%2B15s%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a984dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
cookie.min.js
ncmhcso.org/template/rubik/js/
2 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/cookie.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfdbae14960ab90f96810eb628e6115a85d20927e6c487007b5c1dff13a4268c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/cookie.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5b00004dbe73060000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"866-5beacd6d2eac5-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SDqFkSA4v%2FORsx5uzNLV0RPc4C1VTCA54ogaMn4oia9lMudPh23m0HKUPm%2FZNssK24kd%2BauHc%2BG2yYyMWIYp5P7ecJE6eQhqnnPsXKo2POBRzagQJX3AvJ%2Bhj%2F%2B7PKSNCbZnjRY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a9a4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.flexslider.js
ncmhcso.org/template/rubik/js/
55 KB
12 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.flexslider.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e7a1412730fc4c5b0f5722472d217ec2e106e0756fe6d97a37b0ea89db35960
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.flexslider.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5b00004dbec2a21000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"dbfe-5beacd6db1894-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=e9bovukBhmO3EPBxzz0GAcP34Oo3YMlI6eBhGw7nPU77bGRvaVkcBAXv0dTsnIYXJr5%2FSMXK1ophV9Qus6n3MKfp1ZGnjJpGE7WmtDnR%2BKBON0q8uBSqr2hNudvEOpLJkmEJa%2FI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54a9d4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
froogaloop2.min.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/froogaloop2.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc46f44565a092c856a6d70471d942caca57598049a85ce80366c1c5831d0f3e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/froogaloop2.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5c00004dbeaf228000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"6e9-5beacd6d943d1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=guUYc2ZAZZRrpbqwrrPdhCaHbrSmklzk%2BINs9ld9UHTbfEmg8e3c2gLRe4Y1FuMmNSD00iSqEGRmTYFMq04%2BOWglhKcBJpaksgYCEml2UxK5O6f17Ddkm0knf9Tzh7d25v3%2FDKo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54aa04dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
modernizr.custom.26633.js
ncmhcso.org/template/rubik/js/
9 KB
4 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/modernizr.custom.26633.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc621afdf972c39066502aeed507c2cd0752f0cec9c932224fae97cc2a1d10a5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/modernizr.custom.26633.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5d00004dbe90251000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"24e7-5beacd6df9cdd-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bGSrcnnMF%2BVRH9%2BVytS3PzS1FqZqzDWuzoY7UgFvfQhUdbRaZ7hVzPWKz8r5fHVUEsqFCdwmZ1HDErGZMft4q3jDIqx7J4O20GBDCZUeUjbgGWffbe0CKIA7BlT2U4p37y8ona4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54aac4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
justifiedgallery.js
ncmhcso.org/template/rubik/js/
0
0
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/justifiedgallery.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/justifiedgallery.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
91
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6100004dbee2016000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0RLKQZYSY4CgXFWI3e2nWTksLbGyLvc1pvfZQ%2BOSYEJwK5ZXeFv638ZevmwGstL0%2BwDynC6Sxu3K5ToNpVF7YT73Fp%2F5DSZMrUa06dtwfQ9CZU0L80P47O%2Bo1sNrccX4yal6gUw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ab24dbe-FRA
jquery.magnific-popup.min.js
ncmhcso.org/template/rubik/js/
20 KB
8 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.magnific-popup.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ef35581d56516af9c0a792f09316bda2494a5f497edf5de30e6ab74052bc380
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.magnific-popup.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6200004dbede3d6000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"51d3-5beacd6e18140-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=J5Q87Ub1B5b6OFD4ow1v0KXB6gLkvrnoG61BAgT2PHWNaK7q8G5r3G79E0QQLF7yztqN4ogh6WFQAT9uN8iqLfOO53yMkrgfG9%2BwC%2BVPF5eK%2BdSeWn6jMbWy%2B9y2nyR9J5XQvYg%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ac74dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.fitvids.js
ncmhcso.org/template/rubik/js/
3 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.fitvids.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0d5f91a5430829df5638fa69b85a6e361876d5499744cc724d01c342d944a75
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.fitvids.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6300004dbe981bd000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"cbe-5beacd6d7ad8e-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=bLJ64B40ZcL6oqOaPInuomzWOWSiL59Z7tgIQs%2BVSfI59k8CeHTgbrq10sCT8T%2BVFalZlxXUkGb%2FTg2YRpyA8r8RyUi1%2FHWet%2F3jTz8zh1yNu8LOCOyRb3NFD6bIVdwjbGL5PzI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54aca4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery.fs.tipper.js
ncmhcso.org/template/rubik/js/
7 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery.fs.tipper.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fb666fd52dd0d79bf7fffcacac8e560df56ed197509545f314269c7d44d4183
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery.fs.tipper.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6400004dbe838ca000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1b0f-5beacd6d8a790-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=UxnJgZ7BQjKwB%2BkclLDUZFgCPEc8SHtAQepEC1AlNUAzVwuIho2r1LSyokAUuS9vljcMVHFrAqdrjiVoPktt20pqkO4dGPnsXWNlsRdDjt%2B5TMrSsIHgW4F7dZXlsIjgPnz8UZg%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54acc4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
slick.js
ncmhcso.org/template/rubik/js/
36 KB
9 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/slick.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e5baf1d366ed7dc7fce4e7dbca6245c0b7ef74e8d3a6cd6ae7641e725c5024e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/slick.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6400004dbe7d805000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"8ea5-5beacd6e50b87-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=aPFB179JB8FM6EdMbhmoZEMbxU7YQmhK0wVFkvgT72RzULfPcJvPxNVgjji6MpfwNQFg0EXD9SAcZcq07BMIX6hvNT6a6Ge6noOeYXBEkz%2BdMhVwudmyOYgqYv%2FVQHQqdJhDoMM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ad04dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
jquery-news-ticker.js
ncmhcso.org/template/rubik/js/
7 KB
3 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/jquery-news-ticker.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab9df2bccffeb373df3ec6f8c10d1e229a7a05770637875f018673cc9318d3ac
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/jquery-news-ticker.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1368
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6500004dbe931bf000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"1d36-5beacd6dd79f9-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hX7JzTsP6O3oxPekXM%2BLdcfWjSNCgqBtjOT66N6%2Fch5GgBtm0yQrlRf2sK9QZxaqkFPrKQOZBoS48TMIiS9l8nzA2NAoMNsXdQEUq1mU7CDr5jVgzo4Jm9rsYLoq14mW87FS6ew%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ad24dbe-FRA
expires
Fri, 02 Jul 2021 06:23:44 GMT
onviewport.js
ncmhcso.org/template/rubik/js/
4 KB
2 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/onviewport.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8254c9521e087388e9bf4ffe934db413d93a10140e77e7931595fa191bd4aed7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/onviewport.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6500004dbee31c0000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"ffe-5beacd6e190e0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=A3WIlJetf940pc3DoMp6BI6ZCCU9s1gH5sf6iYRbwHTr9zw3qGTk9wTXCg697IZbQ54Y5PnfKuomJ4ar8fyHgyoi46eBKlyZiLzCLVy%2B4%2FwWUek8bFsI%2Fd%2BA2cKehsp7nP0%2FlRs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ad64dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
module-load-post.js
ncmhcso.org/template/rubik/js/
72 KB
7 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/module-load-post.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7cc10d6b929d18973c7eda0205c914669edbd44cad3e656a5737d3dde64ad0f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/module-load-post.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6600004dbed8335000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"11f55-5beacd6e2e8a3-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FuNDiK7smJDUL3XWLF53KdGpHTrbf09Q1WPwGL9RhPnxl3nlOgJ68t1jXCDBVuynjMHZGYkaYMizoWdj6aWUuKM211lAc5z9J5lgJaL%2FkvQqUhVCkjA%2F8PZteGWweanxCweB%2Frs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ad84dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
menu.js
ncmhcso.org/template/rubik/js/
3 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/menu.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6085301708c5091aa3bd00ca313d09f08a1ea02926745978796ce6b433b03ba
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/menu.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6600004dbecf846000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"a8b-5beacd6ded1bb-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vqnkyHK3nsbm9tVrdvKxMcVlO35QfVNAmVMHRwv4ZpK9BIIUJ13utblAdxZ7VUclPhiUS4BQ5A7Z8N14hb5cpyf1I5o5xsu58c%2Bs5KQwUBgElZ8%2Bb6maFcGy4RXQR1B%2BjjsWtmA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ada4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
playlist.js
ncmhcso.org/template/rubik/js/
2 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/playlist.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09961140c12f8d7e4b768fe77f20560945ccf4b92be9ca816369d51f502af9cf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/playlist.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6700004dbee595a000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"68e-5beacd6e20de1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=vICX9OGppWrTCzfWYdqM%2B5NFwO2aBbD%2FTJzUrO%2FtHqs9%2FNP6jfVkOu13IJegyEZ%2BcOvoXgo9g5nqtHTxo%2B5OPNnBHwbF2V%2Bf%2BWCGYs%2B%2By4PfjqaPR%2BdaHMqRizuDHBMz1Xc9b3s%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ade4dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
customjs.js
ncmhcso.org/template/rubik/js/
39 KB
7 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/customjs.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
83620fc89fc1d579db7168aab01b0b8ad43bc46590a2de59d7fda09e8564f9cf
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/customjs.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6700004dbe90252000000001
last-modified
Mon, 29 Mar 2021 13:27:11 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"9d5b-5beacd6d972b1-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=N57b07tmVf0P%2BItP%2BJAWuCKqmGkTa9guDixNrbTkbUpx53NFd4anoqXzE6YQysinDhXd1HI06xHsvvn1hJyucnJw1PlcrIsn5a6U8kmSvwsq4CozXKgHFeYAWIAimHYrHQGpSVk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ae24dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
wp-embed.min.js
ncmhcso.org/template/rubik/js/
1 KB
1 KB
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/wp-embed.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/wp-embed.min.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
119771
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b6800004dbea23a7000000001
last-modified
Mon, 29 Mar 2021 13:27:12 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"57b-5beacd6e6b16a-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=2hh3XtVO18fQkvYtrc9GWCIib1eg5GKEu6CnsUyHzUIizio1KIrigXh2czH5xcXBw4CY0jdB%2B%2BZ9aDHKseeUgvzk8or%2BGyfLkwwp6Qxz1FbfiUKUDPtPHKQTZZrvqTjPqqfwR2A%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa54ae44dbe-FRA
expires
Wed, 30 Jun 2021 21:30:21 GMT
cookieconsent.min.js
cdn.jsdelivr.net/npm/cookieconsent@3/build/
20 KB
7 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/cookieconsent@3/build/cookieconsent.min.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
43005
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781b5a00004a9d11a41000000001
x-served-by
cache-fra19140-FRA
timing-allow-origin
*
server
cloudflare
etag
W/"50d5-nLraS9YXyGxjjPLr3exyStWWkHs"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
66128fa55d014a9d-FRA
kmKiZrc3Hgbbcjq75U4uslyuy4kn0qviTgY3KcA.woff2
fonts.gstatic.com/s/librebaskerville/v9/
27 KB
27 KB
Font
General
Full URL
https://fonts.gstatic.com/s/librebaskerville/v9/kmKiZrc3Hgbbcjq75U4uslyuy4kn0qviTgY3KcA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2ca57650e9d1881e382bd324039937317b18e44fd5fadab6d09018d426a2622a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ncmhcso.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 06:24:42 GMT
x-content-type-options
nosniff
age
519710
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27932
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:02:29 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 06:24:42 GMT
EJRVQgYoZZY2vCFuvAFWzr8.woff2
fonts.gstatic.com/s/ptserif/v12/
32 KB
32 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ptserif/v12/EJRVQgYoZZY2vCFuvAFWzr8.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ef391572f9fbb7bab7fef6ce2c4fc92ad68a8c148889a79cb9f9b1452d851fab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ncmhcso.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 12:13:20 GMT
x-content-type-options
nosniff
age
498792
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32960
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:06:03 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 12:13:20 GMT
EJRSQgYoZZY2vCFuvAnt66qSVys.woff2
fonts.gstatic.com/s/ptserif/v12/
29 KB
29 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ptserif/v12/EJRSQgYoZZY2vCFuvAnt66qSVys.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville%3A400%2C700%2C400italic%7COpen+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CPT+Serif%3A400%2C700%2C400italic%2C700italic&ver=1549941966
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e548abcd8734bfcf8b4ebbbca1af98f9e8ae1e0ff884c0971f29498a4fc108f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://ncmhcso.org
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 05:05:29 GMT
x-content-type-options
nosniff
age
524463
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29400
x-xss-protection
0
last-modified
Thu, 10 Sep 2020 17:05:20 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 05:05:29 GMT
berbagai-kemungkinan-penyebab-anak-tunagrahita-dan-ciri-cirinya-1.webp
ncmhcso.org/img/health-care/
43 KB
43 KB
Image
General
Full URL
https://ncmhcso.org/img/health-care/berbagai-kemungkinan-penyebab-anak-tunagrahita-dan-ciri-cirinya-1.webp
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e571ca97d08aed616229516a85ebbe298ede274bca3256afd9357c73a2e5010a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/img/health-care/berbagai-kemungkinan-penyebab-anak-tunagrahita-dan-ciri-cirinya-1.webp
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43660
cf-request-id
0abf781b8900004dbeaf22d000000001
last-modified
Mon, 29 Mar 2021 12:49:58 GMT
server
cloudflare
etag
"aa8c-5beac51c1ade6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=qJpBQKaoHyQpQJyU0TOH9b9xOxG5dWcLQCyw9fEQ%2B0a%2Fw%2BvA2vX7nVFOa%2FUzVN2Y%2Fnxr12h2FU4cfmAf4pvCAZzs7OmEXDHBC2anwAuN4H72sd8FTfLDK6%2BrJrtgac3CTlDd0gM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa5aba74dbe-FRA
expires
Fri, 25 Jun 2021 06:46:33 GMT
fontawesome-webfont.woff2
ncmhcso.org/template/rubik/css/
75 KB
76 KB
Font
General
Full URL
https://ncmhcso.org/template/rubik/css/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/css/fontawesome-webfont.woff2?v=4.7.0
pragma
no-cache
origin
https://ncmhcso.org
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
font
:authority
ncmhcso.org
referer
https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://ncmhcso.org
Referer
https://ncmhcso.org/template/rubik/css/font-awesome.min.css?ver=5.0.6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
112129
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
77160
cf-request-id
0abf781b8a00004dbea72c7000000001
last-modified
Mon, 29 Mar 2021 13:27:06 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
etag
"12d68-5beacd689eabe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HL7ZWxTL4v%2FczprA%2F5nA3IDxvhKLKhf77SDFTaHc34C698D7aRqb3ie4%2FSR%2BjMXc8BRrJ9vOyf4Px2UZ5VynU04s4dn9qsMqqe0%2BL4nWVOhze8Lv0Iso9wQIMbtKTmIqtCqnpCY%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
accept-ranges
bytes
cf-ray
66128fa5abab4dbe-FRA
expires
Wed, 23 Jun 2021 23:37:43 GMT
1788
na.nawpush.com/tags/
241 B
363 B
XHR
General
Full URL
https://na.nawpush.com/tags/1788
Requested by
Host: cst.cstwpush.com
URL: https://cst.cstwpush.com/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.18.0 /
Resource Hash
850ebe5afa86a299ed655f0dd371f0bb4c80e38b73d855edf5139c3475f0d7f0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 18 Jun 2021 06:46:32 GMT
cache-control
max-age=300, public
content-type
text/plain; charset=utf-8
server
nginx/1.18.0
content-encoding
gzip
x-proxy-cache
HIT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20210616/r20190131/ Frame 33D1
10 KB
5 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20210616/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20210616/r20190131/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 19:02:37 GMT
expires
Thu, 01 Jul 2021 19:02:37 GMT
content-type
text/html; charset=UTF-8
etag
15579341980913220427
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
4579
x-xss-protection
0
age
42235
cache-control
public, max-age=1209600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
stat.optad360.mgr.consensu.org/
20 B
286 B
XHR
General
Full URL
https://stat.optad360.mgr.consensu.org/
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
18.196.233.38 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-233-38.eu-central-1.compute.amazonaws.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
e596a6cc17f525e0707049608e73975baa5474e82c932c8b60fa11a718617140

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 18 Jun 2021 06:46:32 GMT
Content-Encoding
gzip
Server
nginx/1.14.0 (Ubuntu)
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
gpt.js
securepubads.g.doubleclick.net/tag/js/
62 KB
21 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
sffe /
Resource Hash
aa7ad08dddb3da63c9512897e1918a62f8fa96268d92fa1c3c2b4edbf4014686
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"905 / 297 of 1000 / last-modified: 1623971959"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21461
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:32 GMT
prebid4.10.1.js
get.optad360.io/sf/
380 KB
381 KB
Script
General
Full URL
https://get.optad360.io/sf/prebid4.10.1.js
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:8e00:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b961bb522a21c8710fa523ee1b97d3ae8880606088e221a08525621d54b014ca

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 21 Feb 2021 06:36:28 GMT
via
1.1 a32f966fc5896281eb3de44fd8f57d40.cloudfront.net (CloudFront)
last-modified
Tue, 20 Oct 2020 11:44:25 GMT
server
AmazonS3
age
10109405
etag
"8b3682ab6cf8d8156745869486e3291e"
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=31556926
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
389196
x-amz-cf-id
NVgGmaltA1lGfCwwbWt896RvNsSlZSD-yK7SmFFTD1L60jgo9QZ1lg==
1.jpg
allthebestsofts.com/rubik-times/wp-content/uploads/2018/06/
52 KB
53 KB
Image
General
Full URL
https://allthebestsofts.com/rubik-times/wp-content/uploads/2018/06/1.jpg
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.121.248 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium68-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
7733e901ce4639c446a06c89071cca31e57b494ca45e1b25ef1c523caf6e4083

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
last-modified
Mon, 14 Jan 2019 04:29:04 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
53756
expires
Fri, 25 Jun 2021 06:46:37 GMT
csub.js
js.wpushsdk.com/npc/sdk/wpu/
6 KB
3 KB
Script
General
Full URL
https://js.wpushsdk.com/npc/sdk/wpu/csub.js
Requested by
Host: cst.cstwpush.com
URL: https://cst.cstwpush.com/static/adManager.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.16.1 / PHP/7.1.28
Resource Hash
240f2fa6d9c547702519223d888610d5517255aa52ad0c04d86f0ec6d0ab76d6

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
gzip
server
nginx/1.16.1
x-powered-by
PHP/7.1.28
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
expires
Fri, 18 Jun 2021 07:46:32 GMT
cache-control
max-age=3600
x-proxy-cache
HIT
justifiedgallery.js
ncmhcso.org/template/rubik/js/
0
0
Script
General
Full URL
https://ncmhcso.org/template/rubik/js/justifiedgallery.js
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::ac43:d657 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:path
/template/rubik/js/justifiedgallery.js
pragma
no-cache
cookie
__oagr=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ncmhcso.org
referer
https://ncmhcso.org/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
91
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781d0e00004dbebe35b000000001
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cNFne8VDYLb6G02eseE5A6bGD8Pawj1SOcB4Ad6XzwR6dsLCqxNoDhDHv1aNpayDF8pLh6HZQpwnUtffpYN3BEXg2IpxVRwWdjp26noQP3nnw9zfbKiUJ20wkzsdyJxFATlS0aE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=2678400
cf-ray
66128fa81a074dbe-FRA
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9308._pRA-Qp5HRl8X6t2YAbro8s0pPK_Zwh9U1uH4qRcf_5yQZn2TzyGC_NcOAEcm_cK.KFWP3_sA9zgkTzGrZQpBFm3gCPw%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9308.dqeMWlL31peyaI6qcauzu6-RqtcGGjxmvNJ7-dTfhWzGNiLrDJpaZqiPsSUhD7H4UAjX1HpOv1lIRrZD6AldRQ%2C%2C.T9k0IHmZxqZvq0aUGGaW15TikzA%2C
75 B
75 B
Image
General
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9308.dqeMWlL31peyaI6qcauzu6-RqtcGGjxmvNJ7-dTfhWzGNiLrDJpaZqiPsSUhD7H4UAjX1HpOv1lIRrZD6AldRQ%2C%2C.T9k0IHmZxqZvq0aUGGaW15TikzA%2C
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9308.dqeMWlL31peyaI6qcauzu6-RqtcGGjxmvNJ7-dTfhWzGNiLrDJpaZqiPsSUhD7H4UAjX1HpOv1lIRrZD6AldRQ%2C%2C.T9k0IHmZxqZvq0aUGGaW15TikzA%2C
date
Fri, 18 Jun 2021 06:46:33 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
abs.js
cdn.zx-adnet.com/adx/
200 B
255 B
Script
General
Full URL
https://cdn.zx-adnet.com/adx/abs.js?
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9be45d830a633e050edaa82361e4ecac3cc189b3a3975a41aa01ae3cb4e4120b
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998793.037221,VS0,VE175
etag
"437b8edcf8ac42ac5e7961966dea7cee69a38a82519efa00f6f37a753caad24c-br"
x-served-by
cache-fra19142-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600,public
date
Fri, 18 Jun 2021 06:46:33 GMT
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive
content-length
118
x-cache-hits
0
advert.gif
mc.yandex.com/metrika/
43 B
136 B
Image
General
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
last-modified
Thu, 17 Jun 2021 09:26:05 GMT
etag
"60bf3bc8-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Fri, 18 Jun 2021 07:46:33 GMT
pubads_impl_2021061503.js
securepubads.g.doubleclick.net/gpt/
325 KB
114 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
sffe /
Resource Hash
408abc3a5bedff37056ecb1ba4872225de8a269ffe9aa04fd8fd38a7e7ec5116
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 15 Jun 2021 21:10:23 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
116743
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:33 GMT
latest.json
cdn.jsdelivr.net/gh/prebid/currency-file@1/
2 KB
1 KB
XHR
General
Full URL
https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20210618
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid4.10.1.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49894b52d15fdca5393109cc22008f85b6eaba81d87686597e602a466932f71a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
13495
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf781da000004de8c3265000000001
x-served-by
cache-fra19151-FRA
timing-allow-origin
*
server
cloudflare
etag
W/"699-4F08GFbexTqglNeGGXgoiYOTyXk"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
66128fa8f8e14de8-FRA
integrator.js
adservice.google.de/adsid/
107 B
165 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
165 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
86 KB
27 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=121764058%2Cncmhcso.org_SF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C750x100%7C970x90&cookie_enabled=1&bc=31&abxe=1&lmt=1623998793&dt=1623998793183&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1200&adks=2594827412&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1&msz=728x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=640&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
2d664ebbe5f126cc0507bab837a6f736b9ab3a219b5aeb99a213305ae23973df
Security Headers
Name Value
Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLaPv_nKoPECFUYL4AodW38A9w&gqi=&layout=/sadbundle/%24csp%253Der3%24/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CLaPv_nKoPECFUYL4AodW38A9w&gqi=&layout=/sadbundle/%24csp%253Der3%24/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
content-encoding
br
x-content-type-options
nosniff
google-creative-id
-1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27993
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
date
Fri, 18 Jun 2021 06:46:33 GMT
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/
0
0
Other
General
Full URL
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

