prnt.sc Open in urlscan Pro
104.26.14.80 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://prntscr.com/zlspa2
Effective URL:
https://prnt.sc/zlspa2
Submission: On February 16 via manual (February 16th 2021, 1:00:03 pm UTC) from ZA

Summary HTTP 158 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 40 IPs in 4 countries across 26 domains to perform 158 HTTP transactions. The main IP is 104.26.14.80, located in United States and belongs to CLOUDFLARENET, US. The main domain is prnt.sc.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2020. Valid for: a year.

This is the only time prnt.sc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 19	104.23.140.12 104.23.140.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.26.14.80 104.26.14.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.23.139.12 104.23.139.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:20d... 2600:9000:20d7:9200:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
2	151.139.242.3 151.139.242.3	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
1	2a00:1450:400... 2a00:1450:400c:c1b::9c	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20d... 2600:9000:20d7:1200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	192.207.255.147 192.207.255.147	62821 (AS-MNX) (AS-MNX)
1 19	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
5	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
3	65.9.24.128 65.9.24.128	16509 (AMAZON-02) (AMAZON-02)
1	23.37.38.181 23.37.38.181	16625 (AKAMAI-AS) (AKAMAI-AS)
2	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:811::2001	15169 (GOOGLE) (GOOGLE)
3 25	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
2	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:810::2006	15169 (GOOGLE) (GOOGLE)
3 6	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
3 9	23.218.208.246 23.218.208.246	16625 (AKAMAI-AS) (AKAMAI-AS)
1	138.201.84.253 138.201.84.253	24940 (HETZNER-AS) (HETZNER-AS)
1 4	144.76.104.53 144.76.104.53	24940 (HETZNER-AS) (HETZNER-AS)
1 2	92.123.148.9 92.123.148.9	16625 (AKAMAI-AS) (AKAMAI-AS)
4 6	84.200.5.215 84.200.5.215	31400 (ACCELERAT...) (ACCELERATED-IT)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:d70:0:b:... 2a00:d70:0:b:2002:0:d91a:365b	29097 (HOSTPOINT-AS) (HOSTPOINT-AS)
2	5.148.168.135 5.148.168.135	29691 (NINE) (NINE)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
158	40

19 104.23.140.12 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.26.14.80 (United States)

ASN13335 (CLOUDFLARENET, US)

prnt.sc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.23.139.12 (United States)

ASN13335 (CLOUDFLARENET, US)

image.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
st.prntscr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20d7:9200:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.242.3 (United States)

ASN33438 (HIGHWINDS2, US)

cdn.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1b::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:f916:5049:f87f:108e (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20d7:1200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.207.255.147 (United States)

ASN62821 (AS-MNX, US)
PTR: haproxy2.ad4game.com

ads.ad4game.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a03:2880:f12d:83:face:b00c:0:25de (United States) 1 redirects

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.136 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.9.24.128 (Orlando, United States)

ASN16509 (AMAZON-02, US)

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.38.181 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-38-181.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

scontent-frt3-2.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:811::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:810::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.162 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.218.208.246 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-218-208-246.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 138.201.84.253 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.253.84.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 144.76.104.53 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.53.104.76.144.clients.your-server.de

hal900022.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 92.123.148.9 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-148-9.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 84.200.5.215 (Germany) 4 redirects

ASN31400 (ACCELERATED-IT, DE)

cct.connects.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:d70:0:b:2002:0:d91a:365b (Switzerland)

ASN29097 (HOSTPOINT-AS, CH)

www.linsenkontakt.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 5.148.168.135 (Zurich, Switzerland)

ASN29691 (NINE, CH)
PTR: adresult08.nine.ch

www.adtracker.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	googlesyndication.com c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com ade.googlesyndication.com	179 KB
22	doubleclick.net 6 redirects stats.g.doubleclick.net securepubads.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net cm.g.doubleclick.net	175 KB
22	prntscr.com 2 redirects prntscr.com st.prntscr.com image.prntscr.com api.prntscr.com	2 MB
19	facebook.com 1 redirects www.facebook.com	498 KB
10	casalemedia.com 3 redirects htlb.casalemedia.com dsum-sec.casalemedia.com	9 KB
7	2mdn.net s0.2mdn.net	211 KB
6	connects.ch 4 redirects cct.connects.ch	2 KB
6	twitter.com platform.twitter.com syndication.twitter.com	148 KB
5	redintelligence.net 1 redirects hal9000.redintelligence.net hal900022.redintelligence.net	10 KB
5	googletagservices.com www.googletagservices.com	145 KB
5	google.com www.google.com adservice.google.com	912 B
4	ad4game.com cdn.ad4game.com ads.ad4game.com	104 KB
3	amazon-adsystem.com c.amazon-adsystem.com	34 KB
2	gstatic.com fonts.gstatic.com	26 KB
2	adtracker.ch www.adtracker.ch	48 KB
2	awin1.com 1 redirects www.awin1.com	1 KB
2	fbcdn.net scontent-frt3-2.xx.fbcdn.net	37 KB
2	google.de www.google.de adservice.google.de	910 B
2	facebook.net connect.facebook.net	60 KB
2	consensu.org quantcast.mgr.consensu.org	79 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	prnt.sc prnt.sc	21 KB
1	linsenkontakt.ch www.linsenkontakt.ch	60 KB
1	googleapis.com fonts.googleapis.com	760 B
1	quantcount.com rules.quantcount.com	356 B
1	quantserve.com secure.quantserve.com	9 KB
158	26

	Domain	Requested by
19	pagead2.googlesyndication.com	securepubads.g.doubleclick.net c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com prnt.sc googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
19	www.facebook.com	1 redirects connect.facebook.net www.facebook.com
17	st.prntscr.com	prnt.sc st.prntscr.com
15	tpc.googlesyndication.com	securepubads.g.doubleclick.net c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com prnt.sc googleads.g.doubleclick.net tpc.googlesyndication.com
9	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
9	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net
7	s0.2mdn.net	c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com prnt.sc s0.2mdn.net
6	cct.connects.ch	4 redirects c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
6	googleads.g.doubleclick.net	c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com prnt.sc
5	www.googletagservices.com	ads.ad4game.com securepubads.g.doubleclick.net c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com prnt.sc
4	hal900022.redintelligence.net	1 redirects c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com hal900022.redintelligence.net
4	googleads4.g.doubleclick.net	googleads.g.doubleclick.net prnt.sc
4	c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	www.google.com	prnt.sc c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
4	platform.twitter.com	prnt.sc platform.twitter.com
3	c.amazon-adsystem.com	ads.ad4game.com c.amazon-adsystem.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.adtracker.ch	hal900022.redintelligence.net
2	www.awin1.com	1 redirects hal900022.redintelligence.net
2	scontent-frt3-2.xx.fbcdn.net	www.facebook.com
2	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net
2	syndication.twitter.com	platform.twitter.com prnt.sc
2	ads.ad4game.com	cdn.ad4game.com
2	connect.facebook.net	prnt.sc connect.facebook.net
2	api.prntscr.com	st.prntscr.com
2	cdn.ad4game.com	prnt.sc cdn.ad4game.com
2	quantcast.mgr.consensu.org	prnt.sc quantcast.mgr.consensu.org
2	www.google-analytics.com	prnt.sc www.google-analytics.com
2	prnt.sc	prnt.sc
2	prntscr.com	2 redirects
1	ade.googlesyndication.com
1	www.linsenkontakt.ch	hal900022.redintelligence.net
1	fonts.googleapis.com	hal900022.redintelligence.net
1	hal9000.redintelligence.net	c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	htlb.casalemedia.com	cdn.ad4game.com
1	rules.quantcount.com	secure.quantserve.com
1	www.google.de	prnt.sc
1	secure.quantserve.com	quantcast.mgr.consensu.org
1	stats.g.doubleclick.net	www.google-analytics.com
1	image.prntscr.com	prnt.sc
158	42

This site contains links to these domains. Also see Links.