1
mc.yandex.com/watch/68669068/
Redirect Chain
  • https://mc.yandex.com/watch/68669068?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A265%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-U...
  • https://mc.yandex.com/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A265%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen...
184 B
266 B
XHR
General
Full URL
https://mc.yandex.com/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A265%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A1122216682099%3Ahid%3A608800334%3Az%3A120%3Ai%3A20210618084632%3Aet%3A1623998793%3Ac%3A1%3Arn%3A467724967%3Au%3A1623998793655043633%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1623998792298%3Ads%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1623998793%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
5d7cc259e704335896d08543304ae31eeaf36f735cdf5e0767d4a4e78e62e0ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:33 GMT
x-content-type-options
nosniff
last-modified
Fri, 18-Jun-2021 06:46:33 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://ncmhcso.org
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
184
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:33 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:33 GMT
last-modified
Fri, 18-Jun-2021 06:46:33 GMT
location
/watch/68669068/1?wmode=7&page-url=https%3A%2F%2Fncmhcso.org%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3Alvg2sn1re62lx62l%3Afp%3A265%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A562%3Acn%3A1%3Adp%3A0%3Als%3A1122216682099%3Ahid%3A608800334%3Az%3A120%3Ai%3A20210618084632%3Aet%3A1623998793%3Ac%3A1%3Arn%3A467724967%3Au%3A1623998793655043633%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1623998792298%3Ads%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Adsn%3A0%2C18%2C50%2C1%2C51%2C0%2C%2C%2C%2C%2C%2C%2C%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1623998793%3At%3AMedizinische%20Informationen%2C%20Die%20Sie%20Vertrauen%20K%C3%B6nnen%20-%20ncmhcso
strict-transport-security
max-age=31536000
access-control-allow-origin
https://ncmhcso.org
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:33 GMT
checkabuse
cdn.zx-adnet.com/
70 B
375 B
Script
General
Full URL
https://cdn.zx-adnet.com/checkabuse?surl=https://ncmhcso.org/
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/abs.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Google Frontend / Express
Resource Hash
cc7cc67c9a20cdb365cee019afd88e150a17a99f8984fe2ab6be0aa10e031ebd

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
gzip
x-powered-by
Express
x-cache
MISS
content-length
81
x-served-by
cache-fra19142-FRA
server
Google Frontend
x-timer
S1623998793.236475,VS0,VE160
etag
W/"46-EvbgeHJd39XoipOEZOe1/kP8fRE"
vary
cookie,need-authorization, x-fh-requested-host, accept-encoding
content-type
text/html; charset=utf-8
x-cloud-trace-context
883e7a7649aa3eb949d57fa3a769d1cf
cache-control
max-age=3600,public
function-execution-id
ytv40nm80ofq
accept-ranges
bytes
x-orig-accept-language
en-US
x-country-code
DE
x-cache-hits
0
container.html
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E76C
6 KB
3 KB
Document
General
Full URL
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
:scheme
https
:path
/safeframe/1-0-38/html/container.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
3108
date
Fri, 18 Jun 2021 06:46:33 GMT
expires
Sat, 18 Jun 2022 06:46:33 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, immutable, max-age=31536000
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
osd.js
www.googletagservices.com/activeview/js/current/
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3d2fb5e2edecc03632d4232f8956dfc6cea25557cdd082cab892d00f2769bc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842926269324"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28241
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:33 GMT
index.html
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/ Frame 855B
70 KB
42 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7190fc6eb38bde20e78e2fe2c6b7629bb347768d193b52d9440e8270e40766e3
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-type
text/html
access-control-allow-origin
*
content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
date
Sat, 12 Jun 2021 08:20:20 GMT
expires
Sun, 12 Jun 2022 08:20:20 GMT
last-modified
Sat, 17 Apr 2021 14:37:36 GMT
x-content-type-options
nosniff
x-dns-prefetch-control
off
content-encoding
gzip
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
content-length
41737
age
512773
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
adview
securepubads.g.doubleclick.net/pagead/ Frame E76C
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CxP5MSUHMYPbGDsaWgAfb_oG4D_K_oaZj3cekx9MNjqTyjNMHEAEgqoDDImCVgoCAmAegAfCduvIDyAEJqQK6Wdc27v2zPuACAKgDAcgDCKoExAFP0D_223bhKxUG9APk7HvkX0vNz8a-6BOdu21cjP1IsOJJbA7GJgswSBd90x7wePGAgLRm1fk3WSB8Ga6EfYpgLDEgwsQXNweZS8HtKrn7q9KkkYeXFQtjFNLZgH5t6hetypsOkjnxE92C07KaXt1Mh69AcsN6PNtV9IpanVgHkTCYOWJ1U0R4GFbZnuBlbRW_LCdDqQAhy-MkkgD5EBNwhbOvbDtXdan3whunCJjF5K1prjWkM1XRurQ5nSgs9LaxRc7FwAS2hdfveOAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAf44cUNqAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEPieENIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tMzQyMzc0ODM1MDE3NTc5OIAKA8gLAdgTAtAVAZgWAYAXAbIXGgoYCAASFHB1Yi01NTEyMzkwNzA1MTM3NTA3&sigh=jMumxeCbx34&template_id=419
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
/
Resource Hash

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame E76C
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
447
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame E76C
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:42:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
237
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:42:36 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame E76C
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:33 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:33 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame E76C
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:40:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
390
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:40:03 GMT
l
www.google.com/ads/measurement/ Frame E76C
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTzSa6Ou4GDLnZ_WrE6IE3tnn4CTZJQkqDG1tmPAIMX6abXY9yLpthwGrCF5fd2qmF4K7dWb9zUwSm6FrwYUI_cNy2hqw
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

s
googleads.g.doubleclick.net/pagead/drt/ Frame D35F
143 B
163 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/s?v=r20120211
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUkM-JAafQqMzJPNrOWpSKB9BOqHDWfZgkwRczmSq3b14RnkVyc1CavCsa0fX0Y
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/

Response headers

content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
date
Fri, 18 Jun 2021 05:47:15 GMT
server
safe
content-length
145
x-xss-protection
0
cache-control
public, max-age=3600
age
3558
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
exitapi-impl.js
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 855B
9 KB
3 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 09:26:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
76814
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3271
x-xss-protection
0
server
cafe
etag
7483759447172721109
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Fri, 18 Jun 2021 09:26:19 GMT
addata.js
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 855B
26 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 08:00:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
81955
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10382
x-xss-protection
0
server
cafe
etag
12806417668659483808
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=86400
timing-allow-origin
*
expires
Fri, 18 Jun 2021 08:00:38 GMT
logo_d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/ Frame 855B
1 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/logo_d.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d29ff1a0d107b4a6a4508c99edb4b7783e2813b98d0a999ac4fbce8915b1cd66
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
514535
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1450
x-xss-protection
0
last-modified
Sat, 17 Apr 2021 14:37:36 GMT
server
sffe
date
Sat, 12 Jun 2021 07:50:58 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:50:58 GMT
tyre.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/ Frame 855B
17 KB
17 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/tyre.jpg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bd02724ce784c8b273e88c3f80dca01a8747634d2155d29790ed2e3660d259a7
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
524466
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17698
x-xss-protection
0
last-modified
Sat, 17 Apr 2021 14:37:36 GMT
server
sffe
date
Sat, 12 Jun 2021 05:05:27 GMT
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 05:05:27 GMT
bg.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/ Frame 855B
37 KB
37 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/bg.jpg
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e3db6e10d23efee68a3363d146b24121b9f1028f32180e54430c687541fccacf
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
496821
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37867
x-xss-protection
0
last-modified
Sat, 17 Apr 2021 14:37:36 GMT
server
sffe
date
Sat, 12 Jun 2021 12:46:12 GMT
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 12:46:12 GMT
logo_l.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/ Frame 855B
1 KB
2 KB
Image
General
Full URL
https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/logo_l.png
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/7478968233103728381/nt_s21-DE_728x90_find-the-nearest-dealer/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9f714fe4238276cbacceb8400a76d9c33a9fb83e4abecdc52aebe8ee87772781
Security Headers
Name Value
Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options
nosniff
age
489984
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1497
x-xss-protection
0
last-modified
Sat, 17 Apr 2021 14:37:36 GMT
server
sffe
date
Sat, 12 Jun 2021 14:40:09 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 14:40:09 GMT
truncated
/ Frame E76C
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6d3c13f4d0e89f526de5a6854a48402da759f01d0da06e26d75ecc5339e1a9a1

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 855B
34 KB
34 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1e7ba7486df51b247d667ddfef156c72ed4f149a3693b1ca9be424f2ea680a50

Request headers

Origin
null
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
si
googleads.g.doubleclick.net/pagead/drt/ Frame D35F
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
179 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Requested by
Host: 171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
URL: https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
safe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/drt/si
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 06:46:33 GMT
server
safe
content-length
0
x-xss-protection
0
set-cookie
DSID=NO_DATA; expires=Fri, 18-Jun-2021 07:46:33 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Fri, 18 Jun 2021 06:46:33 GMT
cache-control
private

Redirect headers

location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Fri, 18 Jun 2021 06:46:33 GMT
server
safe
content-length
246
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activeview
pagead2.googlesyndication.com/pcs/ Frame E76C
42 B
518 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstRg0hCbsavGAR48dcpVm-pQdxQ7Q3oEgrIP5cGhu9JmM3lv7ugXBXU2w1YSF96BVGQwJ06W2UX-XGr-IQG7aAMhFEsYRzOQcD5t7IbD4sBAXlfcVE9xcvuIo1X3OT7FuNWggMmYzholaLF68tedF3g&sai=AMfl-YT_ydVuklgAmVyHaMZcr_IEganUisOh0r4EZFdq1rg3H3L_HgO7BE3rYkcf7PFKNNZSWjdBtwLKEvjzbohDBCtyQhUgXfxe7GpKxOFiIbtAhpjAuNyKdkT1Qp4Tg4s&sig=Cg0ArKJSzDKxgTbheL5EEAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210616&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=2594827412&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1623998793666&dlt=34&rpt=186&isd=0&msd=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/
62 KB
21 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
sffe /
Resource Hash
aa7ad08dddb3da63c9512897e1918a62f8fa96268d92fa1c3c2b4edbf4014686
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"905 / 312 of 1000 / last-modified: 1623971959"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21461
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
gpt.js
www.googletagservices.com/tag/js/
62 KB
21 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js?zx
Requested by
Host: cdn.zx-adnet.com
URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e8b2dbe974437332938aa773a9fc8dfbd3f8589a840c2f7a5121303567880a59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"905 / 751 of 1000 / last-modified: 1623972020"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21675
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
83 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.12204539522408742
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
1
mc.yandex.ru/watch/53428543/
Redirect Chain
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.1247365385282313
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.1247365385282313
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.1247365385282313
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
location
/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.1247365385282313
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.22146977414590552
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
1
mc.yandex.ru/watch/53428543/
Redirect Chain
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.12186898214948472
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.12186898214948472
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.12186898214948472
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
location
/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.12186898214948472
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.19466733025224903
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
1
mc.yandex.ru/watch/53428543/
Redirect Chain
  • https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.5326471905817924
  • https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.5326471905817924
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.5326471905817924
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
location
/watch/53428543/1?wmode=7&site-info=%7B%22ABS%22%3A%7B%22ncmhcso.org%22%3A%7B%22https%3A%2F%2Fncmhcso.org%2F%22%3A%22%22%7D%7D%7D&r=0.5326471905817924
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.06417434946010081
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.7241779897272942
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.619352227715996
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.6049800137462531
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.18276018582070508
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.6615050719299818
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.10351139752361083
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.7782232649366971
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.19020502305148668
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.2827702684430198
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.04134760224408107
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.2422873553896978
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
mc.yandex.ru/watch/56614870/ABS/
43 B
71 B
Image
General
Full URL
https://mc.yandex.ru/watch/56614870/ABS/?r=0.10910359416576432
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
last-modified
Fri, 18-Jun-2021 06:46:35 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-length
43
x-xss-protection
1; mode=block
expires
Fri, 18-Jun-2021 06:46:35 GMT
53428543
mc.yandex.ru/watch/
0
0
Image
General
Full URL
https://mc.yandex.ru/watch/53428543?wmode=7&site-info={%22ABS%22:{%22ncmhcso.org%22:{%22https://ncmhcso.org/%22:%22%22}}}&r=0.6304805088021135
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