Domain
app.prntscr.com
prntscr.com
twitter.com
www.facebook.com
www.google.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-18` - `2021-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
quantcast.mgr.consensu.org Amazon	`2020-05-22` - `2021-06-22`	a year	crt.sh
*.ad4game.com Go Daddy Secure Certificate Authority - G2	`2019-11-17` - `2022-01-16`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-12-22` - `2021-03-21`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
www.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-30` - `2021-11-29`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.google.de GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
redintelligence.net R3	`2020-12-21` - `2021-03-21`	3 months	crt.sh
www.awin1.com DigiCert Secure Site ECC CA-1	`2020-04-21` - `2021-07-21`	a year	crt.sh
cct.connects.ch R3	`2021-01-10` - `2021-04-10`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-01-19` - `2021-04-13`	3 months	crt.sh
www.linsenkontakt.ch Thawte RSA CA 2018	`2020-07-28` - `2021-07-29`	a year	crt.sh
adtracker.ch R3	`2021-01-25` - `2021-04-25`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh

This page contains 20 frames:

Primary Page: https://prnt.sc/zlspa2
Frame ID: CD5B4EFC0C5AD66B5BE1CDA9F5155404
Requests: 57 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.6e189c4f2b6d88c453045806323cdcf3.html?origin=https%3A%2F%2Fprnt.sc
Frame ID: CACF2D19343E2C17761119E2F42AEBA9
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.6e189c4f2b6d88c453045806323cdcf3.en.html
Frame ID: 915C035FE6853EC5F6930CD60EE70AF1
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
Frame ID: 5570545034A72A77B473ABB38F5E38E1
Requests: 4 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
Frame ID: 06238D7C96B431BF568803E8938B499A
Requests: 6 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Frame ID: 0A198761C28933FDD3E1C4DCF21A2C99
Requests: 9 HTTP requests in this frame

Frame: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 93F4799D068A7E15DDBEB1439F51F1A0
Requests: 1 HTTP requests in this frame

Frame: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: B8A0F0DD1F2F2E3E6C64B8FC08E93B35
Requests: 15 HTTP requests in this frame