integrator.js
adservice.google.de/adsid/
107 B
165 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
165 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=ncmhcso.org
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795451&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=348&adks=816432149&ucis=2&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x-1&msz=1600x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
f76d52d1bab6a33045c3db6943580b063074b0735afc6517a573479d5ebcb0ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4486
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289305
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x250&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795454&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=1152&adks=937995419&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1050x-1&msz=1050x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
c28a9887c2be62f57b318f8b7c66a638d98ab5b8b28e6044c111c1eebf3887c3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4513
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335342073
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
5 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795456&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=2070&adks=3035302266&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=690x-1&msz=690x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
70bd5c7fd4f6d3a76acc5720247e8344f900d5f4b06cca2d614963244499c341
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4607
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289287
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795458&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=3239&adks=2962422274&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=720x-1&msz=720x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
a939f9e879f700eade071baf1a1e5bd5c7a2889d42dede7236d118c87e4dc3aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4391
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289296
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795459&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=4445&adks=397425725&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=720x-1&msz=720x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
100727b0ba2fb2cef480e85a4e62a30d0819fc66e72894312061a265b41f4605
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4375
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335343303
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=580x400&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795461&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=330&adys=5543&adks=596868765&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=720x-1&msz=720x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=5&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
08af167ae87c1c73df99ed27c6dd0acfa0056136b22f27a17884369c0569b886
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4380
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289098
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795462&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=1018&adys=2070&adks=3117521977&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=315x-1&msz=315x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=6&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
a15efea66244386426b3fa9c3fe929d8317b88412905ceca7ad0a7d1fdaa9c37
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4377
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335288537
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
8 KB
4 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795464&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=1018&adys=3171&adks=2410209763&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=315x-1&msz=315x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=7&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
f12d9215f826eb1fe574e73a8e63521f2ce9d1818b1522812fa4f168b468c4f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4373
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335342082
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
10 KB
5 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795465&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=1018&adys=4745&adks=2732256955&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=315x-1&msz=315x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=8&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
91b8096a0e7e7aeb28bb0899e9f7f251ec0e1165fbf4a8e12d6acfff0cd45afa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5469
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289080
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/
10 KB
5 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=569108319563977&correlator=4155788592627767&output=ldjh&impl=fif&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&vrg=2021061503&ptt=17&sc=1&sfv=1-0-38&ecs=20210618&iu_parts=60274849%2CZX-ABS&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600&cust_params=site_domen%3Dncmhcso.org%26site_topdomen%3Dncmhcso.org%26site_referrer%3D%26site_hash%3D%26keywords%3DMedizinische%2520Informationen%2520Die%2520Sie%2520Vertrauen%2520K%2520nnen%2520ncmhcso%2520none%2520Wir%2520Bem%2520hen%2520Uns%2520Ihre%2520Quelle%2520F%2520r%26seg_id%3D21120200%26site_url%3Dhttps%253A%252F%252Fncmhcso.org%252F&cookie_enabled=1&bc=31&abxe=1&lmt=1623998795&dt=1623998795467&dlt=1623998792422&idt=736&frm=20&biw=1600&bih=1200&oid=3&adxs=283&adys=6844&adks=843388246&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fncmhcso.org%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=316x-1&msz=316x-1&ga_vid=1300708977.1623998793&ga_sid=1623998793&ga_hid=1055469694&ga_fc=false&fws=4&ohw=1600&btvi=9&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
c15cccae31e0b27e4f8db728a62c21736958f692047bfad5d1ca07dc28efe9c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5454
x-xss-protection
0
google-lineitem-id
5574013589
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138335289191
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ncmhcso.org
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2C79
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpw0z-4I09KZh89J9OaE3xeMH-jUVSfA9Xv1QB_WUp9doSYFPD6YcLuSvU_Z1pD6r0_No98zX2iBjU0Fs8ZlTziVYUx28LqExAQ9pq2aRBBq9wErhymVsD3AkXRPoRhqzLeXQpTISuXFGh_bkrqHpn-vapBLuNyPIgqYJ-tYqpoNpmMhG0EtjSeuNQXWbh6JqRSNqHtaagaeStsxcIEcgs73m3PEhYUSfHazSS52hqAlCDqDqb8RuHJtY1yMsCc55dyudt7We1bhuxegTXkT81tfY&sai=AMfl-YSaCAZ1hXeqHvCMEbZXhe-UjGku2Jjts2hKovnYggb6aGi1IY6T-HU-l-ZrKh0ODZ7bA9FiUj10D36QupTRfzET-TdS84tuiHXk-eZ2fXGIQCx6CDTGT0s01oHbIPm2&sig=Cg0ArKJSzKURXOSdKGHtEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:35 GMT
ALLzxvr.11
bk.jampartizan.com/ZXM/OPTR/ Frame 2C79
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.11
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.594593,VS0,VE182
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2C79
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_sf_r&pvsid=569108319563977&vrg=2021061503&nw_id=121764058%2C60274849&nslots=12&eid=31060838%2C31061160%2C31061279%2C31061149%2C31061166&pub_url=https%3A%2F%2Fncmhcso.org%2F&GAM=null&Final=null
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 874C
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGprM0w5g8Bm2IiOYVv_-q85YuXfuR0wcYwP0bR-uDio9W_NlAKV1zp-4DSjE35zVknPR-Bynyud5il2fWwCLvmYm7aLhsxFPnlkR-KzEK8AxzpTWyE3_IAvwQKnzMBvuCeGwV8qySJ-eR4B2vQ3R90dj6TRoKdPWn86WQhqvmSuf5HGkF1bZYsAK8I6OWb0N6PK54kH1OKV-FEhu1nlX5pX97oCHCLvExHls_EO6SDwuSJM7GaYcGcdjT-n3vEzWJaYYTYC_WPSMJn4mPFo0YiSM&sai=AMfl-YRoG9DjC0IKd3DVmFBvZDdGM_Rs3jI6VC4pGWhS6duqMZyYVKuwHh_AXLcJk6BXhLZgea5C9n32SR6h04H4MIP_SwJhX6cIPysd0h3A1DcPlqlAw9ZTsnPPUc0AefOh&sig=Cg0ArKJSzMDcNR6V3hduEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:35 GMT
zxvr.57
bk.jampartizan.com/ZXM/OPTR/ Frame 874C
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/zxvr.57
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.594675,VS0,VE168
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 874C
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0AC1
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstzv1a0rBwFbmPXgEYRTvoLrqabYCBxPrh3OtV_AjZDHfY_iTuYKk26RcPuybCCKInq053YweAFFfNupL0LPoN5zo72QvotcYf1Nk2INvhBbSG2owco9dgpnAvjXz9WDCPgegSM3HvpTRU9ppi1-2ChP2nG8R1xByW-aFZDk8vpzMYwqhvq2GDAqBIsHh1CptyG9rDFrIRHjRR-8RcLjdr_1HtYDvFFZlguSodkr6s2qdjWWI54lIkaXBfNNld-zDDN-Sz-U8o9fQlZf7VXchNzIhM&sai=AMfl-YQb8OhNIwlKTfltWwLVLZrRCejJCJ4FNiTP6oNhQQUUnKXW8KciH8d2apaCl1MRhRaljykF1BoSUrOWxIYOeaGSU4h7UKJSPQMzHfJKf6kY_5AUlrVu2upyDweAUJH9&sig=Cg0ArKJSzPUQxJU4Fet0EAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
zxvr.0
bk.jampartizan.com/ZXM/OPTR/ Frame 0AC1
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/zxvr.0
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.594670,VS0,VE204
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0AC1
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 5D46
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstxvKtwIwd2ECvex_TClBSs_O2S4GjBW6Hz7zLGyq4qs5wYNS7WVtG42ZUWlAVOQZ27ChpzYkREKbkcHnxgwc2SZcB_Q6DAaRXMCyt59YtnRpCEQUBycnITnIkHaNxm-P3cDn_6Sr33axMF4aKjlTuX3mVPu6XMK9g9vjgkwbUK_KTV0Xml9uhq1bsJ5aVUyTU1J420ABtMSX9xdfDyUFSxESI6UGF8kXW-JOgu_Sg8_22zqZm_TQFPajNCUDG4OikWkN27V5ZNN-CIMI9hCiMqKyw&sai=AMfl-YR1UktU8oIYmaxLOyZ6TyTf5mjo5MgNuROZMJb37EW7bhgcDtiha-8yWZTr3ONGRCMSiy0RedoElzSXpTtUJP-2Lm_mTlVzowWb7mvbaex-4Q5B6JITwUXcsf_ar27e&sig=Cg0ArKJSzPbQCxHHXuqXEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.93
bk.jampartizan.com/ZXM/OPTR/ Frame 5D46
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.93
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
246adef29fe1329a53847079c91950a159407881774e15b5d5df2e8cb276534c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.608383,VS0,VE1
etag
"629bdb77bd34cfd294109a1585d5c643b6680e2abccef7e380ae44297360d399-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1178
x-cache-hits
1
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 5D46
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0BBA
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstrrI_DcOl19WDmz4MlXrJaq60nvHwn-VMdV1_jhqvxylTQ-0-WtnZDqanqBPGck_VgHo4x2giSBW2u_AG5CzdNWtEIcxGRW6gJiwI7XmtuTH0EJu5ZminGI8IXvERWQ6vXc6ZrQtWumb6tEwnMLbOMrDzy6bKfxWOwmchapflCVN2SoC6viJXNAKv_DYmb6opa1g_nxo5N2rIZyKyOUHe6-8-S3dv1GkMFQnK6VhNKbjQVADMCjPivI6hihmEl1sTLpcKaZ2B1zYX2cZk3k3gQpyOgOgiy5Q&sai=AMfl-YSehfeqFOa219k3P1w6P13bsmJyXsb26gqrk1K4GFKynikiCVaGyjGQ8yJbtOoOLOgz2SEI4zQSfVXaiVxtExfMk2iWXv-2kvNyX3INAkNVynmZIbvH4EoDj-Vh3xDu&sig=Cg0ArKJSzBilgILuMw33EAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.0
bk.jampartizan.com/ZXM/OPTR/ Frame 0BBA
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.0
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.608375,VS0,VE153
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0BBA
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9B9C
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvrCQLGFyMmtR2OPFcyldFRULNP7Htp0msS0IeUpoMXHy3TNEwhAxXqtKxw6AIxue_NZ_Xv1bVkTaUh0ka8OmqfEZAOt-FCjDUjnke5NGhVMf5twRkUAOK0oNb5psoxvIabz_xJgtcgz-P7FIh8G5mB4QG8PZpMZOgnOnO9NGMa5_N9mDs9T_yF-zAyHaB7nQ-ryHSxEfgO8DAiiD5TR2BZ3R2SI1nT2rHt63CksSfRO7jtOpXXzEcapN4VsubzjYrMU4rE2v-WapSFqzGcQZhX8hw&sai=AMfl-YRF2V5dKVb88ouOz6-Z7LxCXt53jRbB5cmBkX-ZhQ7BD0rIHVj5BEDee6buP1J9Q30z0-ypRmeFRnqHIP6XxPuUWsVTbuWbKWJg5Utv3MWX0GWpO-f0RhLz_yHgx3fH&sig=Cg0ArKJSzI21_GDo4WfQEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.55
bk.jampartizan.com/ZXM/OPTR/ Frame 9B9C
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.55
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.608391,VS0,VE157
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9B9C
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2E4A
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPH3sbH6D3uKTFCV70ahFnA6edUJuHV7FLxij6TkKtzCLU8Bf4Jx_jZImnZnFPT4Jk8ZUqwmcAaQ51NUr-d6VVw-cNjBBR2gNpZD_ya9pVawrn0pfRdVkV9yTkzrkAVDw5md4k7l2NAWQosOqXYr5_PBQXJ0o8qvr8TyHuG91S_uDPZ5c7BarkY-jDFZ8HniVf0R32BxMiPLEvc7LRZ5uW3i4ZK8rcbjLLrVfSo6cjArm2t2-cBl-QzwVLIcDkoZZajetg7S-_kE2vXLTX79lYb79rvgNfvQ&sai=AMfl-YSGIg2snXS9Gi8qrkd5IEURQKtwy-ZYLPHh-V_QoJWgQItEels5kZgbwhuApOBBMIM_mm7KcdFt_Yq5sCg7zmD7IEPO9aTJqOwss7gjBXY8Dx1uKAn4gOLkty7sPIgj&sig=Cg0ArKJSzHHz7knBMax9EAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.60
bk.jampartizan.com/ZXM/OPTR/ Frame 2E4A
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.60
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.612318,VS0,VE1
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
1
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2E4A
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 570D
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVQiCa0pwzXz1SidhK1nTwdp8OgiyCjpuETPXgiCiKVMRUf-H-4q9hkoV_ymKkTK5j2UnGxTkUtuGhkDL9D1U-Rr20PrTUEU--5CGY_10YX3VKca_Kq2WMhOxLskrB_rmGEF4Qjcj0OxBfJCFvwPxi6hjl1UawfW9jqmoLxc9u4f3FQYOQgBnKkToOa74wCgUyZXRIOAHLs_BOrXu5ehqAMW3JxXMGlI-QMw816PQ8zeFsFiXt5IoTNHksgakEAIzr1dBDEX5pjDnoBPVoDLyNg24&sai=AMfl-YTsZeMlFNnkGte_jZ8ypzEqi5wFXHXikzsKsh2bvKa9s-yrEpJ5zfRs4bDGeOKGWCsjFMAzXqTKIdgzmXVT5IuV3uyqI-B-Y5hA_Alok5LCJMPamo3S7zzq35IRJoI&sig=Cg0ArKJSzMiTt11-GtFIEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.54
bk.jampartizan.com/ZXM/OPTR/ Frame 570D
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.54
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.632170,VS0,VE167
etag
"dd615af05cacdee1b2238a974184e481542d79e2bdf91caf64613feab3d739af-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1174
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 570D
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D60E
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvK2sx6Cx3mZm_d_6bTj-mDKPskD2m18WTWqjBMlKKOCCsw_mRkLSg0rn5UP4BGRa8TuQW-fu3UqVpkisN0DcF3J4XGIKMCutKtRfbFiuC_pRYgffBz3kEa8RiYr_bpIa7AtjJau2PTPPekBftdmmTskedwvq7YtZZvSNbPE5437du6Koi6pXuNzmTNfguctCFku8x2fVPRobl0zH0Wav4MOtgFvSQKacrgzyyCVkh_e8YG4gRFjDPM2BtbhLX0o35S1hYCf1JixYXZaviCRVNnRcuT6SB6iw&sai=AMfl-YTLGvPh09l5TEJqyPRE2Vwp5y6iifZAluKradV-pxM3wdcl_jFxAZCHk7-Uz1EJG29TN9NwXHaNMbzUfyo4SfqHlVDqn1VGwfSE23KMHxvm_4eYybJHlHfALIDMfJo&sig=Cg0ArKJSzGWFSTM66ia5EAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.95
bk.jampartizan.com/ZXM/OPTR/ Frame D60E
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.95
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
246adef29fe1329a53847079c91950a159407881774e15b5d5df2e8cb276534c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.640695,VS0,VE159
etag
"629bdb77bd34cfd294109a1585d5c643b6680e2abccef7e380ae44297360d399-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1178
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D60E
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0685
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskamVtwxS0PST3RLSqDV8YQHR4yBKsgKFudBbNLpGnZECp4WOAkNE8MbehqJbqEKi-h9IJmMj002Lfem13UYxmWxB7bvptcjwhzFfky_mT8A5Oki4DeKd1Ic8hw38XEclHYyKXIGaRxlvs1ZCWsoLQEumDI0S8nlDZ8ujH3Xyh_B9b6Z0wrGubqnvB6UpHiNVue2secM7X32i0UnpW8tLCJjzsLxn5Br9MaDHRQdGJpoT7ti86_Yk56J5czbaz9kYKJXiMIPVzq6_MIHJ1IelIIM8&sai=AMfl-YQ9csnXFgvaDZ80aEtA3GJg9gkjIz12xngtPBloVP4iZkirAST0wBUdb0ZGjHyWMvoon9PXY2WoOJsa6zUaAyY0PlGXFP34Y-iWU5l7IL7x5u6HxMuPvFIeK06zSXw9&sig=Cg0ArKJSzPnLW5d5eYqYEAE&urlfix=1&adurl=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
ALLzxvr.92
bk.jampartizan.com/ZXM/OPTR/ Frame 0685
5 KB
1 KB
Script
General
Full URL
https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.92
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
246adef29fe1329a53847079c91950a159407881774e15b5d5df2e8cb276534c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31556926
content-encoding
br
last-modified
Mon, 14 Jun 2021 10:46:48 GMT
x-timer
S1623998796.660927,VS0,VE188
etag
"629bdb77bd34cfd294109a1585d5c643b6680e2abccef7e380ae44297360d399-br"
x-served-by
cache-fra19121-FRA
vary
accept-language, x-country-code, x-fh-requested-host, accept-encoding
x-cache
MISS
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
date
Fri, 18 Jun 2021 06:46:35 GMT
accept-ranges
bytes
content-length
1178
x-cache-hits
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0685
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:35 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:35 GMT
truncated
/ Frame 2C79
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
273aeaca6d853aaad1bda85aa8a4ef1fbdb81a3f974f9430c7287341fde23c46

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 874C
206 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0632e19d6a69d5d2ced4160f8ec373977128f038801b19cdb695c375d4fdb975

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 0AC1
220 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
795436a9b34d7cee4c0c4d75b6a4e9bfb09dcbd35d09e53f1c9ff9585c28de02

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 5D46
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c28ec832f5ecfe9352abcd287283305f4b73cdee8952340bcd077915ff237a7e

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 0BBA
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3c83548386827adca9c6c19ec892039a5784a3ea2f5c193954d6bbd0c46957f

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 9B9C
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
90f5b3b6644bc22752012cb38af16acbd0758607c043bcc4dceaf67708b7a6df

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 2E4A
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4c895853a2fc12da6876bbbf5b41c242811b9162a65c042146293f728bcad937

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 570D
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0cf123d9af27b09b4a51ecedbad25fea2d304aa83158ff829543248b25dba645

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame D60E
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eacaf032d6b2c78e716159cf0bbfb1d6fb04c499358e53a1c8422097f6f58c33

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 0685
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9961778411483e22893fbbb5783caa61c1c0eee0e19ce45f5a5a845b6ca9170b

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
ads
googleads.g.doubleclick.net/pagead/ Frame 4FB4
58 KB
22 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.93
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4e494c61b1a3ac72626ae5bf2c8f4b1e5ba7e9097e31e6f09a7c86808c1c8a6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:36 GMT
server
cafe
content-length
22927
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 63E0
52 KB
15 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.60
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
be266149542bbd949484c2c813bbbf8cc04a121c313d2bbacc46edb773d1ab17
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:37 GMT
server
cafe
content-length
15698
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 0B57
94 KB
30 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ecce6a58616c4f65c8992b1db8b5258071f6bc5226617d1149824a343fdee84b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:37 GMT
server
cafe
content-length
30921
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame CF58
73 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/zxvr.57
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fb72b57f0eb32d34140b9af0e922723a4bc6d96bd57f1cc33669a6b875976a0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:36 GMT
server
cafe
content-length
24994
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 786C
72 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.55
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4a415b9664c15a6fa3f01b0cfac702e89a6e2d765f8effedf758ca8f4089456a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:37 GMT
server
cafe
content-length
24487
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame D58D
72 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.11
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ec46d1a0fd66abcf47fd1aded820d75f29097fcf1f99922e5ca9d38890a8c18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:37 GMT
server
cafe
content-length
24820
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 6A45
73 KB
25 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/zxvr.0
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9fcb152549dc1c9f571127c64608504a67f406e203b3bae2f7eadf88d1480627
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:36 GMT
server
cafe
content-length
25154
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 276B
69 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.54
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0c98b45816904c4e42fb1e0d92cbad6668c5fb2939e887528cbf70fac3418436
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:37 GMT
server
cafe
content-length
24708
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 2156
67 KB
24 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.95
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fd431dbe6258a7677ea8923a007eba3bd18d165ca6d95b26ae5c74815a478bbf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:36 GMT
server
cafe
content-length
24108
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ads
googleads.g.doubleclick.net/pagead/ Frame 0058
50 KB
15 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Requested by
Host: bk.jampartizan.com
URL: https://bk.jampartizan.com/ZXM/OPTR/ALLzxvr.92
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
24e4a034ba4919f99fe0d4cf57fe8aa098a2e24624dc8e5f6082e82b26659f79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
DSID=NO_DATA; IDE=AHWqTUmJLHlkJj55F-v54o8Z4qT_FX_owTQjTOr-o1AFyd2PlTMFWG_evPf9-vklBBc; test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Fri, 18 Jun 2021 06:46:36 GMT
server
cafe
content-length
15196
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
optad360.js
serving.stat-rock.com/player/
303 KB
95 KB
Script
General
Full URL
https://serving.stat-rock.com/player/optad360.js
Requested by
Host: get.optad360.io
URL: https://get.optad360.io/sf/0cb56948-cae8-47f8-b292-fbe3862a81d2/plugin.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
144.76.128.227 Lindlar, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
ap16.adplayer.pro
Software
nginx /
Resource Hash
37afcc50aed647983a6e055ccfdcb8ffb5edc9f759d42330a10edb6585f971f7

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
content-encoding
gzip
last-modified
Wed, 12 May 2021 07:13:31 GMT
server
nginx
etag
W/"609b801b-4bbf3"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=600
css
fonts.googleapis.com/ Frame 0058
3 KB
674 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 06:41:04 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:36 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0058
1 KB
990 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
452
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 0058
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
450
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0058
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:42:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
240
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:42:36 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0058
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:36 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0058
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:40:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
393
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:40:03 GMT
l
www.google.com/ads/measurement/ Frame 0058
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTt__OflTES4180xSwCdNpoB0REEo3vxZobijACLfjZhnAnY_SyYJuY5JZAgfb9E7IrnjXjbv07GvhGYuaba4e4uue25A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 0058
25 KB
11 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86730
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/3068642240242166769/ Frame 0058
12 KB
12 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/3068642240242166769/downsize_200k_v1?w=300&h=300
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13d89f2f519a76667d106e935583774c620f379eb96605d9d8ae2c63002b995a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 13 Jun 2021 09:40:42 GMT
x-content-type-options
nosniff
age
421554
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11870
x-xss-protection
0
last-modified
Mon, 15 Jun 2020 08:45:29 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 13 Jun 2022 09:40:42 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame B262
1 KB
864 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78218
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 0058
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c5b9193d16bfb047d69c11d9b561271b5cdec3d9b86031112df85fff6cb6daff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 0058
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515152
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 0058
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503888
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
11540491134275046509
tpc.googlesyndication.com/daca_images/simgad/ Frame 4FB4
27 KB
27 KB
Image
General
Full URL
https://tpc.googlesyndication.com/daca_images/simgad/11540491134275046509
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
37577455f348abb564af8ac7a767d609ef3e52881db617e9b9f1d362b1cd5b3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:58:45 GMT
x-content-type-options
nosniff
age
514071
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27256
x-xss-protection
0
last-modified
Sat, 13 Feb 2021 05:33:36 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:58:45 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 4FB4
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
450
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 4FB4
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
95
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 4FB4
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:36 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 4FB4
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
31
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame 4FB4
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSKZpGVWVNRg6feDzOBsvhiX5s3RU5rKCypuINAz10mBfRbSn1eQRz8bwrFelPDOInr6ZzFjSH8AKOuMiv_r-rTsop4Ug
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

one_click_handler_one_afma_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 4FB4
25 KB
10 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/one_click_handler_one_afma_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a783598f3cc86a4d73a813cedd5f6cbdf85ab7b95c4d40944a30c833071aa18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 21:37:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32950
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10657
x-xss-protection
0
server
cafe
etag
7233769875026612745
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Thu, 01 Jul 2021 21:37:26 GMT
/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame B262
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHAfvJOm_RBiTq569KLQlcI&google_cver=1&google_push=AYg5qPJNQdU6hiy5RznQWgkUafO0jF6oBcDpqyLJC15AZsbhq63AJYHOfPD8ZV43sQDwds_typM--eCB_jDAC83MHd8TiqXDgUQ
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjc4NDIxNDA5MzI5MDU2MTg0Ng==
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm=&google_sc=&google_hm=Mjc4NDIxNDA5MzI5MDU2MTg0Ng==&google_tc=
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
43 B
407 B
Image
General
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dpixel
cms.quantserve.com/ Frame B262
35 B
463 B
Image
General
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMMXtvkugCQDiyo4yxs9gQU&google_cver=1&google_push=AYg5qPL7CWLx1zU7-Y7iYTwa0FIUocObegAUSJTYTKMPrXKFeVkTTvfeolF4PWJPFhxHEqmYSV7ZIrdNZ9AMYagbcmn7-V1rTIk
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame B262
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEDuWImcPXDEjG7XNlObjivU&google_cver=1&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4l...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY&google_tc=
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY&google_tc=
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIv-mCqkUOPpw4zCuSkBGY9SqNe1Us6ouzbOlFVxaA-Yu6SWnvA3Yg8o8bn8fp6oqfUfdA-ueSrFUlZ8m4lnki4Ds90nLY&google_tc=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
398
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AdxPixel
tr.blismedia.com/v1/api/sync/ Frame B262
0
136 B
Image
General
Full URL
https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEHGSYk0J-xuHhKQcar4Qeiw&google_cver=1&google_push=AYg5qPKamY3Ijaeu19wPMQd6-fAEjTMRTTjz2snd4nmXK1J0Oye88qt4rsVmwu2vPpHioTMwxJgXoVG6l5lk1WsHtKpI4lqfVK0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
via
1.1 google
alt-svc
clear
pixel
cm.g.doubleclick.net/ Frame B262
Redirect Chain
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEDOajEUU8ETD67QqOB8O4q4&google_cver=1&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_q...
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEDOajEUU8ETD67QqOB8O4q4&google_cver=1&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX...
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_qorRk
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_qorRk
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJUWH4yck-OdLAhdd8t-80oiKGkg8exEHf2lI6IDEPUU4N0S3HAdxy8YLWi5fqbrK3rkiMjyZ8FH2UtrZ__pgmpX_qorRk
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
pixel
cm.g.doubleclick.net/ Frame B262
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBDMoYTEQYLlcVCCJJVCbD8&google_cver=1&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRoOM...
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEBDMoYTEQYLlcVCCJJVCbD8&google_cver=1&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHi...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRo...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRoOM-V1b30Tt0f-A9ElPHQ
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPKWquuWznD1Rix-yjEEnFWOGXIECtDqZCezQLLElyV_4XdsFb6dGhIvNWLK_kl9t1X7rHiRRoOM-V1b30Tt0f-A9ElPHQ
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
dot.gif
s0.2mdn.net/ Frame B262
43 B
413 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEEdFKxwiLdqi10Na4lixJQk&google_cver=1&google_push=AYg5qPK4_xP3nQmDmetoQA9NX_cj8tOS4UmWqSFZ3vZ4h3l3ARJW5YTXts8e9-iouh_9O3D_mpY7B9WsPU2gQ9z5f41MNoGooKGX
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 06:46:36 GMT
attr
cm.g.doubleclick.net/pixel/ Frame B262
0
253 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JcIgg4lB4sxrxobeYkrPqRAXW5Wp8e481EZxeUt59m6pOPw6_gHzyxwNAGJ8m4lWvsUZJcLg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.3507888665175558
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 0685
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvveDS1c_Or8usferaHfV6N_ZwglsQheJ70YceECisdwIL0ixOsqVUCV9rzVlE5G4L1MeKvNPX4A3MlxtikaYSs7lGSmklMc9lY8811CZsDjlp8t1kv7_0Ma5SZ-SiV2cnIwrkF-0Gnp-7955h4h_GxbLDpfyV_hJ5F4tvB_Fj68sm83FrUx7Iofl4V-EvbgBEmB8ll7ABqNLRp5PhjmF6ddlWu9lsr98InDz2_GPmtcN4UgDqhVatmXiPnSQJD8PUW1zBSf6Y-g_38iZqY1m5X78sH3g&sai=AMfl-YQBB-iEcKxV56vkTZfRBX8510MUqrvz7ACc4UQMvkzEOsCxVpBtQ2KmmLMr8ottZwBGG-YWHFVelM7FrP1OAjEnaSQFpPE-xGG9D-AvLefaySzWUL5AT0-keOSplIe2&sig=Cg0ArKJSzEtNhRD3guY9EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:36 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:36 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 7665
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78218
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 4FB4
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d55af792935ca87af56842444b3a1171f301a1e63722ab7e1b57dadb0c655c3

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
i.match
s.tribalfusion.com/z/ Frame 7665
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEDsQQvewgT5SajDHyrDwpFE&google_cver=1&google_push=AYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l&...
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDsQQvewgT5SajDHyrDwpFE&google_cver=1&google_push=AYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8...
43 B
444 B
Image
General
Full URL
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDsQQvewgT5SajDHyrDwpFE&google_cver=1&google_push=AYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
66128fc1cdcb2b4d-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length
43
cf-request-id
0abf782d1800002b4d9a81b000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
82
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
66128fc07ad82b4d-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEDsQQvewgT5SajDHyrDwpFE&google_cver=1&google_push=AYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIUl5cf7wWDh7-bjiMvtuc4F5Q4CBjhgMonIHIfMB-BxK28ePEZCcaSNWk_djf7A4rJI0OGkVhHcRjlrDX06fo_TWzX_W8l%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control
no-cache, private
content-type
text/html
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id
0abf782c4f00002b4de90b2000000001
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 7665
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_push=AYg5qPKfg_aIT8dPx3OGR3_vrgCK4iQoobNdOk3KXIZHZI7Du1hCfi9et_...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_push=AYg5qPKfg_aIT8dPx3OGR3_vrgCK4iQoobNdOk3KXIZHZI7Du1hCfi9et_PAOqY_aNA5mwXSqN37kzbUKHpbbRzmDqz0s1yD1Dg3
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1623998797.883217,VS0,VE90
x-served-by
cache-hhn4049-HHN
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_push=AYg5qPKfg_aIT8dPx3OGR3_vrgCK4iQoobNdOk3KXIZHZI7Du1hCfi9et_PAOqY_aNA5mwXSqN37kzbUKHpbbRzmDqz0s1yD1Dg3
cache-control
no-cache
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-cache-hits
0
pixel
cm.g.doubleclick.net/ Frame 7665
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHc3PwHYk_qgs097nsbhhso&google_cver=1&google_push=AYg5qPKGvOobMfGem_sgael6h5tuVw_c8HAPypxvG0peprRYZGRBfIfuyrL7blPRX7kSS737ZW8zKgvAr7V...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPKGvOobMfGem_sgael6h5tuVw_c8HAPypxvG0peprRYZGRBfIfuyrL7blPRX7kSS737ZW8zKgvAr7Veu2_lClMlSbGNoAlk&google_hm=rSH-4C1iSX2uF-QuSC74M-8
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPKGvOobMfGem_sgael6h5tuVw_c8HAPypxvG0peprRYZGRBfIfuyrL7blPRX7kSS737ZW8zKgvAr7Veu2_lClMlSbGNoAlk&google_hm=rSH-4C1iSX2uF-QuSC74M-8
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:36 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPKGvOobMfGem_sgael6h5tuVw_c8HAPypxvG0peprRYZGRBfIfuyrL7blPRX7kSS737ZW8zKgvAr7Veu2_lClMlSbGNoAlk&google_hm=rSH-4C1iSX2uF-QuSC74M-8
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
clear
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 7665
Redirect Chain
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ...
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ...
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ9IIcoa4GrwUaBxgaNMsa...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ9IIcoa4GrwUaBxgaNMsaHuGbPE8ckET3_RUvD92
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 06:46:37 GMT
Server
nginx
Vary
Accept
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKokiH0SggojcyDccUHekVny26grFcyUWmG5V2nQvj9dutn6wAfC0IaZ9IIcoa4GrwUaBxgaNMsaHuGbPE8ckET3_RUvD92
Connection
close
Content-Type
text/plain; charset=utf-8
Content-Length
238
pixel
cm.g.doubleclick.net/ Frame 7665
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=j30vgfmlTD6bpHrbp2Atzw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=j30vgfmlTD6bpHrbp2Atzw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLJVvvt9eGsBuPiA8LdSLWXBT6k5aXeOEU6ixYVGHqHmFAnVaupyvQhXf8IRZ5mSI-Y4YBB0z8GBNVthZ9QP4Y2gGY_Fw
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=j30vgfmlTD6bpHrbp2Atzw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLJVvvt9eGsBuPiA8LdSLWXBT6k5aXeOEU6ixYVGHqHmFAnVaupyvQhXf8IRZ5mSI-Y4YBB0z8GBNVthZ9QP4Y2gGY_Fw
date
Fri, 18 Jun 2021 06:46:37 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 7665
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&googl...
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AY...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rv...
0
0

pixel
cm.g.doubleclick.net/ Frame 7665
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKPX6EJH_bkqAe4tHQzvSjo&google_cver=1&google_push=AYg5qPJmjr0mW0syTG3KGkXhu_pM8rX3o8J80u6H2KqCiGmziJ1H24oHIr0KmoghHdVg5OdKJqxAmST_5eUgF7QC...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJmjr0mW0syTG3KGkXhu_pM8rX3o8J80u6H2KqCiGmziJ1H24oHIr0KmoghHdVg5OdKJqxAmST_5eUgF7QC80w9gFl3PZOY
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJmjr0mW0syTG3KGkXhu_pM8rX3o8J80u6H2KqCiGmziJ1H24oHIr0KmoghHdVg5OdKJqxAmST_5eUgF7QC80w9gFl3PZOY
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:36 GMT
via
1.1 0b1a7654de85c273e4c8f54e3e012e2e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
VIE50-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJmjr0mW0syTG3KGkXhu_pM8rX3o8J80u6H2KqCiGmziJ1H24oHIr0KmoghHdVg5OdKJqxAmST_5eUgF7QC80w9gFl3PZOY
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
rAKnlIE3BGpInmt3weA0LCBNJcXMUlR7YDqpFvCCfQ3mH9uAGiavuQ==
attr
cm.g.doubleclick.net/pixel/ Frame 7665
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IiiHvC10o7FoHDorekfOdJUGKMdPvEHCTmrI2jFSzKxkS-5mXP_ZvEDk2y-JS3R6IQ-8Vo
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 5D46
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvceGJWbp8ShE5tbxBXF-N5fhM2dKx-zEuTY6P3hU92FhUWnsYVXXYSooqxX3fpwJ9MvnO1ptMvd0DwPkz0OB8tQgPR-iw-9RtG9oSGR2F7TABURs3s_xDE8RXkVv2PRIdJBPKLTWmivj8Ru18LPsXNsYO44BJ7NAXRWOI2FODP-6Ep1jmq99g96aAQfS0jJsRzvLVJ8r8vgMdB8Mh03KAaOH2c5Gat04m5C1A5z5wlommJAnkGJofvvuChdytwIz1x-8oub74QcSKMJFWWyqSKzUu7OA&sai=AMfl-YS5wGNiWQuBZOZk341LsTyV55tv9aaV20eZz4V6y92Z3ShDnOsNipgadTNhtQWMT9LXaIm7o6LqkxICby57g-s2GLOFR_4yYzeY8ecdbYyGbWJ6AaiIV8JNfYstmp1U&sig=Cg0ArKJSzIKyNoSsGJu9EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:36 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:36 GMT
css
fonts.googleapis.com/ Frame 6A45
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 05:36:23 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:36 GMT
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame 183D
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.5754331779009063
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3899
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 6A45
1 KB
910 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
452
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 6A45
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
450
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 6A45
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
95
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6A45
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:36 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:36 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 6A45
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
31
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame 6A45
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaS8yEXP_IiaCjYoK_MQ6AuESEtzXZl-pzpTEeR44IwlkUPwcBAc5Ny5be1W6q7zkgdVzyST4qKY1atFYSCb-a4_zPqEzA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 6A45
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86730
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 832C
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78218
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 6A45
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
29b46ac5b9e3243117fbbf5e8f2f63ac027cdaeabb32d1f643ca663560c6e9ae

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 6A45
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515153
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 6A45
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503889
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
css
fonts.googleapis.com/ Frame CF58
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 05:32:24 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:37 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:37 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame CF58
1 KB
910 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
453
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame CF58
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
451
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame CF58
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
96
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame CF58
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:37 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame CF58
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame CF58
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRQgbexamegOsRbGXwxg8VnWhnUlSKHZ6dZk1tbkS2s5cOyJZWCH2QAlaoS9UhIt7gFFZus9haZn0JHBnWC-l6vDIz1og
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame CF58
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86731
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
css
fonts.googleapis.com/ Frame 2156
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 06:19:35 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:37 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:37 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 2156
1 KB
910 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
453
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 2156
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
451
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 2156
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
96
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2156
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:37 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 2156
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame 2156
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaS2_RuG5woOnGAyWX_46g4NRxH0Pq18cVgymhevhxDMEoGQ-GMQ0gXEMcu6BYMJAoF0DmYw80Udl3ePohVTwoZvlXvJrQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 2156
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86731
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 2F02
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78219
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
pixel
cm.g.doubleclick.net/ Frame 832C
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMMXtvkugCQDiyo4yxs9gQU&google_cver=1&google_push=AYg5qPKvYiiOVIuXGtEGrL2dhsHv78X-JVtIp53OPdbwy6296hoQMIfvVt...
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKvYiiOVIuXGtEGrL2dhsHv78X-JVtIp53OPdbwy6296hoQMIfvVtzbglvgwGlZ-kQ3ZWLKWCSh0YQI0pD6OiaiOqivpmHF&google_hm=1NABKF...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKvYiiOVIuXGtEGrL2dhsHv78X-JVtIp53OPdbwy6296hoQMIfvVtzbglvgwGlZ-kQ3ZWLKWCSh0YQI0pD6OiaiOqivpmHF&google_hm=1NABKF7ctBNApUPskCF22A
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKvYiiOVIuXGtEGrL2dhsHv78X-JVtIp53OPdbwy6296hoQMIfvVtzbglvgwGlZ-kQ3ZWLKWCSh0YQI0pD6OiaiOqivpmHF&google_hm=1NABKF7ctBNApUPskCF22A
pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
strict-transport-security
max-age=86400
expires
Fri, 04 Aug 1978 12:00:00 GMT
current
dclk-match.dotomi.com/match/bounce/ Frame 832C
0
104 B
Image
General
Full URL
https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESECszt89k5fyFzrnc7s-BO04&google_cver=1&google_push=AYg5qPLFFnXNWuZ3byGTqeMOPSu5AZ_zjAzOGt-i8Vc1z9as5xC88ctjcV2mWN1_Tzc-GWBUOSB5F2p8_UXB9gwp9X4JeoGv7Iis
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
pixel
cm.g.doubleclick.net/ Frame 832C
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESECgVRX6N6zsLYiy_mQd8txk&google_cver=1&google_push=AYg5qPLFxuarojKl4YbdMgUxApYG8TdxCDkf-oUaO6KEThR-AFP8nTLya9KecynfrrF0uOmnUS5WuNidN7Mjmx...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPLFxuarojKl4YbdMgUxApYG8TdxCDkf-oUaO6KEThR-AFP8nTLya9KecynfrrF0uOmnUS5WuNidN7MjmxeQZ4...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPLFxuarojKl4YbdMgUxApYG8TdxCDkf-oUaO6KEThR-AFP8nTLya9KecynfrrF0uOmnUS5WuNidN7MjmxeQZ43p4TEhu2U
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPLFxuarojKl4YbdMgUxApYG8TdxCDkf-oUaO6KEThR-AFP8nTLya9KecynfrrF0uOmnUS5WuNidN7MjmxeQZ43p4TEhu2U
Date
Fri, 18 Jun 2021 06:46:37 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame 832C
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPJBBhpTnPNg0ef4ixB6kNHG-r21BXOVVRDyE4tnp69KLYxf8BaSez02sJoQ5jhHlCkbhcBJgXrlG3HF73ydMkQX0px...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJBBhpTnPNg0ef4ixB6kNHG-r21BXOVVRDyE4tnp69KLYxf8BaSez02sJoQ5jhHlCkbhcBJgXrlG3HF73ydMkQX0pxxXsSG&google_hm=MTA4NzQ4MTUzOTY5MzgwND...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJBBhpTnPNg0ef4ixB6kNHG-r21BXOVVRDyE4tnp69KLYxf8BaSez02sJoQ5jhHlCkbhcBJgXrlG3HF73ydMkQX0pxxXsSG&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:37 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJBBhpTnPNg0ef4ixB6kNHG-r21BXOVVRDyE4tnp69KLYxf8BaSez02sJoQ5jhHlCkbhcBJgXrlG3HF73ydMkQX0pxxXsSG&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 832C
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu&...
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu&google_hm=u-W4KiAIy8QwakUuezdY1w==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu&google_hm=u-W4KiAIy8QwakUuezdY1w==
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKkm514SIwaZNtoW2uKsTZBIh5eY3c760mjcoGGR67swwZ2S-TqQklii04mHh8-ON6w_cB97lrApH4ioS-wpqwZshQRDccu&google_hm=u-W4KiAIy8QwakUuezdY1w==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-request-id
ua4t4a5bmpfqaud2h221dc8d8oatuu2r
pixel
cm.g.doubleclick.net/ Frame 832C
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKPX6EJH_bkqAe4tHQzvSjo&google_cver=1&google_push=AYg5qPLw7_pdlwNmNHOC3F-Jn1DUUXhbpk9HiwVXGBs4-V64PaSKNFS-duUnnU-CPsKvUUcWd8XTQpW4IhL7dK6m...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLw7_pdlwNmNHOC3F-Jn1DUUXhbpk9HiwVXGBs4-V64PaSKNFS-duUnnU-CPsKvUUcWd8XTQpW4IhL7dK6mJQbqUc0mdr7v
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLw7_pdlwNmNHOC3F-Jn1DUUXhbpk9HiwVXGBs4-V64PaSKNFS-duUnnU-CPsKvUUcWd8XTQpW4IhL7dK6mJQbqUc0mdr7v
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:37 GMT
via
1.1 0b1a7654de85c273e4c8f54e3e012e2e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
VIE50-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLw7_pdlwNmNHOC3F-Jn1DUUXhbpk9HiwVXGBs4-V64PaSKNFS-duUnnU-CPsKvUUcWd8XTQpW4IhL7dK6mJQbqUc0mdr7v
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
KHMSP35OTtR5I1SrqbXAFjoVLF0yMd9nmSv--6zzOrS3bhbL7q8F5A==
pixel
cm.g.doubleclick.net/ Frame 832C
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEI...
  • https://sync.targeting.unrulymedia.com/csync/RX-2b67f067-5b25-414e-85df-81e86d5318c5-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPLmp7_BieMAnwVY_amA_...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLmp7_BieMAnwVY_amA_kCeKi4MTYvdZHijbau5GYsRxDmJPvp_fGh3kJs-xLkAJ7uydjyqlnQwEEKkWmJS965EJukxTTyV&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLmp7_BieMAnwVY_amA_kCeKi4MTYvdZHijbau5GYsRxDmJPvp_fGh3kJs-xLkAJ7uydjyqlnQwEEKkWmJS965EJukxTTyV&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLmp7_BieMAnwVY_amA_kCeKi4MTYvdZHijbau5GYsRxDmJPvp_fGh3kJs-xLkAJ7uydjyqlnQwEEKkWmJS965EJukxTTyV&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
date
Fri, 18 Jun 2021 06:46:37 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX2b67f0675b25414e85df81e86d5318c5003
content-type
text/html
attr
cm.g.doubleclick.net/pixel/ Frame 832C
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KUV9vNmY2v1H-BqDKfwctZYKzcO3vFhYFyWRlGnAmTSDErfJx4_UVcnzk0yijQEgYmLuau
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 0AC1
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsulLnN9THjHitBTKlI-Ba9GUR8e627uHwO1CtvrgIm68-AY52sMFV-suoqajL6Knbtbl72ws70wA-IoFzFoS0eGrgjZXJqEdJj52k605w_ZxyTv7EFCZWIM21tJzUfIhnX0oXoOWYo7Js5hfQ-TNJ3HTNV4_bTjLereiLZj4XVD_M92AL9EnlE_wThEPwiCiZvpHRrawNwc_cMI7CvTDoZPlui5R7oTYG8KMGLy3Z6TOvrpv2aQpJe0Sye2i-N4N7HnG1cC5IYrmGzPOLvh9Yq4R1x__w&sai=AMfl-YQxRcwQcQLXt1MH354-YAZihjVbRifA3HrqdumkQFFTWD8BlDtkpuIIBuaNFXn0jI0z2lS8eiFeS3_GOGvHEHsu2tqhRLcn4uRXIlqa4VE-3uzUG1J_fiFAFqLMmqDT&sig=Cg0ArKJSzC6fV4m6ISIDEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:37 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:37 GMT
css
fonts.googleapis.com/ Frame 786C
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 05:54:17 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:37 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:37 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 3251
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78219
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame CF58
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
085090f246d04b6921b2e44e51bf6b6a5d234ae456ff7325dd0c85c12333c2cd

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame CF58
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515153
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame CF58
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503889
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame 7D8D
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09902549814922401
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3900
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 786C
1 KB
910 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
453
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 786C
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
451
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 786C
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
96
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 786C
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:37 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 786C
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 786C
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86731
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/14738076059717248402/ Frame 786C
26 KB
26 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/14738076059717248402/downsize_200k_v1?w=600&h=314
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f8533d3a748458fe5a5a8d3f562b3535bd151c6cb9af4fafb7839d176a8cd2ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 04:05:19 GMT
x-content-type-options
nosniff
age
528078
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26579
x-xss-protection
0
last-modified
Fri, 28 Feb 2020 09:28:30 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 04:05:19 GMT
truncated
/ Frame 786C
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 2156
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
543c7697685c56b03408ab997237daab81cacc93a71637f0b7d87734df5e9ca7

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 2156
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515153
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 2156
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503889
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 49B3
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78219
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 786C
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d61109ad78ea052162d7e8f8049277b7ab740d25584a80047d12ca53bffe6a97

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
/
google2waycm.netmng.com/cm/ Frame 2F02
0
0

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2F02
Redirect Chain
  • https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHAfvJOm_RBiTq569KLQlcI&google_cver=1&google_push=AYg5qPIiNG530GBDQ6QsofofGBfEslkmEnCzdAXJNGOes6c83ShcHWuJc9KOxQ4aoKoc5oDXUx5oLvawPtwSk0b3_lL_j0JnAniq
  • https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=Mjc4NDIxNDA5MzI5MDU2MTg0Ng==
  • https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
43 B
407 B
Image
General
Full URL
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software
/
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type
image/gif
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEDAQHTMfbrB9XrwehllMAxc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
google
match.adsrvr.org/track/cmf/ Frame 2F02
70 B
265 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFwv-Uue8xw1BQYraO9VNUo&google_cver=1&google_push=AYg5qPISJ9mf8XGbtsplZ4KS3LCuiHfRN77iFKYZykXHEtoY0fZwMruc8pmT1MDRJFMVWZI8p_Ha3LaxhfMW9kA0sSs4xm1TMraFXg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 2F02
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPJmHTKjhcpiCEjD_c73H0gUTMuGTYPtW3fN2B9Vo6dStkyydfs8JQ4WRka2iebRlGcWiVNj7y_...
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPJmHTKjhcpiCEjD_c73H0gUTMuGTYPtW3fN2B9Vo6dStkyydfs8JQ4WRka2iebRl...
  • https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 2F02
0
114 B
Image
General
Full URL
https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEHGSYk0J-xuHhKQcar4Qeiw&google_cver=1&google_push=AYg5qPJ_FizWl7bN0QiTZRsd9DeLaStzD4MD_kKgp_wLFT_I-_OzFMQ5u1x4hAGFCJ5fnEUFk_zJZpcjoBIU1tj9Yk513cP9nG8nJg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
via
1.1 google
alt-svc
clear
pixel
cm.g.doubleclick.net/ Frame 2F02
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEKPX6EJH_bkqAe4tHQzvSjo&google_cver=1&google_push=AYg5qPK9j4ukHEjwBUsfN_XsOoyvhlgUqzhiOAep0mMhvE8MbDlkA4YnzGp28dmLdZNOWilMEfHWN7zfPJLhzUwR...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK9j4ukHEjwBUsfN_XsOoyvhlgUqzhiOAep0mMhvE8MbDlkA4YnzGp28dmLdZNOWilMEfHWN7zfPJLhzUwRz8wH5foupAw1Lw
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK9j4ukHEjwBUsfN_XsOoyvhlgUqzhiOAep0mMhvE8MbDlkA4YnzGp28dmLdZNOWilMEfHWN7zfPJLhzUwRz8wH5foupAw1Lw
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:37 GMT
via
1.1 0b1a7654de85c273e4c8f54e3e012e2e.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
VIE50-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPK9j4ukHEjwBUsfN_XsOoyvhlgUqzhiOAep0mMhvE8MbDlkA4YnzGp28dmLdZNOWilMEfHWN7zfPJLhzUwRz8wH5foupAw1Lw
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
xWxJDE0rmphX_1HL6badJbGSKazwPwFCudvA-kqzNySOg_oN_cfUBA==
dot.gif
s0.2mdn.net/ Frame 2F02
43 B
63 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEEdFKxwiLdqi10Na4lixJQk&google_cver=1&google_push=AYg5qPL8XSxcgHM5F26C2H3IewDtEdoyuKQaVQto3QIanuSh-MN2uwimvHW7PYbccruqkze72hMsleuO1MqErXckMklR7cVeQtpWJFc
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 06:46:37 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 2F02
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LQ3m0XH2h0G8ufPWHhlP6VFF_Zm6yQHl0AlFj1uB1z0SKD5aUBF9lN21cBQtEgwkBoGBVZMg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 874C
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvMG4PIUKI9TKsap9WJYHGZg1TJG2aEQJzyQifnUX3aiq1biR35CtlSacTZ90cPBNyNZHkmyPL2knt1LCJ8fCNs8Ln1mnyR48FagxefXGUN4nTnvI9C84KkjRkNL43Z7h4wQ0p4Zdrc1_C5wBFPr8kMxXpJlwka_bMGHwkY5nK4Jm66T-w-QaKwZI6tr7ntFlaFlNy5-4Iyp4JXLTCTm1xt7qfcme-PvYtVM5tYEtAmusRSR8kOYUoxKvA8teYD4CwvnAT4uvD3P1QwJZj6udaf9pxiUw&sai=AMfl-YTXNcru-U_WZp9Ny5susLLnPrHwj9AafEXW7bMXgSZ8pCDnlyULpEDYmoNzrtF15KRwPMcVDvlqbq-l3AqwY0VApPYjxd3_TCAhfjTowNExfjRDnMokcyCPa8Ny4SX2&sig=Cg0ArKJSzD0-j0gDgsVbEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:37 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:37 GMT
pixel
cm.g.doubleclick.net/ Frame 3251
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESECgVRX6N6zsLYiy_mQd8txk&google_cver=1&google_push=AYg5qPKpYueY_QLFBjzCzPWNBuAYnDcjKjWtEVgGKPU06yuVhWwd-rq-Qez2dWud5jqrFa014IcmHmAL3UHLi3...
  • https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPKpYueY_QLFBjzCzPWNBuAYnDcjKjWtEVgGKPU06yuVhWwd-rq-Qez2dWud5jqrFa014IcmHmAL3UHLi3Pgqv...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPKpYueY_QLFBjzCzPWNBuAYnDcjKjWtEVgGKPU06yuVhWwd-rq-Qez2dWud5jqrFa014IcmHmAL3UHLi3PgqvGBk3ZJFM7oMQ
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk3NTAyMTcyMTg2MDI0MTU1Ng%3D%3D&google_push=AYg5qPKpYueY_QLFBjzCzPWNBuAYnDcjKjWtEVgGKPU06yuVhWwd-rq-Qez2dWud5jqrFa014IcmHmAL3UHLi3PgqvGBk3ZJFM7oMQ
Date
Fri, 18 Jun 2021 06:46:37 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
pixel
cm.g.doubleclick.net/ Frame 3251
Redirect Chain
  • https://ads.travelaudience.com/google_pixel?google_gid=CAESEMgdnrS2XMd7JeC9eflPJCs&google_cver=1&google_push=AYg5qPI6plVUh1pgzgPArIVwDBi9B2lZT2iC0f6maRJrc3Y-xagZAgzU83SXSwmRuqcIKYiEjr8MWPYguP1WiIL9...
  • https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=CtFVst2XR8WQD1BjV73c3g2&google_push=AYg5qPI6plVUh1pgzgPArIVwDBi9B2lZT2iC0f6maRJrc3Y-xagZAgzU83SXSwmRuqcIKYiEjr8MWPYguP1WiIL9UW2mUtRqlOTQfw
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=CtFVst2XR8WQD1BjV73c3g2&google_push=AYg5qPI6plVUh1pgzgPArIVwDBi9B2lZT2iC0f6maRJrc3Y-xagZAgzU83SXSwmRuqcIKYiEjr8MWPYguP1WiIL9UW2mUtRqlOTQfw
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:38 GMT
via
1.1 google
x-engine-version
0.0.0
server
nginx/1.15.12
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=CtFVst2XR8WQD1BjV73c3g2&google_push=AYg5qPI6plVUh1pgzgPArIVwDBi9B2lZT2iC0f6maRJrc3Y-xagZAgzU83SXSwmRuqcIKYiEjr8MWPYguP1WiIL9UW2mUtRqlOTQfw
x-host
tde-deliveryengine-production-84b97f78fc-9n4gv
alt-svc
clear
content-length
0
match
um.wbtrk.net/doubleclick/user/ Frame 3251
0
0