Frame: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: F181DAF7FA76C2C0ED8B6C32552F218A
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
Frame ID: 1BCD58707A7F7A7D78C18A399B08E1F4
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
Frame ID: E9FD1CFE6D241D4A980FF09543764FCC
Requests: 4 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DET_rWyi6cCGUVSUHZ_DDDz4G3rOMKtEdnum7W8gp61LcqUMwmciCJY-517QDeayw5UINTpvLWGn5G1ARcwwZetpWyqy9Q4fKz65O4zdfO8isWHDHVdU8tbYgGbs21JwkVuArK7o4oc6145R6Cx4A2ZoQBig&dbm_d=AKAmf-DH01CvoVITIyMEs7nAXIKNRgBaGHhOiHCecK_hDy6ktBQn2cFDxHycjceMZVMuoHqMznnw5pZx7ddQXkboLw5xYaDH5efTCe9JX1I54rK_A3MPi69zdS665vb28xDxbAstLIGsiPuZwaw8MTgDlvSAgEznvmGJ-RegbeJATbtjNO1TPokCKGgW4i_Iy_atNnKpgRaBDoaFu77sMgpD5RGd6i9vhyJGfbbgVCaVvU7X5ignCvnjlBaXewxPWZpErXJP5fj9e6oD-gnZPwpnU8XIcM6kSOe2mmCjuQQuJ0ZWxty4jD8NZXNFI9_2K7W8Z_NqYZuHOLqc-wleXHfvd9243UBuJv5vp-DL_7xoQYZ5p2tvt2Tnjar8KN0Xr9RZtpHU4jBiHF53RB7IX6QHQrT1D9eJxgmxo5iiPZ8jLjcjfKpgdR9U4O0hltA_4a18JxsIXHAuvDjMnqI4GJ7gSDlgG4rWC3-faTQyzzk9554p3BFN-0Rzj11xE0nA31xlUrZd7Lrl4NU040Bc6u21ADOJrSnzT6tRRY-9v0hEYtlbo7zVSqpeR6CtXMO7q_TNkWjERbl7zg7cjDhy_iTEPOPfAxIUOswcO4XYPnupgko8T2RjzNOTHr7kTAEu35NuwDhRdY3t9X20PN7dMF-wR3RravkLvMOyHDTKqVW8-SAloEIHMzh4NgJB6W8wQQQWm5zebS71kEJqCsvpQaMBRcvLrIH84-etzIfz5sRDivZM5OeLi1w2lbDBjLHAzmLP2udykRx0fLb8gOxiHleDI9MqJHeWZnjfGqU6dgLvWZNqJfJNoBPQWO37vAh_abKYCqkYmpnInJ1iRDOLGtBYsJaZjFe1bo0UfP2s6PObkDIdUXccdfdHTP87RSuFSsQUlc_m2GGYe29AnF81WTWFcUkrTAK8x5d4LE16JKWZl8m_TnlBCiykzEhWcR5DaqWpb0kK1CLPbE95yKlWsmk8V84Lgn9ztbgxUN85T9pFvV5yIK0-mClZfAQjG8_WuZTuRaifFJi16jFv2YX1xxw_dFYsl18a0KJpzTfmuxtZLBZD6Ghk3hR6qVjDkLg8iXgSDZohUucD0bl1MSW99uTXarmfwwypJzixloz8fwrSc1VJMAQyGDSDWWUu1ON6p_0u4QMRPltUW3ldPqd6TN1UsAg-kMHnZlLhviSRkrXICMiH95Jto0TqhsEMhLGP8_O12-75MaBZVHNNyyBBOfXFYJQQr3w8GG-ZM2s4ktYtfQ3dqlMMMGb37lm6x2hSKo-ErNeAkuFep4kXOPzkRAi6WOGMEMsiqW__GmmbWWW7onm_mKtIGsajfrlsw294SucBggLYpWqeuowZpZDGqg6wQIVWELmDSGPP9BWkSWsBK4xt1botne0KIok9WSlmCFzwGxTIwwapYB0kvsSmrVTEjskPUfVNqgY5lvE3X4CYL0LmS-a43VsxnOXVxYZ35YcwgWUF0ImjMS0JinnMHJDSwXjoQRy1f27rEvq6Zz4prrvkL3VOcZMMDw2Q4HJVG63YFtv7jZu0zTDemULZFsiPoIjqwn5yraYygG5Y062bTRERKkSrMrTK7jgSV9ytwKGRfVQMROXmOH-cxDBN9zpUJ4AJzJwoxE_VrQIkJ60QQClMw3we2c2LodQ_F-KHhpJcwmwU7s5nYYrvR_1tAF3t4Mk3YWBbD2fAeP_3GtPB6EHhEodJOG94OShij4HEv6F-SBwfOj2BtuP_1UoHXzCccoi7O2r4SEhhIEFvMHz6-CcrKPMQRuC705n_orXXQi3i0AdYGD3nViYU3h-rAuTKRnzaJAlObS52-n4y8aBtaCbF58LAnuBuFcQACnXLqC3C6tY_eOJYrC3-Vst_sXmabsv_cg36o3PWcivTw-4be2RRJ02bJn6RPIWfjxdNrnOsGr1c0a5Bwd-3XGjeN7psh459fSxy6b8NjWjFInE22HyOQ_CRFiOzT8TTSwu_QNd2oBYxFUKH31Qtd77adswA6s0FIK0S8XiG0M6AqYouk8OoyvuBzRlay_7UDFyNQjx3k1I_AOG040qQr5HBErUWKpO70IWaneOMGBeIrXLE00zZdPtNHqdv9cCOrXeZ9-vDPIWol0sxYC517VIfK8P4DqcvRFLb0GBe-HU78PprGFwgwSwsq9epVHA5Fcjx1hMzS-2JYgHjtEnxw14fZuas7KJhmMiW0SJmiokq2INYiX9q1nSflSyvHIIlKnt7tCp-PfIPc1J2LKf9_1l5UJzA9-APSsGxMKZU4TrALZHuc8utPo0T4PBaMpLkbF3V3aC9OYH67J7qdHHLij-rslIcaWIQuFcs3vIdZF33lhaiiIpkgfMQFH_HNCBItNXmmsGeCTeOaZG86Nfat8MAYGdhTNev2G_JATSYc3NfZAQluTbgBDGb2IUfNZtITcuWbzPUf9cS4rW2PKqRP_SDay3_pDXvp-wZvM--iNnNFRmBFYZP2BEfrkAUmcz9e1oPZ_-gFrVSaAWWBRPjgPtCZwOolFeqQWNp8Az6fEI8dDd2iOnrzssrIXfU51r4cpAKpcrhoMZEMznF_aJxUVeQL27uEaxRsHL2BrLH2x4VZaws8-QrYvaC2DdvFay2KHaHV5RJ8MGCbtkP8KKFIiwPIawZhT1IeEkS9Tr0DEnodUI_2BYFhb_HGbe8WUDoApN7spuHYUDcCDiA4cmGDSGB6HuKe37PR_0ZAjqMmV-hZ3IK-Zswvj-sUhqRpu2W5067qH7pcDWMw0amKOmk4s0uldNvxcPfgWPllxyXSHb9QKeeqNWr1Qi8j2Q2D-YO8M8bM0mkDdwPAiVX40H1H0QfzfPGbo3B8TGlNAQULrLEXq4Zi1iVIsBDQf57SzuTUvZ01Tj7e7NS6MVEkXzyDizGm4kuC3eEv-dUPQKqqNFhCsHTDdokXbqEDJb7u9HQowaNFCLh9wktpBCjRLbUzmaOQE3Zck1w0JOq43K6oKxO8OpLMcOS8l8AqL9mfBfD00JqArBu4UhHKJ4A5xdob77kGYImCs71c4rhoA7dERF83PR2ai3fX0Rvw06wSly5Lr-sspTRV2tGZKXp&cid=CAASPeRoAVVrI5sl7W8DY5Ssx0t2WLklmcx72f3JuejNCo_1H9C5uMRcIvuxOpB1Pj9QICS7cIPcCdZNXeIJQIo
Frame ID: 09084E69E4B7FEED94F52E3233D8632D
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
Frame ID: D82439FF0D5AF91227A668EA6051F49E
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 52CFBB92BAD229C0FC90062DFF978E7F
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A4F46CCDC5E7F3E1ED852A8CB219626D
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 1EE850B0C5D94F326F20FAD9FC9CB78A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: B2F1CA33D99C5D21A5161240C1D4A741
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/9492030/1584717169061/index.html
Frame ID: 7A70549E3CE631752CF2FA6F7C7A9673
Requests: 5 HTTP requests in this frame

Frame: https://www.awin1.com/cshow.php?s=2347560&v=14114&q=358322&r=414915&pref1=74913800125699900710156011507022&pv=1
Frame ID: 64EA79486FE65B26CD22516BCD927328
Requests: 1 HTTP requests in this frame

Frame: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
Frame ID: B77EDA660D6E42EE43A649FB91FE131A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://prntscr.com/zlspa2 HTTP 301
https://prntscr.com/zlspa2 HTTP 301
https://prnt.sc/zlspa2 Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

158
Requests

99 %
HTTPS

56 %
IPv6

26
Domains

42
Subdomains

40
IPs

4
Countries

3917 kB
Transfer

9489 kB
Size

4
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://app.prntscr.com/translate-lightshot.html
Title: Add your language

Search URL Search Domain Scan URL

URL: https://prntscr.com/gallery.html
Title: Sign in

Search URL Search Domain Scan URL

URL: https://twitter.com/Light_shot

Search URL Search Domain Scan URL

URL: http://www.facebook.com/Lighshot

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/
Title: Captured with Lightshot

Search URL Search Domain Scan URL

URL: http://www.google.com/searchbyimage?image_url=https://image.prntscr.com/image/pdeAScMJTx2jQNh8LD06Jg.png
Title: find similar

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/download.html
Title: Download

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/tutorials.html
Title: Tutorials

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/privacy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/faq.html
Title: FAQ

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/help.html
Title: Help

Search URL Search Domain Scan URL

URL: https://app.prntscr.com/advertise.html
Title: Advertise

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://prntscr.com/zlspa2 HTTP 301
https://prntscr.com/zlspa2 HTTP 301
https://prnt.sc/zlspa2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51

https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2 HTTP 302
https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2

Request Chain 113

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

Request Chain 114

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YCvBuzy3R9Sgbt5kLOm27AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

Request Chain 116

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

Request Chain 117

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YCvBuzy3R9Sgbt5kLOm27AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

Request Chain 119

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

Request Chain 120

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YCvBuzy3R9Sgbt5kLOm27AAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