pixel
cm.g.doubleclick.net/ Frame 3251
Redirect Chain
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKiJumA0u_HbFFBfkTvg-Yk5EyGYqj4ENlRJYTwE-yppn_EXfgBBcx9t...
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKiJumA0u_HbFFBfkTvg-Yk5EyGYqj4ENlRJYTwE-yppn_EXfgBBcx9tFsXgQwr7gsG-pvOWxG03...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKiJumA0u_HbFFBfkTvg-Yk5EyGYqj4ENlRJYTwE-yppn_EXfgBBcx9tFsXgQwr7gsG-pvOWxG03CxUVnbTWfNAlqCxEh3UFw
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 06:46:37 GMT
Server
nginx
Vary
Accept
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKiJumA0u_HbFFBfkTvg-Yk5EyGYqj4ENlRJYTwE-yppn_EXfgBBcx9tFsXgQwr7gsG-pvOWxG03CxUVnbTWfNAlqCxEh3UFw
Connection
close
Content-Type
text/plain; charset=utf-8
Content-Length
240
google
pix.impdesk.com/csync/ Frame 3251
0
0

pixel
cm.g.doubleclick.net/ Frame 3251
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII&google_cver=1&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps...
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps_TPg&go...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps_TPg
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPKZohl55FWI3_Y67R-_snPPObboStgGvBywfqUZED298S8dBMbqj0R4TrMSQC4k05w7ApHevgpMdxJzR2Vzo661FuISps_TPg
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame 3251
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEAzx1b9ZjZ_mPGvvII25Mv8&google_cver=1&google_push=AYg5qPKHk5ZGpkwe06SKYxFb3yxBMfx9BrEy7FcHsbU1jJ1TIfTY7hgoq72pwa-B7Wss33Dn7D6l0F...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKHk5ZGpkwe06SKYxFb3yxBMfx9BrEy7FcHsbU1jJ1TIfTY7hgoq72pwa-B7Wss33Dn7D6l0F3-JxA-b8VkCyLiFQHa7ibrHw&google_hm=Njc3OTYx...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKHk5ZGpkwe06SKYxFb3yxBMfx9BrEy7FcHsbU1jJ1TIfTY7hgoq72pwa-B7Wss33Dn7D6l0F3-JxA-b8VkCyLiFQHa7ibrHw&google_hm=Njc3OTYxODY4ODgyMDQwMTgwMg%3D%3D
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPKHk5ZGpkwe06SKYxFb3yxBMfx9BrEy7FcHsbU1jJ1TIfTY7hgoq72pwa-B7Wss33Dn7D6l0F3-JxA-b8VkCyLiFQHa7ibrHw&google_hm=Njc3OTYxODY4ODgyMDQwMTgwMg%3D%3D
date
Fri, 18 Jun 2021 06:46:37 GMT
content-length
0
attr
cm.g.doubleclick.net/pixel/ Frame 3251
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JXyUepFgeipYFdg1_waQK4mmw1i3Q3XA3RoQfZk_mY_jUExYd1Ov0xf_Nlm33IW4wWiRjY
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:37 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame D60E
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst8LTJQktXlQ8kmYDn5YGqc_mAyTozpQWLMiQTpqGJm7GTRsRfA_8kU_t_SLi2uxQel0_VvBxKiIWsvx2LM6AZQYFjefeNym61NAT0MGqXMB6LHQ9vQc2tsO6U6h1xWS_rEPnbVJfSrRGJoH17jOP3Ilbx9cNKm3VgfdzHOMGW5oZigCwM-m716cx0gBOlM6LB6THzbc48k0bH4F1I9BEOuTwj_uIyXncsbHWdx2dMdVzK-ZDkPhO5M62hlltcfaEmU28DSq4-LuJ8SXzxdruZCqPZn0qX3ws2U&sai=AMfl-YSJO2FxW-WVxFlyfRHOJJMGyjEqPqOqKU9DRz3Gsty26GI-AJN1ke80bb0Gpb5pR2XJi6cv1_SdlH9RAJ0AeDm0cn28XmQgDKaJyiVv54j42dJcF57BySKf1HMyt1g&sig=Cg0ArKJSzDUKd_C-zff9EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:37 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:37 GMT
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame 6973
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=250&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=970&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3709411884436631
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3900
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame C300
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3565838599&adf=4188749683&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fworldtourismgroup.com%2F&ea=0&flash=0&wgl=1&dt=1568467881274&bpp=42&bdt=21&fdt=44&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=1051177114888&frm=23&ife=1&pv=1&ga_vid=1990525009.1568467881&ga_sid=1568467881&ga_hid=1109394268&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=32&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=654&isw=530&ish=534&ifk=4258374561&scr_x=0&scr_y=0&eid=151527007%2C182984000%2C182984200&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C534&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=1044&bc=31&osw_key=1317328505&ifi=1&uci=1.746w5gtp7s5o&fsb=1&p=https%3A%2F%2Fworldtourismgroup.com%2F&dtd=56&0.6890766207188799
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3900
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
css
fonts.googleapis.com/ Frame D58D
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 05:30:47 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:38 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame D58D
1 KB
913 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
454
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame D58D
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
452
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame D58D
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
97
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D58D
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:38 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame D58D
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame D58D
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTnw8-kkW5rnY7B-X2GoQ-RuUufa88rWxXa5nqzVPahFNifsI7ehOmApGA3R5D1wq_Uca2Fdxs0vW4B8omgxqysaFNzJg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame D58D
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86732
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/14738076059717248402/ Frame D58D
26 KB
26 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/14738076059717248402/downsize_200k_v1?w=600&h=314
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f8533d3a748458fe5a5a8d3f562b3535bd151c6cb9af4fafb7839d176a8cd2ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 04:05:19 GMT
x-content-type-options
nosniff
age
528079
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26579
x-xss-protection
0
last-modified
Fri, 28 Feb 2020 09:28:30 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 04:05:19 GMT
truncated
/ Frame D58D
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 786C
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515154
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 786C
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503890
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
pixel
cm.g.doubleclick.net/ Frame 49B3
Redirect Chain
  • https://um.simpli.fi/gp_match?google_gid=CAESEP8gi1JMN_3Mu6KF7r4pAOs&google_cver=1&google_push=AYg5qPI1kWOXGDecxhbsJYYj7MrTST6ISZpYbmYYPRqqiTqjp1DTggwn97cG5NNkbMrNedGfJb9TWQk10kFId8W_9pIIBijVWOPN
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=9BE2451957054AD9AC79E95519088E6A&google_push=AYg5qPI1kWOXGDecxhbsJYYj7MrTST6ISZpYbmYYPRqqiTqjp1DTggwn97cG5NNkbMrNedGfJb9TWQk10kFId8W...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=9BE2451957054AD9AC79E95519088E6A&google_push=AYg5qPI1kWOXGDecxhbsJYYj7MrTST6ISZpYbmYYPRqqiTqjp1DTggwn97cG5NNkbMrNedGfJb9TWQk10kFId8W_9pIIBijVWOPN
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=9BE2451957054AD9AC79E95519088E6A&google_push=AYg5qPI1kWOXGDecxhbsJYYj7MrTST6ISZpYbmYYPRqqiTqjp1DTggwn97cG5NNkbMrNedGfJb9TWQk10kFId8W_9pIIBijVWOPN
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
154
expires
Thu, 17 Jun 2021 06:46:38 GMT
pixel
cm.g.doubleclick.net/ Frame 49B3
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEK_5uRIQqXkTpZKKJNjB0KY&google_cver=1&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUH...
  • https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEK_5uRIQqXkTpZKKJNjB0KY&google_cver=1&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUa...
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=google
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=07f1ce62-0aa4-4ee1-93cb-2d4496f46fb5&ssp=google
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUHqN9rMzQ&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUHqN9rMzQ&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJ_xnI9VApmJVdelvgy6JFHHDvcAkT4Oaepe1wkUzwn0698MOZfsgfcVcN044QtyiSQZju0ar0iKdSSUaeAiUUHqN9rMzQ&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
pixel
cm.g.doubleclick.net/ Frame 49B3
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPIZe1H8YKm_xGVv9hPGEsIq40VejX7kZJ2z2PzouyGvcNsZyBoTsOEwVYM4IVdojtMMaU9J6Wl0SxTDYLlf3FW4yny...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPIZe1H8YKm_xGVv9hPGEsIq40VejX7kZJ2z2PzouyGvcNsZyBoTsOEwVYM4IVdojtMMaU9J6Wl0SxTDYLlf3FW4ynySZ6M&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPIZe1H8YKm_xGVv9hPGEsIq40VejX7kZJ2z2PzouyGvcNsZyBoTsOEwVYM4IVdojtMMaU9J6Wl0SxTDYLlf3FW4ynySZ6M&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:38 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPIZe1H8YKm_xGVv9hPGEsIq40VejX7kZJ2z2PzouyGvcNsZyBoTsOEwVYM4IVdojtMMaU9J6Wl0SxTDYLlf3FW4ynySZ6M&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 49B3
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEBDMoYTEQYLlcVCCJJVCbD8&google_cver=1&google_push=AYg5qPIEPiN-v3agmOviHfAgsvB847_jf-S5JW3o08OtvWGVJ5wwA_oKqt1-xxuHaxxN1r--vBsrQEf7...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPIEPiN-v3agmOviHfAgsvB847_jf-S5JW3o08OtvWGVJ5wwA_oKqt1-xxuHaxxN1r--vBsrQE...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPIEPiN-v3agmOviHfAgsvB847_jf-S5JW3o08OtvWGVJ5wwA_oKqt1-xxuHaxxN1r--vBsrQEf74rg5ZRichogkB8910zZT
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
nginx
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzgxMjM3MTczMzQzODkwMzA0OA&google_push=AYg5qPIEPiN-v3agmOviHfAgsvB847_jf-S5JW3o08OtvWGVJ5wwA_oKqt1-xxuHaxxN1r--vBsrQEf74rg5ZRichogkB8910zZT
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 49B3
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsH...
0
0

pixel
cm.g.doubleclick.net/ Frame 49B3
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII&google_cver=1&google_push=AYg5qPLwAtFGl0iAaQN7e63EyFQbMxtVy31go5w0KQy6ybfjxoZV739KhEd5eWcoi2IgevLxwNaOIvyF1UC6_f8GLhrXg0V8HHY
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPLwAtFGl0iAaQN7e63EyFQbMxtVy31go5w0KQy6ybfjxoZV739KhEd5...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPLwAtFGl0iAaQN7e63EyFQbMxtVy31go5w0KQy6ybfjxoZV739KhEd5eWcoi2IgevLxwNaOIvyF1UC6_f8GLhrXg0V8HHY
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPLwAtFGl0iAaQN7e63EyFQbMxtVy31go5w0KQy6ybfjxoZV739KhEd5eWcoi2IgevLxwNaOIvyF1UC6_f8GLhrXg0V8HHY
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
dot.gif
s0.2mdn.net/ Frame 49B3
43 B
63 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEEdFKxwiLdqi10Na4lixJQk&google_cver=1&google_push=AYg5qPIzWrNjadRSIKuluqNt3oxZIzJU3nCHeW4BJWvXVOn_RkxPVSdfrroc-cETxtHiRGKOqNALgSNHzfpX5CyODU9OjQICYGRyZQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 06:46:38 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 49B3
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lrt1oQtYjyv8WbMokZM0VQ9pOfbW6pUGRaxJaXKG9ZOygB2lMlmzpDm9ejVXTddMK49d4l4Q
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
css
fonts.googleapis.com/ Frame 63E0
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 06:24:50 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:38 GMT
css
fonts.googleapis.com/ Frame 276B
3 KB
578 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 05:53:10 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:38 GMT
css
fonts.googleapis.com/ Frame 0B57
2 KB
531 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 18 Jun 2021 05:32:53 GMT
server
ESF
date
Fri, 18 Jun 2021 06:46:38 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 18 Jun 2021 06:46:38 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9B9C
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst6BcTh6riZDVTRX6ttHDCA1e1zuPXvSijldtuTami9AeF_C3wTd6r6_NrXvD5lfN_iaZnCom2iMvLa0AzQ8WP8nv415NngxKFBw83xl1qIIWNGEJtCw5EGgO7n2-YpFgBgrzMGqvBfbEbCYXdBAy3FCpuLoYNh99QZTPG9SLuM5HPgy8kMON5g5R8FstQy4crqbEnLxbnTh-AlJ8FkRNZXoj9ZtLQOuTFM4TIYAE4FpB0qaN3VtZVVj2YCfQBGFrrlVdkGQJcicCHFByIHimkJXD-Mbg&sai=AMfl-YS3X_J-5NmMiWCrQ64QjP3iEtQ1_YtdupzZHzSlRbBn6dCGf0F7V9VwnLhoDiX1YU5mzBwHsf0dufPjyvonEVDB60nIpdif_lvq73rBl4GdkgVnro_VEnVgsYBjEeAB&sig=Cg0ArKJSzEjzoOX9nkDwEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:38 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame E23D
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78220
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 63E0
1 KB
913 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
454
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 63E0
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
452
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 63E0
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
97
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 63E0
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:38 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 63E0
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame 63E0
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSHvzYUsZ08114fUmDi2Ktt_fovEg_8wRb6bYdl0dqoedlWYMLIRrble4sZJt18daFpBSZSeqKxHlM1xqjst4dzFcGMOw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 63E0
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86732
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 276B
1 KB
913 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
454
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 276B
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
452
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 276B
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
97
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 276B
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:38 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 276B
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame 276B
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSx5cbzYzUErcy90fp-wPlrxX_iAAeui11OjXO9vNjRy3pzEGfYtrkF5EwNfX9mCJp864HGWAB4kCQSmgm_FhNZ0eMEyQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 276B
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86732
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
load_preloaded_resource_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0B57
1 KB
913 B
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
454
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
882
x-xss-protection
0
server
cafe
etag
11243716317595354070
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:04 GMT
abg_lite_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/ Frame 0B57
17 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/abg_lite_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:39:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
452
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7072
x-xss-protection
0
server
cafe
etag
14457676323939599074
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:39:06 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0B57
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:45:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
97
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1385
x-xss-protection
0
server
cafe
etag
10711834930267210186
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:45:01 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0B57
122 KB
37 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server
sffe
etag
"1623842920177421"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
38075
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:38 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/ Frame 0B57
13 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
33
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5706
x-xss-protection
0
server
cafe
etag
10674426802404029766
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 02 Jul 2021 06:46:05 GMT
l
www.google.com/ads/measurement/ Frame 0B57
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRXdRY_tCIPOvyDwXQgeMdLbvLGyQRR6mcEK-iCFr3ShqScES32gvf-XKuofjnY2nwEjQlpuu00CHZGhRCRHvhCzwvzdA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

5be26e13f65761684aaaff0594247b1f.js
www.gstatic.com/mysidia/ Frame 0B57
25 KB
10 KB
Script
General
Full URL
https://www.gstatic.com/mysidia/5be26e13f65761684aaaff0594247b1f.js?tag=mysidia_one_click_handler_one_afma_2019
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 17 Jun 2021 06:41:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
86732
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10687
x-xss-protection
0
last-modified
Thu, 17 Jun 2021 06:31:32 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7776000
accept-ranges
bytes
expires
Wed, 15 Sep 2021 06:41:06 GMT
shopping
encrypted-tbn0.gstatic.com/ Frame 0B57
26 KB
26 KB
Image
General
Full URL
https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSjlAn_rpgu-0y5tVR3RKX-kDZVsPjwYsa5G9aN34BK8AIXY07SU9nFdIDf4w&usqp=CAI
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b7229ec361efa820b9ec7ea04bd77581cbc89d17b645820715d748a06322b1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:36:15 GMT
x-content-type-options
nosniff
last-modified
Thu, 26 Nov 2020 01:47:57 GMT
server
sffe
age
504623
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type
image/jpeg
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26365
x-xss-protection
0
expires
Sun, 12 Jun 2022 10:36:15 GMT
shopping
encrypted-tbn3.gstatic.com/ Frame 0B57
33 KB
34 KB
Image
General
Full URL
https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcTBIpMhOf-NJkmfUG8i359LLwbhEQEUEX-vFCPpjtfOcROp8z9wOy39jat1_w&usqp=CAI
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c7dd14620f5650c08f9cdc751c0df99e4133337edd54f6527faec8bd1b3e88c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 04:58:55 GMT
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 15:24:25 GMT
server
sffe
age
524863
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type
image/jpeg
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33826
x-xss-protection
0
expires
Sun, 12 Jun 2022 04:58:55 GMT
shopping
encrypted-tbn1.gstatic.com/ Frame 0B57
40 KB
41 KB
Image
General
Full URL
https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcTBXKMnc7ezgrYEXSsVpuQDvVOrE8b5MdT3_rAw-3xGxdgDUBgAZJKTvxWqjgM&usqp=CAI
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eaeebeddc3ece3448bd52fa6ad8494f2dd6afd869d38aaee596c757c53343bdf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 15:32:17 GMT
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 13:13:37 GMT
server
sffe
age
486861
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
content-type
image/jpeg
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41142
x-xss-protection
0
expires
Sun, 12 Jun 2022 15:32:17 GMT
2401371329490837093
tpc.googlesyndication.com/simgad/ Frame 0B57
Redirect Chain
  • https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKD34sLimAEQgAkYgQkyCLhTVvxEnQYN
  • https://tpc.googlesyndication.com/simgad/2401371329490837093
98 KB
98 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/2401371329490837093
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
270be58b040d0b59d87a4deea0ca09e1b49916b84858005cd3e3e1f2d302ba32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 08:58:35 GMT
x-content-type-options
nosniff
age
510483
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100649
x-xss-protection
0
last-modified
Wed, 05 May 2021 19:23:23 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 08:58:35 GMT

Redirect headers

timing-allow-origin
*
date
Thu, 17 Jun 2021 13:50:11 GMT
x-content-type-options
nosniff
server
cafe
age
60987
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://tpc.googlesyndication.com/simgad/2401371329490837093
cache-control
public, max-age=2592000
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Sat, 17 Jul 2021 13:50:11 GMT
downsize_200k_v1
tpc.googlesyndication.com/simgad/7858866382639373275/ Frame 63E0
26 KB
26 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/7858866382639373275/downsize_200k_v1?w=300&h=300
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3edc07e9053e5f74fe42260ea0806366e67dd743ba43370afe0b1a21c3061978
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 11:30:48 GMT
x-content-type-options
nosniff
age
501350
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26713
x-xss-protection
0
last-modified
Tue, 19 Jan 2021 14:01:21 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 11:30:48 GMT
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame A9C3
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.5237555739773243
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3901
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame D58D
0
20 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=jca&jc=26&version=r20210616&sample=0.01
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210616/r20110914/client/load_preloaded_resource_fy2019.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame D58D
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1411d96afa510f9ab6d3982946b9cf9c0603622e61d08299d653c4011eb53e75

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
view_pixel_1x1.gif
secureir.ebaystatic.com/cr/mscdn/64e017fc0bf98153dd694dc97d24a1ac/ Frame 0B57
Redirect Chain
  • https://www.ebayadservices.com/marketingtracking/v1/ar?mkrid=707-157687-884638-9&mkcid=4&mkevt=2&mpt=4187233676&ff18=mWeb&siteid=77&adtype=0&size=1x1&ipn=admain2&placement=529704
  • https://secureir.ebaystatic.com/cr/mscdn/64e017fc0bf98153dd694dc97d24a1ac/view_pixel_1x1.gif
43 B
549 B
Image
General
Full URL
https://secureir.ebaystatic.com/cr/mscdn/64e017fc0bf98153dd694dc97d24a1ac/view_pixel_1x1.gif
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.89.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-89-51.deploy.static.akamaitechnologies.com
Software
envoy /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

suppress-x-frame-options
true
content-encoding
gzip
x-content-type-options
nosniff
x-cache-lookup
MISS from include-cache-1:80
x-ebay-pop-id
UFES2-SYD-irstatic-1
akamai-grn
, 0.8c6656b8.1623998798.144194c5
x-envoy-upstream-service-time
262
content-length
57
x-xss-protection
1; mode=block
server
envoy
date
Fri, 18 Jun 2021 06:46:38 GMT
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
access-control-allow-credentials
true
rlogid
t6q%60uebwh%3D9vjdq%60uebwh*5kkvq%28rbpv6770-17569c27810-0xce
access-control-allow-headers
*
expires
Sat, 18 Jun 2022 06:46:38 GMT