Request Chain 137

https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x18&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D&documentReferer=https%3A%2F%2Fprnt.sc%2Fzlspa2&ancestorOrigins=https%3A%2F%2Fprnt.sc&random=1420699143299&isIframe=1&container=&adPos=0x14&adPosCheck=1x15&adtagId=0 HTTP 302
https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x18&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D&documentReferer=https%3A%2F%2Fprnt.sc%2Fzlspa2&ancestorOrigins=https%3A%2F%2Fprnt.sc&random=1420699143299&isIframe=1&container=&adPos=0x14&adPosCheck=1x15&adtagId=0&uidRedirect=1

Request Chain 143

https://cct.connects.ch/tpv.php?t=116827V1869151989B&subid=74913800125699900710156011507022 HTTP 302
https://cct.connects.ch/images/spacer.gif

Request Chain 144

https://cct.connects.ch/tpv.php?t=116827V1410150335B&subid=74913800125699900710156011507022 HTTP 302
https://cct.connects.ch/images/spacer.gif

Request Chain 148

https://www.awin1.com/cshow.php?s=2347560&v=14114&q=358322&r=414915&pref1=74913800125699900710156011507022&pv=0 HTTP 302
https://www.linsenkontakt.ch/banner/120x60px_Linsenkontakt_a.png

Request Chain 149

https://cct.connects.ch/tb.php?t=116827V1869151989B&subid=74913800125699900710156011507022 HTTP 302
https://www.adtracker.ch/upload/modissa/chunky/CHUNKY_120x60.jpg

Request Chain 150

https://cct.connects.ch/tb.php?t=116827V1410150335B&subid=74913800125699900710156011507022 HTTP 302
https://www.adtracker.ch/upload/Zizzz/Bilder/pied120x60.jpg

158 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request zlspa2 Show response
prnt.sc/
Redirect Chain

http://prntscr.com/zlspa2
https://prntscr.com/zlspa2
https://prnt.sc/zlspa2

16 KB
5 KB

248ms
141ms

Document
text/html

104.26.14.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.14.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80e2eb1342eaa54b62a3ac315f53d573b1d77555f5df0cbc27926e8bbfd8236c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: prnt.sc
:scheme: https
:path: /zlspa2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:37 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d14df25e7f0a353a6d1a809a2359979901613480377; expires=Thu, 18-Mar-21 12:59:37 GMT; path=/; domain=.prnt.sc; HttpOnly; SameSite=Lax
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
cf-request-id: 084c85d5e000004c25f11fc000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=c0D4rI8%2Ftad819jDQ9hM7dyBje4WJ8I7J7yO0ALdiM5zQ5cy81%2FIzzxTX0QResN0AEmpg8oJ3HtmSQk%2B6jFoLYl%2BzGoCWvrh"}]}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 6227726968f44c25-AMS
content-encoding: br

Redirect headers

date: Tue, 16 Feb 2021 12:59:37 GMT
content-type: text/html
content-length: 178
location: https://prnt.sc/zlspa2
cf-cache-status: DYNAMIC
cf-request-id: 084c85d4950000cc364d83e000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 622772675f2acc36-ZRH

GET
H2 200 main.css
st.prntscr.com/2021/02/09/0221/css/ 57 KB
8 KB 83ms
81ms Stylesheet
text/css 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b67ae2416a166f4238581097d4ce984a69d9662aab12ecc4b2b881c45164e36

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:22:10 GMT
server: cloudflare
age: 1494
etag: W/"6021f1d2-23b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1800
cf-ray: 6227726a4801cc36-ZRH
cf-request-id: 084c85d66f0000cc3635357000000001
expires: Tue, 16 Feb 2021 12:52:51 GMT

GET
H2 200 jquery.1.8.2.min.js Show response
st.prntscr.com/2021/02/09/0221/js/ 91 KB
32 KB 60ms
58ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/js/jquery.1.8.2.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:22:10 GMT
server: cloudflare
age: 1493
etag: W/"6021f1d2-827c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 6227726a4803cc36-ZRH
cf-request-id: 084c85d66f0000cc3630011000000001
expires: Tue, 16 Feb 2021 13:02:24 GMT

GET
H2 200 script.mix.js Show response
st.prntscr.com/2021/02/09/0221/js/ 69 KB
23 KB 86ms
85ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/js/script.mix.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9d17a49fbd4e61d42fb801e708edd216d2ff629aa838b04cae023b9efb24bbc