Redirect headers

Date
Fri, 18 Jun 2021 06:46:38 GMT
Strict-Transport-Security
max-age=31536000
Content-Type
image/gif
Location
https://secureir.ebaystatic.com/cr/mscdn/64e017fc0bf98153dd694dc97d24a1ac/view_pixel_1x1.gif
Cache-Control
private,no-cache,no-store
RlogId
t6baubqsodf%3F%3Cumjgcp%60tqjfc*na%7Cdt%28rbpv6713-17a1ddf1bd8-0x233d
Connection
keep-alive
Keep-Alive
timeout=20
Content-Length
0
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame D58D
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515154
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame D58D
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503890
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 6AD9
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78220
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame D197
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78220
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
activeview
pagead2.googlesyndication.com/pcs/ Frame 874C
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvtUH3Qavxa3OSPUdEY8ieylMqHGWTc44-Otyakj_A4h_Xx0gcHpxH4_NgeNHnKU4w0VYpcTzrBViMEmo2w1oOkD9BUQ2RkHnAGq9LAC2s&sig=Cg0ArKJSzIDXRKdNq6BIEAE&id=lidar2&mcvt=1132&p=348,315,598,1285&mtos=1132,1132,1132,1132,1132&tos=1132,0,0,0,0&v=20210616&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=816432149&rs=4&met=ce&la=1&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1623998795533&dlt=0&rpt=330&isd=0&msd=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame CF58
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsueSHHjiJZIidd5FxBnQSvPtIMBk7zesvXcLkvDNNiqnz4yKlxqUYxtTfs5h507jHm-xxAptMjOmiA_IxvQ9ypscVOIcUcx79KufOtwBO1YLwgCynIZkxTrKQ5zzw&sai=AMfl-YQrZgOsRZ6ZmYAc-UaCrpf_IDP5-tO3pclKyNwlKC7I67yL3HjlK8X7FmYFg-1bqkfCc0jtZ4ideXnbDTIWkREmwcDSdQpV8LI&sig=Cg0ArKJSzFT6DrpFcHsAEAE&cid=CAASF-RolEcEnhKPoKRJeEq73bSkG5cB1S0S&id=lidar2&mcvt=1134&p=0,0,250,970&mtos=1134,1134,1134,1134,1134&tos=1134,0,0,0,0&v=20210616&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=3986104005&rs=5&met=mue&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&r=v
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame 63E0
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
786f0176069ed859b81fbc69af45e22a1fc88be3127402985af6fc9ed1b7b527

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame ACA6
1 KB
749 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
pagead2.googlesyndication.com
:scheme
https
:path
/pagead/s/cookie_push_onload.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://googleads.g.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
date
Thu, 17 Jun 2021 09:02:58 GMT
expires
Fri, 18 Jun 2021 09:02:58 GMT
content-type
text/html; charset=UTF-8
etag
48472445140208031
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
724
x-xss-protection
0
age
78220
cache-control
public, max-age=86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
truncated
/ Frame 276B
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
78b0e2671e2b5a9a34ba9508348c05f8e1afe703086c6bc30d8a489720716fe9

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 0B57
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b9f06410858629bfa26244bba46739e5d179fca99e32c0d4e4f35d2454c0f5fe

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 276B
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515154
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 276B
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503890
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
pixel
cm.g.doubleclick.net/ Frame E23D
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU14QlRBQUJwWG5zU0FCZw==&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_cver=1&google_push=AYg5qPLRIeRcvC6PbRA5EZPc9WEyuC5PtV...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU14QlRBQUJwWG5zU0FCZw==&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_cver=1&google_push=AYg5qPLRIeRcvC6PbRA5EZPc9WEyuC5PtVd2D32Td6vMlGs9CiwzZmenfwOIj5YGQEvPPdHJUf2lQbBRYZ1_Ul5ZkQuIuBXZH0Y
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
via
1.1 varnish
server
Varnish
x-timer
S1623998799.714396,VS0,VE0
x-served-by
cache-hhn4049-HHN
x-cache
HIT
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WU14QlRBQUJwWG5zU0FCZw==&google_gid=CAESEKeMiE_5I8wu3UpjCFj9pTw&google_cver=1&google_push=AYg5qPLRIeRcvC6PbRA5EZPc9WEyuC5PtVd2D32Td6vMlGs9CiwzZmenfwOIj5YGQEvPPdHJUf2lQbBRYZ1_Ul5ZkQuIuBXZH0Y
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
pixel
cm.g.doubleclick.net/ Frame E23D
Redirect Chain
  • https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEHc3PwHYk_qgs097nsbhhso&google_cver=1&google_push=AYg5qPIMI67bJ1Thh1B3_41StVBpOM8k62WFRFJFKDTu8lQmmaqMQMzaitV1sHaNS6B4-3e1yD-AO4Jb9xw...
  • https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIMI67bJ1Thh1B3_41StVBpOM8k62WFRFJFKDTu8lQmmaqMQMzaitV1sHaNS6B4-3e1yD-AO4Jb9xwxF1zQAlZP8gnaBRo&google_hm=rSH-4C1iSX2uF-QuSC74M-8
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIMI67bJ1Thh1B3_41StVBpOM8k62WFRFJFKDTu8lQmmaqMQMzaitV1sHaNS6B4-3e1yD-AO4Jb9xwxF1zQAlZP8gnaBRo&google_hm=rSH-4C1iSX2uF-QuSC74M-8
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIMI67bJ1Thh1B3_41StVBpOM8k62WFRFJFKDTu8lQmmaqMQMzaitV1sHaNS6B4-3e1yD-AO4Jb9xwxF1zQAlZP8gnaBRo&google_hm=rSH-4C1iSX2uF-QuSC74M-8
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
clear
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
AdxPixel
tr.blismedia.com/v1/api/sync/ Frame E23D
0
113 B
Image
General
Full URL
https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEHGSYk0J-xuHhKQcar4Qeiw&google_cver=1&google_push=AYg5qPL3lgyyAvs4nhEv2_oVGdhswK3-lTwt1sws-6Lc9b8Vwk9zMDgpFyI8uGeoZoWfBOpVPrjE1vmjQc2JSjH8pShfzF5eIIk
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
via
1.1 google
alt-svc
clear
pixel
cm.g.doubleclick.net/ Frame E23D
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPKIHAXpPOZyB5hl5T0uQVXTRL_D9DQf__e9U-Dw7fN6UjLxaPMINSKK31zzZZsK_ALK1lLJIW9R1FepnZTfbhFgOPW...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKIHAXpPOZyB5hl5T0uQVXTRL_D9DQf__e9U-Dw7fN6UjLxaPMINSKK31zzZZsK_ALK1lLJIW9R1FepnZTfbhFgOPWtxGE&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKIHAXpPOZyB5hl5T0uQVXTRL_D9DQf__e9U-Dw7fN6UjLxaPMINSKK31zzZZsK_ALK1lLJIW9R1FepnZTfbhFgOPWtxGE&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:38 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPKIHAXpPOZyB5hl5T0uQVXTRL_D9DQf__e9U-Dw7fN6UjLxaPMINSKK31zzZZsK_ALK1lLJIW9R1FepnZTfbhFgOPWtxGE&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame E23D
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67...
0
0

pixel
cm.g.doubleclick.net/ Frame E23D
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEI...
  • https://sync.targeting.unrulymedia.com/csync/RX-2b67f067-5b25-414e-85df-81e86d5318c5-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPLUmT4Ds9cyjaFW_sOBT...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLUmT4Ds9cyjaFW_sOBTX0uYulqGNGBMeNZ4gYeAvZBZ-RLUhsD9QKvFnIS1CTpEHfspX2f94rg0kjFJ731g8h8VXB8iuQ&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLUmT4Ds9cyjaFW_sOBTX0uYulqGNGBMeNZ4gYeAvZBZ-RLUhsD9QKvFnIS1CTpEHfspX2f94rg0kjFJ731g8h8VXB8iuQ&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLUmT4Ds9cyjaFW_sOBTX0uYulqGNGBMeNZ4gYeAvZBZ-RLUhsD9QKvFnIS1CTpEHfspX2f94rg0kjFJ731g8h8VXB8iuQ&google_hm=Aytn8GdbJUFOhd-B6G1TGMU
date
Fri, 18 Jun 2021 06:46:38 GMT
server
Tengine
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX2b67f0675b25414e85df81e86d5318c5003
content-type
text/html
dot.gif
s0.2mdn.net/ Frame E23D
43 B
63 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEEdFKxwiLdqi10Na4lixJQk&google_cver=1&google_push=AYg5qPLyHrSB23avGh634R_xYNapnhntDBCYmwTvCja_43zPLIVWmWMp5rDrljM2uWlkNnYPbIBa8l6-O-dHv_z3Ny961e_Hmjd8
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 06:46:38 GMT
attr
cm.g.doubleclick.net/pixel/ Frame E23D
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LA25jLA4yjDH6xa_udHkpMsbST8ztLF66UJhW-Rywxiz0luCm8WrDrfUEs1xH8EgfAZbSSLA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 2C79
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvBlqraHxm9QYBFkhTkPaFe2qz4yYaU9N-bl4sU3gPHRy3hp5umY06FuwQvyvCStCpj3-IUxsinnRn6XsIpXKvn-vyKciTSKf2Is1_UDJLzPGU527DmKFQH0BHbZJ2L4-zlZDew6uEYKiR6z0f8J8VUcxtcFrTgKBdrhXAQYuGbkVNQNR5wCyE4pFmvBEDoyNTw8508Bt1oSzUtjNCcQR-plAGcgnMmZ8P1MecGi2bYIYbe3zypEP04_FIaueqI1iYasj4PNCnkkgcLOOSAkrBwLEC-IA&sai=AMfl-YRpcfcYwyQBN5YdNEMqyepXoUXC_fILJVKYRLfQivM8GNcYVnSVzqHcrcELGaDZlzGTuSxrkQzxPO9YaKM-TJuLqWlRmsRJZdpiV2Vvrm3Dkz7aUVmdHPXuZqTdaxhK&sig=Cg0ArKJSzHoBUgCVtusREAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:38 GMT
4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 63E0
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 07:40:44 GMT
x-content-type-options
nosniff
age
515154
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21716
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:21 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 07:40:44 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 63E0
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 10:48:28 GMT
x-content-type-options
nosniff
age
503890
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21552
x-xss-protection
0
last-modified
Wed, 11 Nov 2020 20:26:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 10:48:28 GMT
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame D10E
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.3421399326003087
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3901
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v15/ Frame 0B57
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/googlesansdisplay/v15/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://googleads.g.doubleclick.net
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 12 Jun 2021 13:27:23 GMT
x-content-type-options
nosniff
age
494355
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20900
x-xss-protection
0
last-modified
Mon, 19 Apr 2021 22:53:16 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 12 Jun 2022 13:27:23 GMT
pixel
cm.g.doubleclick.net/ Frame 6AD9
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPI_ktnjrNYThXxNwwHZJjN9GSgbpbWSQLViOL3bttOQh1LM-HaJDsvc9oThcQQigfC3Yl4MC8Z...
  • https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
pixel
cm.g.doubleclick.net/ Frame 6AD9
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEK_5uRIQqXkTpZKKJNjB0KY&google_cver=1&google_push=AYg5qPL8hSGghH8NSPUjVN9t8bmAVaPk5r3WD5MeIf9zqnLfSoKdfMa7buP_pWQLKHou90c2P6P5SL3WPplzHKGk_c4R...
  • https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPL8hSGghH8NSPUjVN9t8bmAVaPk5r3WD5MeIf9zqnLfSoKdfMa7buP_pWQLKHou90c2P6P5SL3WPplzHKGk_c4Ri3fM78Hv&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPL8hSGghH8NSPUjVN9t8bmAVaPk5r3WD5MeIf9zqnLfSoKdfMa7buP_pWQLKHou90c2P6P5SL3WPplzHKGk_c4Ri3fM78Hv&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
//cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPL8hSGghH8NSPUjVN9t8bmAVaPk5r3WD5MeIf9zqnLfSoKdfMa7buP_pWQLKHou90c2P6P5SL3WPplzHKGk_c4Ri3fM78Hv&google_hm=tzPbcIKDRkCbqDLUwmjIxA==
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
dot.gif
s0.2mdn.net/ Frame 6AD9
43 B
63 B
Image
General
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESEAzhYmucyVOyYjMEvuiKdV4&google_cver=1&google_push=AYg5qPLWZIAA97TOkOpeqRTPhx4CGJOEJlGWLz7FPANx3ufwogCpQcWpikGi67VTc-5sFk9I3gCjrXncMAQ68jZGOXpxcMs-bnYjxQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Sat, 19 Jun 2021 06:46:38 GMT
pixel
cm.g.doubleclick.net/ Frame 6AD9
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPJuzMT88PylMBS3SnxhXjwNmumhimwV-WNDPFYsSBW6QA1qADATRPmXpKmANpuWBipKhfHt3NS8X3fr--om3X1SDdo01nLGXw
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJuzMT88PylMBS3SnxhXjwNmumhimwV-WNDPFYsSBW6QA1qADATRPmXpKmANpuWBipKhfHt3NS8X3fr--om3X1SDdo01nLGXw&google_hm=u-W4KiAIy8QwakUuezdY1w==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJuzMT88PylMBS3SnxhXjwNmumhimwV-WNDPFYsSBW6QA1qADATRPmXpKmANpuWBipKhfHt3NS8X3fr--om3X1SDdo01nLGXw&google_hm=u-W4KiAIy8QwakUuezdY1w==
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:37 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPJuzMT88PylMBS3SnxhXjwNmumhimwV-WNDPFYsSBW6QA1qADATRPmXpKmANpuWBipKhfHt3NS8X3fr--om3X1SDdo01nLGXw&google_hm=u-W4KiAIy8QwakUuezdY1w==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-request-id
rcmtd3mbtlu86bl3sef42qtfdc7jana3
pixel
cm.g.doubleclick.net/ Frame 6AD9
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEE-CF40SPPPEOLJ-HF5OkPg&google_cver=1&google_push=AYg5qPLv-2VqzJB2lTUaa8PtFUNPBlim6D-gsYE6D3lCDI7Om6OKEjeR-5vGdN11yS4mgTPcSzE...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDVzEtMTctNkRQNg==&google_push=AYg5qPLv-2VqzJB2lTUaa8PtFUNPBlim6D-gsYE6D3lCDI7Om6OKEjeR-5vGdN11yS4mgTPcSzEgHr2FkIb8_-rGacGd_rUs2Wvp9g
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDVzEtMTctNkRQNg==&google_push=AYg5qPLv-2VqzJB2lTUaa8PtFUNPBlim6D-gsYE6D3lCDI7Om6OKEjeR-5vGdN11yS4mgTPcSzEgHr2FkIb8_-rGacGd_rUs2Wvp9g
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDVzEtMTctNkRQNg==&google_push=AYg5qPLv-2VqzJB2lTUaa8PtFUNPBlim6D-gsYE6D3lCDI7Om6OKEjeR-5vGdN11yS4mgTPcSzEgHr2FkIb8_-rGacGd_rUs2Wvp9g
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
611afce88997db6fdd35eb213e662871
Expires
0
pixel
cm.g.doubleclick.net/ Frame 6AD9
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8...
0
0

pixel
cm.g.doubleclick.net/ Frame 6AD9
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEEXxmZCiCDZ_NKmzP-DDwII&google_cver=1&google_push=AYg5qPIiJLJwZsZx9JvLiuOTjWIypv5ZDoapuwS47fyEwQ-pGt-mp84YsKYzIQitJGkOhwLH57qR7Db5CrS99G-WcQJbJiRhBMPj
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPIiJLJwZsZx9JvLiuOTjWIypv5ZDoapuwS47fyEwQ-pGt-mp84YsKYz...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPIiJLJwZsZx9JvLiuOTjWIypv5ZDoapuwS47fyEwQ-pGt-mp84YsKYzIQitJGkOhwLH57qR7Db5CrS99G-WcQJbJiRhBMPj
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzUyNzMxMzYxMjI4NDc0OTQxMA%3D%3D&google_push=AYg5qPIiJLJwZsZx9JvLiuOTjWIypv5ZDoapuwS47fyEwQ-pGt-mp84YsKYzIQitJGkOhwLH57qR7Db5CrS99G-WcQJbJiRhBMPj
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
attr
cm.g.doubleclick.net/pixel/ Frame 6AD9
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L60ONK7oD0L19ZOGkP2fO1R-fcS4JMg-RoCavJE52ZuHSj7aKrkLsPLX9yTwH5qnqW4j1G
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.791013593747445
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 2E4A
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssO8YSnhBwIlMYv5rIYmK53EJtwMdtYherBzPeOVjdQsWwVl-eASklIQIU-83SaDAK91KbWlA6M2_D6yekMDV2Z8l6Ui7A6nvoZ_Zook8_cM-wHEpO3h1JM3U9fEGOgpqXEHWBn9aPFZ2PA-_dDYALjdR4GBtbXH7XRS_txIkfaTy1GkVihWTh_Po7ensCfOYiKZAOgBVJmtClxIA-LSibn2oQJ_yMwobrDLzA65Ij_abXUloibGvpzlR_nRJjvWH838lM1uEWHrmzFtBCZcwoD-I0ORNXumUXf&sai=AMfl-YSnQ8jhmyI8GTHQnT5nakbig3-wAPLAPKo43Xkoaf-imQggEKJ9U75nZiT3ckwDjvJG7AdbPK38ocCBqzgw5d-avsKoEF_pbB65WjYXUcCwgjMl13DhaDVX-SuolmGK&sig=Cg0ArKJSzB0R33u44V3bEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:38 GMT
google
match.adsrvr.org/track/cmf/ Frame D197
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFwv-Uue8xw1BQYraO9VNUo&google_cver=1&google_push=AYg5qPLrEFCRAE1PM0F85mY1WzvUgRP9dI7fCvmKkAe5uEq0pGRhMJG6kwlZwH6zfgaz9-2kW6VogIGU2YVeTw3bD25hnq2fg9TM
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame D197
Redirect Chain
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPKCmI1WCRMbi0ttWH_1HahDu89haD3q4R9FmfHKGyOySu5w26SGL_xGt...
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKCmI1WCRMbi0ttWH_1HahDu89haD3q4R9FmfHKGyOySu5w26SGL_xGtdlzNOzGqb3ExOs1b8KYW...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKCmI1WCRMbi0ttWH_1HahDu89haD3q4R9FmfHKGyOySu5w26SGL_xGtdlzNOzGqb3ExOs1b8KYWmDCQCkHaaUCpupFo_CV
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 06:46:38 GMT
Server
nginx
Vary
Accept
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPKCmI1WCRMbi0ttWH_1HahDu89haD3q4R9FmfHKGyOySu5w26SGL_xGtdlzNOzGqb3ExOs1b8KYWmDCQCkHaaUCpupFo_CV
Connection
close
Content-Type
text/plain; charset=utf-8
Content-Length
238
gg_pixel
sync.adaptv.advertising.com/ Frame D197
14 B
14 B
Image
General
Full URL
https://sync.adaptv.advertising.com/gg_pixel?google_gid=CAESEEvrDVmviiMkKrfWyZ1BLTY&google_cver=1&google_push=AYg5qPLfsSpWuUZJPgiMgkR2qBBGAl1R5VQLjYFI2PHFu5MnbFZefCVy0ZHE1TpJyi1H3hDmsvcXmMrTphKJrQiSBIkqdwJqhlWv
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.230.12.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-12-180.compute-1.amazonaws.com
Software
ribs2.0 /
Resource Hash
0db80e4ae35fcf307507f9ced66fe9ccb3147c1ea12a60ea034092e6aa3ebf40

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server
ribs2.0
Connection
keep-alive
Content-Length
14
Content-Type
text/plain
pixel
cm.g.doubleclick.net/ Frame D197
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEDDh8iUAauUXgdDCnDL9nS0&google_cver=1&google_push=AYg5qPLUms7GJt4BncAyDeIaMN3KEo2Te8BsSf0vih-uVfBEY9fl_dR_tu7j7U8Qx-T9gZazV3vWd-OJlr4sBDFMFvJfePH...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLUms7GJt4BncAyDeIaMN3KEo2Te8BsSf0vih-uVfBEY9fl_dR_tu7j7U8Qx-T9gZazV3vWd-OJlr4sBDFMFvJfePHXhrc&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLUms7GJt4BncAyDeIaMN3KEo2Te8BsSf0vih-uVfBEY9fl_dR_tu7j7U8Qx-T9gZazV3vWd-OJlr4sBDFMFvJfePHXhrc&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 18 Jun 2021 06:46:38 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLUms7GJt4BncAyDeIaMN3KEo2Te8BsSf0vih-uVfBEY9fl_dR_tu7j7U8Qx-T9gZazV3vWd-OJlr4sBDFMFvJfePHXhrc&google_hm=MTA4NzQ4MTUzOTY5MzgwNDg1Nw%3D%3D
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame D197
Redirect Chain
  • https://rtb.openx.net/sync/dds?google_gid=CAESEL3ZHrpbt1MM7Xb2UafHO-k&google_cver=1&google_push=AYg5qPL2UNAWsUAWd1ijobXIqaTq4WPpf_EbVCeDr9kB1EBLqhtdm1-F-UCuM_fDrUI7OZZ7yXfyswhkCfBUQw3w7QEmmvVE39Fo
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL2UNAWsUAWd1ijobXIqaTq4WPpf_EbVCeDr9kB1EBLqhtdm1-F-UCuM_fDrUI7OZZ7yXfyswhkCfBUQw3w7QEmmvVE39Fo&google_hm=u-W4KiAIy8QwakUuezdY1w==
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL2UNAWsUAWd1ijobXIqaTq4WPpf_EbVCeDr9kB1EBLqhtdm1-F-UCuM_fDrUI7OZZ7yXfyswhkCfBUQw3w7QEmmvVE39Fo&google_hm=u-W4KiAIy8QwakUuezdY1w==
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
via
1.1 google
server
Cowboy
access-control-allow-origin
null
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPL2UNAWsUAWd1ijobXIqaTq4WPpf_EbVCeDr9kB1EBLqhtdm1-F-UCuM_fDrUI7OZZ7yXfyswhkCfBUQw3w7QEmmvVE39Fo&google_hm=u-W4KiAIy8QwakUuezdY1w==
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-request-id
l55tlqogoed5ti04mg3e265uoolfrkl6
pixel
cm.g.doubleclick.net/ Frame D197
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjR...
0
0

pixel
cm.g.doubleclick.net/ Frame D197
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJyLzJSzJcVqCLSJqCTaklg&google_cver=1&google_push=AYg5qPIBaIEAlm5VULc5zDj-9A91nfiH41VJCMERCEU8o2M3Mkc7MQpnKhxANHJJREf-4u-Omc...
  • https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1KcW5IVWVCRTJ1R0VfQ3dnQTZYZ2lNODZNOE43cnpEVn5B&google_push=AYg5qPIBaIEAlm5VULc5zDj-9A91nfiH41VJCMERCEU8o2M3Mkc7MQpnK...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1KcW5IVWVCRTJ1R0VfQ3dnQTZYZ2lNODZNOE43cnpEVn5B&google_push=AYg5qPIBaIEAlm5VULc5zDj-9A91nfiH41VJCMERCEU8o2M3Mkc7MQpnKhxANHJJREf-4u-OmcedwuqsyEEQbZDLz03ng21ygHBr-Q
Requested by
Host: ncmhcso.org
URL: https://ncmhcso.org/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 06:46:38 GMT
Server
ATS/7.1.2.128
Age
0
Strict-Transport-Security
max-age=31536000
P3P
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1KcW5IVWVCRTJ1R0VfQ3dnQTZYZ2lNODZNOE43cnpEVn5B&google_push=AYg5qPIBaIEAlm5VULc5zDj-9A91nfiH41VJCMERCEU8o2M3Mkc7MQpnKhxANHJJREf-4u-OmcedwuqsyEEQbZDLz03ng21ygHBr-Q
Connection
keep-alive
Content-Length
0
attr
cm.g.doubleclick.net/pixel/ Frame D197
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ktu1UGLipElIBhnVsrPH1TT3faKl-XFdbvejVuzaNGn2-6vuQwu0avRLrvxtVWc5Dt6QYw0A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
view
securepubads.g.doubleclick.net/pcs/ Frame 570D
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstPKzDX9cl37fOT7HUiflzi9JIminJX186motJatByEPbZucIb7RWyKYOMb83J2BlmV70Vbg8LPEqlcRYy8bdBeVQT5ZiN-vIYvZuVl35c-xHyE-N_EUYPacD8QlE7inAa9HVLI1F-Vbe4uACYIXjniNCyCYN1SgsC3p3Ellt-fsrflfeK7ml3Hyeb990YBzTzoMBmsFJb7ppl7SC5zmym6hItchN851w2K4MFKkYAxKQnahlx9x9i4XfI85wMMd1lI-Qi-EWq9vIMI4yll1M2xUADVmA&sai=AMfl-YQAE85I166vQ7HJ_uPBzls7vPMQza_DC_RBSr7uO1vD9Muu1LUwNaTLKLt1rHZnAxe-iQCw_Cu6QUAh3uf57ubJoxnER0Pj-yLh5Rfzl7y6ikZIPfOw6oSYgwAj7kA&sig=Cg0ArKJSzNXIwYnoJiVQEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:38 GMT
/
google2waycm.netmng.com/cm/ Frame ACA6
0
0

google
match.adsrvr.org/track/cmf/ Frame ACA6
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFwv-Uue8xw1BQYraO9VNUo&google_cver=1&google_push=AYg5qPIl4dqSuDOwh9bWeGnQ2L8Y2yznXDUlR_eTHSr_3cBpqpELoo84h0Mjx6sfDXp2bGQ_MhxzxG29GTGMNIqlAFZcA15hu-zSjg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a97adde81b00f2ca4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame ACA6
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEFQBYcWgy_KILDdPUhFu6xk&google_cver=1&google_push=AYg5qPLMqVUAB6G7duIOuZK-5rH4_gzS6FNzhJGuH7-iYRZOnWcNn67UNgCSmmzmrA1lVr_cw6OkqOS...
  • https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=Dj1-Zn2DQiG5datEO9HxAmDMQU4
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
pixel
cm.g.doubleclick.net/ Frame ACA6
Redirect Chain
  • https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEOkN1qeHKwiBh1RcmDx8p6k&google_cver=1&google_push=AYg5qPLUu_cqQrSO6Z9rckcxohHALMq9z0X0nvqPJabDpwMNB0pH7IgajCG5z...
  • https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPLUu_cqQrSO6Z9rckcxohHALMq9z0X0nvqPJabDpwMNB0pH7IgajCG5zV_vZ0u75vqHfDjccIcik...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPLUu_cqQrSO6Z9rckcxohHALMq9z0X0nvqPJabDpwMNB0pH7IgajCG5zV_vZ0u75vqHfDjccIcikJilWAQjcFW8gRMJPQ27
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 18 Jun 2021 06:46:38 GMT
Server
nginx
Vary
Accept
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=YImkcLP51NFTyYVfNzEF7Q&google_push=AYg5qPLUu_cqQrSO6Z9rckcxohHALMq9z0X0nvqPJabDpwMNB0pH7IgajCG5zV_vZ0u75vqHfDjccIcikJilWAQjcFW8gRMJPQ27
Connection
close
Content-Type
text/plain; charset=utf-8
Content-Length
238
pixel
cm.g.doubleclick.net/ Frame ACA6
Redirect Chain
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEDOajEUU8ETD67QqOB8O4q4&google_cver=1&google_push=AYg5qPJPbwMkqb80OHsNY-BRefE65g667i6IzxXsPei6C6_G7yzsji1XlXWRzyEAD3bkxPfFGpdybNHKC54ysTXrdZpSmAM...
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJPbwMkqb80OHsNY-BRefE65g667i6IzxXsPei6C6_G7yzsji1XlXWRzyEAD3bkxPfFGpdybNHKC54ysTXrdZpSmAMStbKvsA
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJPbwMkqb80OHsNY-BRefE65g667i6IzxXsPei6C6_G7yzsji1XlXWRzyEAD3bkxPfFGpdybNHKC54ysTXrdZpSmAMStbKvsA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPJPbwMkqb80OHsNY-BRefE65g667i6IzxXsPei6C6_G7yzsji1XlXWRzyEAD3bkxPfFGpdybNHKC54ysTXrdZpSmAMStbKvsA
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
pixel
cm.g.doubleclick.net/ Frame ACA6
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEE-CF40SPPPEOLJ-HF5OkPg&google_cver=1&google_push=AYg5qPKSPBttNTNmasMQ7HOu9VkJndsKuZ7RLn122TlKz6yfdNhLQrF9ze9AlS7NzjLhdH1uRaK...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDWDAtMjQtM0s5NQ==&google_push=AYg5qPKSPBttNTNmasMQ7HOu9VkJndsKuZ7RLn122TlKz6yfdNhLQrF9ze9AlS7NzjLhdH1uRaKh55wAbxeyfMZTK93MbO4u9g5jrg
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDWDAtMjQtM0s5NQ==&google_push=AYg5qPKSPBttNTNmasMQ7HOu9VkJndsKuZ7RLn122TlKz6yfdNhLQrF9ze9AlS7NzjLhdH1uRaKh55wAbxeyfMZTK93MbO4u9g5jrg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1ExWVlDWDAtMjQtM0s5NQ==&google_push=AYg5qPKSPBttNTNmasMQ7HOu9VkJndsKuZ7RLn122TlKz6yfdNhLQrF9ze9AlS7NzjLhdH1uRaKh55wAbxeyfMZTK93MbO4u9g5jrg
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
611afce88997db6fdd35eb213e662871
Expires
0
pixel
cm.g.doubleclick.net/ Frame ACA6
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYD...
0
0

attr
cm.g.doubleclick.net/pixel/ Frame ACA6
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KKQZyaQoKpAaYqvnEL6eaLUyAx1bfIxrJe8GMZw9u64lG6ml8F73KBSv-QGxQk-id1-nCn
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:38 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame 4AA1
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=400&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=580&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.574197203810145
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3901
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0BBA
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsttf2P3DHGHmjnNskdeHMXUTJm_Sv3s-5mq8pIfcy5f4eOtTeG-5M8HFm2nMIA94eA4KO-7MpDKBu9tx1VvhrYmP4V72hW6JvnNDf15mMkberlFIK6A83eIpp6Q9SectlcXoqEWirTvpWOT3zfP1vflWSoFVmMPHgZW9kPNQSPdXcOJHSXkNYEqN1SCrhHkbD3M4Oxf5--aegQmidYhWbRnvZTFbDMzMYssCFXG9PocwswJ-CSTpzkjtr_k50AjaVBx4HiOmQICpQUTGrOIyBRr6sYTstpLxdGZ&sai=AMfl-YSJ-e39Czw-EAkgWdPD-lqjrFdiVQh21IUISYdtChZnYegmJlOnxInan72QVu4r__QUG7d3EY0ZLcN_LTeLAtCOGTPYUJr-5D1MMTbui_Y98Y9ySat9OFJQVlPqjqHg&sig=Cg0ArKJSzLRbmLtVa8HHEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
142.250.185.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:38 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 18 Jun 2021 06:46:38 GMT
sodar
pagead2.googlesyndication.com/getconfig/
10 KB
8 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021061503&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28538536bbfc61b8d81d775fe6ad5aa46c60e55130d10b100624cee7fff51449
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 18 Jun 2021 06:46:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7944
x-xss-protection
0
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame 2610
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6550413363602588&output=html&h=600&slotname=ZXM/ZXM_OPTR/ZXM_OPTR_ALL&adk=3986104005&adf=4188749583&w=300&guci=2.2.0.0.2.2.0.0&url=https%3A%2F%2Fforexox.com%2F&ea=0&flash=0&wgl=1&dt=1568467214166&bpp=40&bdt=56&fdt=43&idt=44&shv=r20190911&cbv=r20190131&saldr=sa&correlator=4362668292350&frm=23&ife=1&pv=1&ga_vid=72328882.1568467214&ga_sid=1568467214&ga_hid=1297433595&ga_fc=0&iag=3&icsg=42&nhd=1&dssz=4&mdo=0&mso=0&u_tz=180&u_his=30&u_java=0&u_h=864&u_w=1536&u_ah=740&u_aw=1536&u_cd=24&u_nplug=3&u_nmime=4&adx=14&ady=55&biw=558&bih=670&isw=530&ish=550&ifk=1003387987&scr_x=0&scr_y=0&eid=151527007%2C368226200%2C368226210%2C410075106%2C20040010&oid=3&rx=0&eae=2&fc=912&brdim=0%2C0%2C0%2C0%2C1536%2C0%2C1536%2C740%2C530%2C550&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=20&bc=31&osw_key=2329077237&ifi=1&uci=1.io7g1trt9o2f&fsb=1&p=https%3A%2F%2Fforexox.com%2F&dtd=71&0.09629985203465985
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3901
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021061503.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 06:46:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1622653785071769"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6437
x-xss-protection
0
expires
Fri, 18 Jun 2021 06:46:39 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/223/ Frame 1FE8
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/223/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5022
date
Fri, 18 Jun 2021 06:29:04 GMT
expires
Sat, 18 Jun 2022 06:29:04 GMT
last-modified
Wed, 17 Mar 2021 18:24:30 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
1055
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
aframe
www.google.com/recaptcha/api2/ Frame 212D
783 B
533 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
3bd1c8bb144ea5c45df63d7e2435e778c86fedb20523ca02353184fceab02751
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-/bGKpJWEvHA4H2Smq2ZFWg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/aframe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://ncmhcso.org/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://ncmhcso.org/

Response headers

expires
Fri, 18 Jun 2021 06:46:39 GMT
date
Fri, 18 Jun 2021 06:46:39 GMT
cache-control
private, max-age=300
content-type
text/html; charset=utf-8
content-security-policy
script-src 'report-sample' 'nonce-/bGKpJWEvHA4H2Smq2ZFWg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
514
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
pagead2.googlesyndication.com/bg/ Frame 1FE8
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/94Gt_qMMOHajVAy-ktkQgEQIoZJrQUA0XxP17Oddwac.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/223/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 18 Jun 2021 05:41:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
3902
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5750
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 13:18:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 18 Jun 2022 05:41:37 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=223&t=2&li=gpt_2021061503&jk=569108319563977&bg=!VFelVxPNAAZktE7iZLQ7ACkAdvg8WsibLAo--FSkNBcaHH97ygVXN1TckBEn3ED2Q9DsIo4cxJBwEwIAAABpUgAAAAxoAQcKADJQ5MtBvWC9acUppI1mjw6nowjPiCzDI0FiUhFzjq6FvgipjYBX5_Q9F4leXDtx6zf0wpkCYxPdBcNTCKr78lXrP8FiosuhbCJv800DA4Wneph50jepp0Uj-t0QfYpT8P2NZ-k00-8ClZ_k0JODv0EtIn4ZZFigVsNzDvm1V87wwUpN_tY8gP8pizGGAg2fWebFURH1qvpuBuJFDEdRdX2PBuO4LLm9NZ8dEO7Jv93s4WfOmuNrpxerTHnQLW-nSLAmc2LNxAJuv-qyqgc1DhTBUKgTVGodeDd1WQCrw9MAxQmqQKBysXiI6tOACn_GziACQncTrwLY3SW1bxXt9KcdMGOC49Tc5lvKmxfeQ02qjyr6fY1mysSzlGeGUClES7K6rzj9f0z748sAqdNOq_Ueqjo8jsFHIYMw8bOhDbWESFBrFCcS9Cd6mB2pm2BWabnPm28vuZqBq_dlBdkHG_Qbxk02z8QLoF7G0TTBSaLWcVId_YWz8jN6RdzGMkxpuPtmViCJ0CeX96FRuYE8O1ssdiePW6FDMWvF1bRljYlVYzBd56ay4KiuIK9R7IsPuxmhXGBqkrvOhxNVlO06nJjAUku8yuZy4IhhORjy52LvT5XcqT1w6kePaq8W2M4cIAmfGMekNSL09sr_v0crr_mgHq-8HzhlN7kKHxeI5Rdza6xXmsrV0t1wKisX9N0loQ03ZR49k36HJY7mDoqM9HCToVDPLVFWbg2ckJGd1pz6DVFo8ZncSchCVx12dospJ99k_hkmQJ1CzokCXoI2QovtCH_9AIVQzyxawbRehjLUKc_GfJQpmemVnbUghLpd6RUxWSlps5lxNXgtGJfRCvNEK0FUI0m3xjpV8wpujHJTAed1sLPVS9NO
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ncmhcso.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:39 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 855B
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=html5-mon&a0=layout&f0=layout&s0=0&d0=190.0000&a1=https&f1=layout_html&s1=0&d1=20.0000&i=513050336398&t=419&c=p&lp=%2Fsadbundle%2F%24csp%253Der3%24%2F7478968233103728381%2Fnt_s21-DE_728x90_find-the-nearest-dealer%2Findex.html&qqi=CLaPv_nKoPECFUYL4AodW38A9w
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Jun 2021 06:46:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPKckK1ZdQNNRdaDbVUE6y8s6GhVS03rvoB6oL_eGjMR5HuZVX2hdxk7jy81Cq0Xs9hGdxgxakUyOeuHqP01hF7PPNdfSuiE
Domain
google2waycm.netmng.com
URL
https://google2waycm.netmng.com/cm/?google_gid=CAESEFQTpDYYpgQz1pHNqL1hyjs&google_cver=1&google_push=AYg5qPJfWx51-1T-X7V0-Zq4ew_nfUKaQyzmZ6C8N9EP_ox6V31fLghJUDNroK3SoWSx7h-WuJZPPLbGYTfGykVGT4wT3gvq8lmVDA
Domain
um.wbtrk.net
URL
https://um.wbtrk.net/doubleclick/user/match?google_gid=CAESEDAslbOIiEYHaPQs5e9Gf_M&google_cver=1&google_push=AYg5qPJOChIzbpa_v0_umt9yBIDGnAG72avGc1LMdfepb5o6yx48EHZSXF_tpmI2IE5iL0AxyppSGnYE-Gs1NPRvfTVNgze3_Puivg
Domain
pix.impdesk.com
URL
https://pix.impdesk.com/csync/google?google_gid=CAESEAtVlKuYi0ibmyFnOtkZhVA&google_cver=1&google_push=AYg5qPLROvRcDvuY57eA2gaGZPYDhUfaUUlPfuPOQolcgU6zTuHzFSU0rD-KeYAyj_MU5LzQAbuhazrUWFgyYdYu1hqL-oZNiJChZQ
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_push=AYg5qPK2Yl5QXBv5J9KAZ4Noxp8k630stcXKJ7V6YzEQJe5sAVz9BX0suHoDP1sT8leHNtunIbsHpsqolBesJhsvm427TxnOF62A&google_gid=CAESEHkNRJUaHwpDClninJ0wpps
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKvyFGbAH7w-rNQLvEw2CchSE6Ckx6KPhGG8UXnfmY9nWf_COCCKhHnsB2KT6Cg8qiGFXtVGtg91Me0Fcoo67d6oZLG9g&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_cver=1&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_push=AYg5qPL5uyuuO5Twrn1U2tGzFqHtzGX3X2FX8qJdXB6DWTgVJpEK-ByrzZ30kiT_XiXqmoH2KvF87dE0vD8nIZBJ7qhyC8x1rhJ93w
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPIPDVcLTEaoSIBJxsiZwWqZmV0-M_3zWZVOcyeY-ozX6TeN8i2TaAiZGJV1PG3v2fSEWKM1hS8wZ06-QOHQjRnv0ZC06OVo&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1
Domain
google2waycm.netmng.com
URL
https://google2waycm.netmng.com/cm/?google_gid=CAESEFQTpDYYpgQz1pHNqL1hyjs&google_cver=1&google_push=AYg5qPK0PJ0agYonnCc_0T26EnnqfRarH2rET68T-el1Yq_x9OJjraGH5ZHmMY9UrePEalJGJs9WAXHaYDVuHLfSaiITH3dOUqvcwQ
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YMxBTFh96lKwzvprQCSk5AAABJQAAAAB&google_push=AYg5qPKD3mIJieADBlmeYdJkpKIc2Y2N9Hs7kJdKylcm7_VCdFbPuD3wroMbJAyhyv6IELXYiL5imvbzuUloehgDYDkeRhkSzM_3&google_gid=CAESEHkNRJUaHwpDClninJ0wpps&google_cver=1

Verdicts & Comments Add Verdict or Comment

163 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| ym undefined| $ function| jQuery object| Sk function| setCookie function| getCookie function| createGeoRestrictionCookie function| setImmediate function| clearImmediate object| regeneratorRuntime object| googletag object| pbjs325474 object| AdSlotCollection object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| adsbygoogle string| google_user_agent_client_hint boolean| engineLoadOnce boolean| __isGoogleAllowed object| __isFromEUPromise function| EventEmitter object| eventie function| imagesLoaded function| getStyleProperty function| getSize function| docReady function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry function| cookie object| jQuery1124039035475258547003 function| Froogaloop function| $f object| html5 object| Modernizr function| yepnope object| Ya object| yaCounter68669068 object| _0xbd59 number| zxadflg_rich_stat boolean| cs_flg string| zxmngname_ext string| yamId string| zx_domaine_ext string| zxadblockmng_ext number| zx_ad_flg boolean| zx_flgCap number| zx_gcWrk boolean| zx_flgOverlay boolean| zx_flgNative function| ZxStartMainModule string| zx_type_ad string| zxadpartner_ext object| __ZXNT number| zxCheckAbsStart object| t object| e object| __ZXCONSENT object| ajax_btn_str object| ajax_c object| App string| fixed_nav object| rubik_instagram_col string| rubik_tabs_more object| justified_ids object| wp string| MyJSStringVar object| cookieconsent function| pbjs325474Chunk object| _pbjsGlobals function| JSEncrypt object| ADAGIO function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| gaGlobal number| zxCheckAbs number| zxConsentEnabled number| ZxConsentFlg number| OaCmpEnabledflg object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired object| ampInaboxIframes object| ampInaboxPendingMessages function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| ZXNT string| slot_ext string| zxadblock_ext string| domen string| site_topdomen number| prtintstlprocent string| zxAdUnit77 string| zx_network_prefix string| zx_ad_slot_default object| adx_dfp_bloks string| zx_banner_w_default string| zx_banner_h_default string| BannerSize_default number| flg_dfp object| t2 object| e2 string| url1 string| url2 string| url3 string| zx_ad_place number| zx_ad_width number| zx_ad_height string| zx_ad_slot string| zx_ad_id string| ins_targets number| cw number| ch object| tt98 string| txt98 string| txt99 string| stl98 string| BannerSize object| google_image_requests function| AdPlayerPro object| DMVAST function| playerPro function| getCs object| ed object| GoogleGcLKhOms

1 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUksjqxnlj_tv7Pi5W5NAk23LnAvTlTDAdeymWYmdD_Dh-SqMtyzJ7UPMOr29_Y