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:22:10 GMT
server: cloudflare
age: 1493
etag: W/"6021f1d2-5e67"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 6227726a4804cc36-ZRH
cf-request-id: 084c85d66e0000cc3632059000000001
expires: Tue, 16 Feb 2021 12:48:57 GMT

GET
H2 200 pdeAScMJTx2jQNh8LD06Jg.png
image.prntscr.com/image/ 2 MB
2 MB 205ms
149ms Image
image/png 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.prntscr.com/image/pdeAScMJTx2jQNh8LD06Jg.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Magic
Resource Hash: 4a6ecbbb2412ecf71655072cda2d011dc14e55d949fcf8f4ed38d401c727d4fc

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: MISS
x-powered-by: Magic
x-temperature: Warm
content-length: 2009611
cf-request-id: 084c85d70d0000cc4e7c9e3000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6227726b4f7ccc4e-ZRH
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 zlspa2
prnt.sc/ 16 KB
16 KB 142ms
140ms Image
text/html 104.26.14.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prnt.sc/zlspa2

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.14.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=o0yZFVeIDNDzPWivtifqkxgRpyUPWdtgiNPbFPha%2FOdN9EOx6PgakjsNVUOGxabKnepqtbeg5oTBmyCR6L9vQO2hzERcAj6G"}]}
content-type: text/html; charset=UTF-8
cf-ray: 6227726afdc54c25-AMS
cf-request-id: 084c85d6d900004c25ea1ac000000001

GET
H2 200 image-helper.js Show response
st.prntscr.com/2021/02/09/0221/js/ 3 KB
1 KB 58ms
57ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/js/image-helper.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 83817752fb260ff66b3bca1471bb20dbb6a1e6a17174c657efe0912ad161b382

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:21:54 GMT
server: cloudflare
age: 1494
etag: W/"6021f1c2-a2f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 6227726ad949cc36-ZRH
cf-request-id: 084c85d6cb0000cc3641a30000000001
expires: Tue, 16 Feb 2021 12:41:03 GMT

GET
H2 200 footer-logo.png
st.prntscr.com/2021/02/09/0221/img/ 630 B
879 B 53ms
52ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/footer-logo.png
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca2c1abcf4b76a46306bc7f1a607a459371ccf5e7213aae988c33b4dabb1758

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1409
cf-polished: origFmt=png, origSize=1848
content-disposition: inline; filename="footer-logo.webp"
content-length: 630
cf-request-id: 084c85d6d40000cc36171a3000000001
last-modified: Mon, 05 Sep 2016 15:49:19 GMT
server: cloudflare
etag: "57cd93ff-738"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:50:53 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726ae989cc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 jquery.smartbanner.css
st.prntscr.com/2021/02/09/0221/css/ 4 KB
1 KB 53ms
53ms Stylesheet
text/css 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/css/jquery.smartbanner.css
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d91d13fd8f9d253a8213aeee7ebaa7e073683fc600a3d82902c3c669b8ffdee7

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:22:06 GMT
server: cloudflare
age: 1494
etag: W/"6021f1ce-ef0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1800
cf-ray: 6227726ae970cc36-ZRH
cf-request-id: 084c85d6d10000cc364d87c000000001
expires: Tue, 16 Feb 2021 12:41:59 GMT

GET
H2 200 jquery.smartbanner.js Show response
st.prntscr.com/2021/02/09/0221/js/ 8 KB
3 KB 49ms
47ms Script
application/javascript 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/js/jquery.smartbanner.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b185d89e437f1591af8c51d5e6dad41d3666e22a81931ee9df22e2cfdacaddb

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:22:10 GMT
server: cloudflare
age: 1494
etag: W/"6021f1d2-aec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-ray: 6227726ae986cc36-ZRH
cf-request-id: 084c85d6d30000cc36f9bb1000000001
expires: Tue, 16 Feb 2021 12:48:57 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 742
date: Tue, 16 Feb 2021 12:47:16 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Tue, 16 Feb 2021 14:47:16 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/ 3 KB
2 KB 84ms
27ms Script
application/javascript 2600:9000:20d7:9200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:9200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:58:55 GMT
content-encoding: br
etag: W/"9074c1a966aada274b63c92859c4a3ec"
last-modified: Wed, 10 Feb 2021 21:13:06 GMT
server: AmazonS3
age: 95
x-amz-server-side-encryption: AES256
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 375ffc8f2a15d6fd2fa731e1cdf5a737.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: tf36jF3qbpZhpHK3LxrRp9Y8s6dYB1gy2NiWUeNUexzDR0Luty5OMQ==