18 Console Messages

Source Level URL
Text
console-api log URL: https://ncmhcso.org/template/rubik/js/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1
console-api error URL: https://ro3.biz/?pu=g5qtmmzqme5ha3ddf4ztonrr(Line 174)
Message:
Error: Browser is not suitable for subscriptions
console-api info URL: https://cst.cstwpush.com/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan version 2.1.4
console-api info URL: https://cst.cstwpush.com/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan run tag spots
console-api info URL: https://cst.cstwpush.com/static/adManager.js(Line 1)
Message:
%c [AdManager] - color:cyan init spot [object Object]
console-api log URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js(Line 2)
Message:
zxnt->page abuse -> Restricted demand
console-api log URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js(Line 2)
Message:
zx->gdpr & oa detected ->start without cmp (2000)
console-api log URL: https://cdn.zx-adnet.com/adx/smrcp_19121001.js(Line 2)
Message:
zxnt native v.1.1
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 10)
Message:
sfr zxm ad 970|250
console-api log (Line 10)
Message:
sfr zxm ad 970|250
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 17)
Message:
v2 sfr zxm ad 580|400
console-api log (Line 17)
Message:
v2 sfr zxm ad 300|600

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

171ec0af51f277855f887bfe6a694e15.safeframe.googlesyndication.com
a.sportradarserving.com
a.tribalfusion.com
ad.turn.com
ads.travelaudience.com
adservice.google.com
adservice.google.de
allthebestsofts.com
bk.jampartizan.com
c1.adform.net
cdn.jsdelivr.net
cdn.zx-adnet.com
cm.g.doubleclick.net
cmp.optad360.io
cms.quantserve.com
cst.cstwpush.com
d5p.de17a.com
dclk-match.dotomi.com
dsp.adfarm1.adition.com
eb2.3lift.com
encrypted-tbn0.gstatic.com
encrypted-tbn1.gstatic.com
encrypted-tbn3.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
gcm.ctnsnet.com
get.optad360.io
google2waycm.netmng.com
googleads.g.doubleclick.net
image6.pubmatic.com
js.wpushsdk.com
match.adsrvr.org
mc.yandex.com
mc.yandex.ru
na.nawpush.com
ncmhcso.org
pagead2.googlesyndication.com
pix.impdesk.com
pixel-sync.sitescout.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
r.turn.com
ro3.biz
rtb.openx.net
s.ad.smaato.net
s.tribalfusion.com
s0.2mdn.net
secureir.ebaystatic.com
securepubads.g.doubleclick.net
serving.stat-rock.com
ssbsync.smartadserver.com
stat.optad360.mgr.consensu.org
sync-tm.everesttech.net
sync.1rx.io
sync.adaptv.advertising.com
sync.mathtag.com
sync.targeting.unrulymedia.com
tpc.googlesyndication.com
tr.blismedia.com
tracking.m6r.eu
um.simpli.fi
um.wbtrk.net
ups.analytics.yahoo.com
www.ebayadservices.com
www.google.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
cm.g.doubleclick.net
google2waycm.netmng.com
pix.impdesk.com
um.wbtrk.net
104.75.89.51
142.250.185.66
143.198.248.63
144.76.128.227
151.101.1.195
151.101.114.49
151.101.65.195
169.50.137.190
18.194.4.26
18.196.233.38
185.29.133.52
185.64.190.78
185.86.138.120
198.54.121.248
2001:678:cb4:bbbb::11
205.185.216.42
213.155.156.181
213.174.135.24
213.174.135.25
213.19.147.44
216.58.212.130
2600:9000:211a:9800:6:b871:4f00:93a1
2600:9000:21f3:8e00:11:a4de:2580:93a1
2606:4700:3030::ac43:d657
2606:4700::6810:5614
2606:4700::6812:d05
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1288:110:c305::8000
2a00:1450:4001:800::2002
2a00:1450:4001:800::200e
2a00:1450:4001:801::2002
2a00:1450:4001:802::2002
2a00:1450:4001:802::2003
2a00:1450:4001:802::200a
2a00:1450:4001:803::2002
2a00:1450:4001:808::2006
2a00:1450:4001:809::2004
2a00:1450:4001:809::200e
2a00:1450:4001:80f::2004
2a00:1450:4001:810::2002
2a00:1450:4001:827::2001
2a00:1450:4001:827::2003
2a00:1450:4001:828::2002
2a00:1450:4001:828::200e
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
2a02:6b8::1:119
2a02:fa8:8806:12::1400
3.126.56.137
3.230.12.180
3.64.28.223
34.96.105.8
35.186.193.173
35.190.0.66
35.227.252.103
37.157.2.236
52.58.194.104
64.4.253.237
66.155.71.150
69.173.144.138
72.251.244.141
76.223.111.131
85.114.159.118
99.86.242.34
00d5fac3472ff8f0feeae7b36306de9131fbc957ffb69460daed498f28d5dad4
0632e19d6a69d5d2ced4160f8ec373977128f038801b19cdb695c375d4fdb975
07599490b624400bd1d6241e586826bfb6c647ec679a38b634c090b8ca4df5a0
085090f246d04b6921b2e44e51bf6b6a5d234ae456ff7325dd0c85c12333c2cd
089be99a4be890d7b3eb928e17be081522aa228825e3724114cd820f9388d918
08af167ae87c1c73df99ed27c6dd0acfa0056136b22f27a17884369c0569b886
09961140c12f8d7e4b768fe77f20560945ccf4b92be9ca816369d51f502af9cf
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c98b45816904c4e42fb1e0d92cbad6668c5fb2939e887528cbf70fac3418436
0cf123d9af27b09b4a51ecedbad25fea2d304aa83158ff829543248b25dba645
0db80e4ae35fcf307507f9ced66fe9ccb3147c1ea12a60ea034092e6aa3ebf40
100727b0ba2fb2cef480e85a4e62a30d0819fc66e72894312061a265b41f4605
13d89f2f519a76667d106e935583774c620f379eb96605d9d8ae2c63002b995a
1411d96afa510f9ab6d3982946b9cf9c0603622e61d08299d653c4011eb53e75
14ab28f58601b3c2eac7f8c3d435e1798f7e66351902b43d9fd42c08004084d5
15b886992795015ddf192ba7c46ea89376cef0fec304d850d735da268c332226
16726b76043e97235cf0b1f6cc92e799194b324647636f5da5867e9641e422bd
1698abe528bb1f8e76991814a09aacb0ec7247d421ed2e4ff8f00e3fb1275712
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1e7ba7486df51b247d667ddfef156c72ed4f149a3693b1ca9be424f2ea680a50
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
240f2fa6d9c547702519223d888610d5517255aa52ad0c04d86f0ec6d0ab76d6
246adef29fe1329a53847079c91950a159407881774e15b5d5df2e8cb276534c
24e4a034ba4919f99fe0d4cf57fe8aa098a2e24624dc8e5f6082e82b26659f79
270be58b040d0b59d87a4deea0ca09e1b49916b84858005cd3e3e1f2d302ba32
273aeaca6d853aaad1bda85aa8a4ef1fbdb81a3f974f9430c7287341fde23c46
28538536bbfc61b8d81d775fe6ad5aa46c60e55130d10b100624cee7fff51449
29b46ac5b9e3243117fbbf5e8f2f63ac027cdaeabb32d1f643ca663560c6e9ae
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b51b115bd237a8ddd57dfcba97289c21e011e73888f1bbff4dfc7a6046ea245
2ca57650e9d1881e382bd324039937317b18e44fd5fadab6d09018d426a2622a
2d1affae24db39c09d9df7afaa24f8c1fcbcad374d03acbc8d273744ba985252
2d664ebbe5f126cc0507bab837a6f736b9ab3a219b5aeb99a213305ae23973df
2dfcce6fc5342373d58c0e96218713014c2295bd79ae21e3c57c65a2c3875089
32e257edc51d8da882af136c78e1395e1dbd72d3960923e2174ec1caf1ae19c3
3320c0d7115359837e0643f49b0828132df3424cedbb4b32428297dde2cf6c66
3471d510569e6fc1f5f6e4e2d80ae9d9061eb9e65bf1ea418225e43334aecd16
3701da754cd5a0bc28caf5540c9d07c59164f08cfc5a3fb57ffc4864ce97abe5
37577455f348abb564af8ac7a767d609ef3e52881db617e9b9f1d362b1cd5b3d
37afcc50aed647983a6e055ccfdcb8ffb5edc9f759d42330a10edb6585f971f7
38a448e9e03a9f64e7611b19af4bb8ec97fde2c708dc57ebbc7701be7ae3af08
3ad2fcb328295f1199d593adaba909f3eea790f695554ac3c1da7aa009fc0e0d
3bd1c8bb144ea5c45df63d7e2435e778c86fedb20523ca02353184fceab02751
3ca3e467b7d4d6b403aa4619019d9250b11449c8ee9c91c90bcbc9acdd64fea2
3edc07e9053e5f74fe42260ea0806366e67dd743ba43370afe0b1a21c3061978
408abc3a5bedff37056ecb1ba4872225de8a269ffe9aa04fd8fd38a7e7ec5116
429f6b7a5802c15145bddd69b400dae34b814eebd42ea1a32934c9a55a159391
4433ff0f49844a27a31acc576d573f17fcff11480ff4c8abf0d17576dc4ffa17
475700259e64d480d1a70023e14741bb298a025e338bb608552e2472d4505a65
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
49894b52d15fdca5393109cc22008f85b6eaba81d87686597e602a466932f71a
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4a415b9664c15a6fa3f01b0cfac702e89a6e2d765f8effedf758ca8f4089456a
4c895853a2fc12da6876bbbf5b41c242811b9162a65c042146293f728bcad937
4e494c61b1a3ac72626ae5bf2c8f4b1e5ba7e9097e31e6f09a7c86808c1c8a6a
4ef35581d56516af9c0a792f09316bda2494a5f497edf5de30e6ab74052bc380
4f7b6c826559e7a9fdd87aa3dab65d9032e27f9677e2c894bf8add376af093e6
514d4d07f570ff4bc32cfa9a6465a572e5c6a609628489bbb113b2ea437b89a6
540f7b2445ec148ae8799eb0a2c71655150085f238c05b705a41cc1110e78071
543c7697685c56b03408ab997237daab81cacc93a71637f0b7d87734df5e9ca7
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
584218e6c2fcaae5dabd9a106e287fd6552525344a9a77e44da2348e3fedf045
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5d55af792935ca87af56842444b3a1171f301a1e63722ab7e1b57dadb0c655c3
5d7cc259e704335896d08543304ae31eeaf36f735cdf5e0767d4a4e78e62e0ec
5d8f2e301e6747c7ad571691ee6a15f6540c7bc7a752447fea7fe7f66cb5b15d
5f3ea9dda31c4f06f4a3ea880793f42de1a7b9b35047998872169aef3f9e15f3
5fb666fd52dd0d79bf7fffcacac8e560df56ed197509545f314269c7d44d4183
63077d68ac600d27ff532213a2ff2d7cbac91a8ecc6bef645580b81f36d6d09b
65e10049ad2c80610615e5e07e5f5f2b0723fcb0a4e12cae9e76b2811bf3d6ab
695cc4316d3c90325361db545d2985a492b17a59e1cec0fa7880bc6b68fb3b25
6ae7c417360b14883ed8299a0f98a1bf6d6de5e01e1d10e4ced1c9ec1f174431
6d3c13f4d0e89f526de5a6854a48402da759f01d0da06e26d75ecc5339e1a9a1
6de7e21adc53c992531c56726a8f1249a96dc887acc4e253e416613095d11fd7
70bd5c7fd4f6d3a76acc5720247e8344f900d5f4b06cca2d614963244499c341
7190fc6eb38bde20e78e2fe2c6b7629bb347768d193b52d9440e8270e40766e3
7733e901ce4639c446a06c89071cca31e57b494ca45e1b25ef1c523caf6e4083
786f0176069ed859b81fbc69af45e22a1fc88be3127402985af6fc9ed1b7b527
78b0e2671e2b5a9a34ba9508348c05f8e1afe703086c6bc30d8a489720716fe9
795436a9b34d7cee4c0c4d75b6a4e9bfb09dcbd35d09e53f1c9ff9585c28de02
7a783598f3cc86a4d73a813cedd5f6cbdf85ab7b95c4d40944a30c833071aa18
7b41345163e513f8480e8661c9f357a8ffc355bc3956aeae8550f88e342686ad
7d3ed5e7e4c4aafe8c1f5d004e7eee33b5887117d2125848352a2cda86dd7ed0
7dfdeeab3d7d536feca8c4d4ba7c7487eb380ae350cb6df273f88047519c404a
8254c9521e087388e9bf4ffe934db413d93a10140e77e7931595fa191bd4aed7
83620fc89fc1d579db7168aab01b0b8ad43bc46590a2de59d7fda09e8564f9cf
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
8451588baf1668bfbd2436a880bb172bd45995b1b1717c621ad0fce66c6c2431
850ebe5afa86a299ed655f0dd371f0bb4c80e38b73d855edf5139c3475f0d7f0
854d677b850907cd851eac7e3f02f05a1e056f05bd5563199c5d93044ff16840
878f39ff62a28e531c2a969d703530e5b0ca8fcde0cae4e8e527d8f114eb6313
8980459ddd1cffbe1aad115aeb932535bd1833ed712ce73f83add43dc4a068e3
8d0265cf1535665ef0520aeee9fdd5300259676f138659d2a8ba184e2c3daba6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
9066d3560e4855d5ad6b44ce3e5413931c24bcd03921ece8f582a947d632194d
90f5b3b6644bc22752012cb38af16acbd0758607c043bcc4dceaf67708b7a6df
91b8096a0e7e7aeb28bb0899e9f7f251ec0e1165fbf4a8e12d6acfff0cd45afa
9207452e3e668f1e46a60b6a611bbc9c1628a76fea71a8883f76ff5206fa8621
922dd843a18f8aa35e5dad2f1c3992348ea31501a6293efd1ace1bafcebb7d89
936567bc744e199e02bfc3c33fe2bc9c862999e0d479e2a694aa7485460a3960
9961778411483e22893fbbb5783caa61c1c0eee0e19ce45f5a5a845b6ca9170b
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ae6e6ff4c4401db42e1390127d2c3f9091c040e9da9951ceefb732b8a9dfffb
9b7229ec361efa820b9ec7ea04bd77581cbc89d17b645820715d748a06322b1b
9b7b9620533171544eeda31afef67b33b67dfb07c49d222f67a939ea8994f5bc
9be45d830a633e050edaa82361e4ecac3cc189b3a3975a41aa01ae3cb4e4120b
9ccfe5660faed87e138eb618c9a44d36dcde7a647bacefd47d27fb9578ee7ab4
9e36f48120b748ca10f6efeb242a7cdbd118a72f0e40b3812a5f3dbe286de818
9e5baf1d366ed7dc7fce4e7dbca6245c0b7ef74e8d3a6cd6ae7641e725c5024e
9e7a1412730fc4c5b0f5722472d217ec2e106e0756fe6d97a37b0ea89db35960
9ec46d1a0fd66abcf47fd1aded820d75f29097fcf1f99922e5ca9d38890a8c18
9f714fe4238276cbacceb8400a76d9c33a9fb83e4abecdc52aebe8ee87772781
9fcb152549dc1c9f571127c64608504a67f406e203b3bae2f7eadf88d1480627
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0d5f91a5430829df5638fa69b85a6e361876d5499744cc724d01c342d944a75
a15efea66244386426b3fa9c3fe929d8317b88412905ceca7ad0a7d1fdaa9c37
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a68cdf7ed2a4b33b54c6d8870af0568ce47c2f59de3ad12b2280e2563b187f92
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7cc10d6b929d18973c7eda0205c914669edbd44cad3e656a5737d3dde64ad0f
a939f9e879f700eade071baf1a1e5bd5c7a2889d42dede7236d118c87e4dc3aa
aa164604cc5fe15185864c5ba789e8115bf4d0ee802e3db6d81747cf3d49d77c
aa7ad08dddb3da63c9512897e1918a62f8fa96268d92fa1c3c2b4edbf4014686
ab9df2bccffeb373df3ec6f8c10d1e229a7a05770637875f018673cc9318d3ac
af79cc4f5e31ec619606c179a7daa85e8bf93e6612351f9f17dc85d9abc2b01e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
b961bb522a21c8710fa523ee1b97d3ae8880606088e221a08525621d54b014ca
b9f06410858629bfa26244bba46739e5d179fca99e32c0d4e4f35d2454c0f5fe
bbde0ea9c50274448afdee811988867d3579169daff16b64bcb99ad1ee10905f
bc621afdf972c39066502aeed507c2cd0752f0cec9c932224fae97cc2a1d10a5
bd02724ce784c8b273e88c3f80dca01a8747634d2155d29790ed2e3660d259a7
bd7680f0d4768bf17b38b5834d7671e6e456d9655b4ae3cb39186d1fcd93f5c2
be266149542bbd949484c2c813bbbf8cc04a121c313d2bbacc46edb773d1ab17
be69c01b37e29a140878d078a8714469fb3dbdfba78263786435d7452b797727
c15cccae31e0b27e4f8db728a62c21736958f692047bfad5d1ca07dc28efe9c1
c28a9887c2be62f57b318f8b7c66a638d98ab5b8b28e6044c111c1eebf3887c3
c28ec832f5ecfe9352abcd287283305f4b73cdee8952340bcd077915ff237a7e
c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25
c3c83548386827adca9c6c19ec892039a5784a3ea2f5c193954d6bbd0c46957f
c5b9193d16bfb047d69c11d9b561271b5cdec3d9b86031112df85fff6cb6daff
c6754c3241a18169afee078352f5e11c9c8eec97b9e2fb173f541ce2d07dd210
c7dd14620f5650c08f9cdc751c0df99e4133337edd54f6527faec8bd1b3e88c8
cb4059d1c09dfbb1aff688bd355c8d8bdcd38bda65dfad288e971439cd0746ee
cc7cc67c9a20cdb365cee019afd88e150a17a99f8984fe2ab6be0aa10e031ebd
cd0d0b6e50ff01ff2f3a9a70d7cfb66a7c6cb9acf7a566325568be6d3bd31fc4
cf34e1b87bbfd9d9b185dec994924a496e279d8dc9387ad8d35bc0110134c4d3
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cffcb70abd2e9d0c7cd49a445c6d3a47d51540fef262470b60d2fb01b6fac11e
d1c009c83f73450bedc9ef5decc272e84e1acf87fd721112bd6b6fa270e44caa
d2935547d3f71917ad204c10123bc6c14bc037d3814b760d50a7540cc0ef6734
d29ff1a0d107b4a6a4508c99edb4b7783e2813b98d0a999ac4fbce8915b1cd66
d61109ad78ea052162d7e8f8049277b7ab740d25584a80047d12ca53bffe6a97
d6299ceb6ce9c971a58efb0bd1fe66a5eb96317a0dd675a608d7a1c12ec11fc7
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
ddf07c5edc3bcaab290fa6573348dac0fe4e00a05fd23e18f18af86800382cb7
de6a725d35b5a7d2e7227a060ab4f33fdb0d43fea2feab41cad0090065b5ee87
de7dd7e8a5f2257d16c23c395b9262c6fa04689c81b0e2b8bf7f5bae9f4177dc
dfdbae14960ab90f96810eb628e6115a85d20927e6c487007b5c1dff13a4268c
e09c5507d6f189744d043d993a3a28a63d12322f3dc978426ef895517b98b567
e1f5a91a6b037e43e2ccf1c86a35ad4ce0ede7b1a099989b5d8c125697b231a7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d2fb5e2edecc03632d4232f8956dfc6cea25557cdd082cab892d00f2769bc4
e3db6e10d23efee68a3363d146b24121b9f1028f32180e54430c687541fccacf
e548abcd8734bfcf8b4ebbbca1af98f9e8ae1e0ff884c0971f29498a4fc108f4
e55842a856a6d829feca3c3ad736c136b6c7549e9247274f78aa296259e06e24
e571ca97d08aed616229516a85ebbe298ede274bca3256afd9357c73a2e5010a
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e596a6cc17f525e0707049608e73975baa5474e82c932c8b60fa11a718617140
e6085301708c5091aa3bd00ca313d09f08a1ea02926745978796ce6b433b03ba
e60ddc8776de90835dfa7f3606b17731961bc687b707600930f393e9da79f309
e62e6cf03b26f76f222534b9cf2b117416bd6ab63155b4c75082ac4f85f8f885
e684839cbcef6b16753dae73e92a49b7115f55e83662ead12d5e05bf7b9915fb
e89a316ebf1c63ea09e2b7b5889fb55e1ffb326c7b2b172027da0948f5709f6a
e8b2dbe974437332938aa773a9fc8dfbd3f8589a840c2f7a5121303567880a59
eacaf032d6b2c78e716159cf0bbfb1d6fb04c499358e53a1c8422097f6f58c33
eaeebeddc3ece3448bd52fa6ad8494f2dd6afd869d38aaee596c757c53343bdf
ecce6a58616c4f65c8992b1db8b5258071f6bc5226617d1149824a343fdee84b
eea6dc59229104927a1ca1a416794d0ae3fb326b2ed6926abda0dd2a8cf693be
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef391572f9fbb7bab7fef6ce2c4fc92ad68a8c148889a79cb9f9b1452d851fab
f12d9215f826eb1fe574e73a8e63521f2ce9d1818b1522812fa4f168b468c4f8
f243e94ce5c9fd76a729b6fe92cf92cb1073d09533de16f44bdc5779fa67be5e
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f5c3ec736b7f9e61a32614127b05b952a269ad02ad3af342ab779df1a847a397
f76d52d1bab6a33045c3db6943580b063074b0735afc6517a573479d5ebcb0ca
f781adfea30c3876a3540cbe92d910804408a1926b4140345f13f5ece75dc1a7
f8533d3a748458fe5a5a8d3f562b3535bd151c6cb9af4fafb7839d176a8cd2ab
f96f665969d662ffa8b3a02b78c023c75d334aaabe15c69f14a262bb299e6cdf
fb72b57f0eb32d34140b9af0e922723a4bc6d96bd57f1cc33669a6b875976a0f
fc46f44565a092c856a6d70471d942caca57598049a85ce80366c1c5831d0f3e
fd431dbe6258a7677ea8923a007eba3bd18d165ca6d95b26ae5c74815a478bbf
fe415f92f03acf72bf24f9b7e4a00011fd2a579adf046dd11679ed0ce383240a