GET
H2 200 page-bg.png
st.prntscr.com/2021/02/09/0221/img/ 5 KB
6 KB 51ms
50ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/page-bg.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 86a1b8f94f48c4e82d2616d4c581f10a34ff447a2bd95be08714fa0d19ba3f51

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1410
cf-polished: origFmt=png, origSize=7116
content-disposition: inline; filename="page-bg.webp"
content-length: 5608
cf-request-id: 084c85d6d70000cc36f214e000000001
last-modified: Tue, 09 Feb 2021 02:22:10 GMT
server: cloudflare
etag: "6021f1d2-1a7b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:39:48 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726ae992cc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 header-logo.png
st.prntscr.com/2021/02/09/0221/img/ 4 KB
4 KB 78ms
78ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/header-logo.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40ec0b04019845302a5052b4689b5d3477c9717dca73243e5faf7cf98f3af564

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1410
cf-polished: origFmt=png, origSize=7995
content-disposition: inline; filename="header-logo.webp"
content-length: 4148
cf-request-id: 084c85d6e10000cc361a104000000001
last-modified: Tue, 09 Feb 2021 02:22:10 GMT
server: cloudflare
etag: "6021f1d2-1e52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:41:10 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726af99acc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 button-download.png
st.prntscr.com/2021/02/09/0221/img/ 314 B
540 B 58ms
58ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/button-download.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e926f30958d0c21d088e6a671d3356a3c3fab9cc6220b8e408f19d868a7dc5c8

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1410
cf-polished: origFmt=png, origSize=1404
content-disposition: inline; filename="button-download.webp"
content-length: 314
cf-request-id: 084c85d7080000cc360330e000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-57c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 13:01:30 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b3a7acc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 button-icon-sep.png
st.prntscr.com/2021/02/09/0221/img/ 40 B
217 B 66ms
65ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/button-icon-sep.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b6a1120cc303b1c6ee6d548a5b418c2707b59de0c1f13c8ab870ca4e734b6acc

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1409
cf-polished: origFmt=png, origSize=928
content-disposition: inline; filename="button-icon-sep.webp"
content-length: 40
cf-request-id: 084c85d70f0000cc36171ab000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-3a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:41:42 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b3a80cc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-twitter_gscale.png
st.prntscr.com/2021/02/09/0221/img/ 374 B
560 B 65ms
64ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/icon-twitter_gscale.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a3a63b2ac124cb9a194ec01ea1f0d3123e4019bf658c6f47a77b4faea84c079

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1301
cf-polished: origFmt=png, origSize=1535
content-disposition: inline; filename="icon-twitter_gscale.webp"
content-length: 374
cf-request-id: 084c85d7120000cc36f9bbb000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-5ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:52:47 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b3aa5cc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-facebook_gscale.png
st.prntscr.com/2021/02/09/0221/img/ 296 B
477 B 61ms
60ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/icon-facebook_gscale.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a093d2047e1a59b7103810b947780e5f94d865915cb923ebcaa7e50f557c2102

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1301
cf-polished: origFmt=png, origSize=1325
content-disposition: inline; filename="icon-facebook_gscale.webp"
content-length: 296
cf-request-id: 084c85d7120000cc36d7874000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-52d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:51:13 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b4ab6cc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 async-ajs.min.js Show response
cdn.ad4game.com/ 3 KB
2 KB 83ms
26ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/async-ajs.min.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Tue, 09 Feb 2021 13:40:37 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: "602290d5-ca8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes
content-length: 1451

GET
H2 200 icon-edit.png
st.prntscr.com/2021/02/09/0221/img/ 214 B
411 B 73ms
73ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/icon-edit.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb09c3720b53d8651d6f5825cf643e6249aefbe82a1ba1417d230cdb9b36cba6

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1379
cf-polished: origFmt=png, origSize=3153
content-disposition: inline; filename="icon-edit.webp"
content-length: 214
cf-request-id: 084c85d7230000cc36f084e000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-c51"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:51:57 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b6b0acc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-camera.png
st.prntscr.com/2021/02/09/0221/img/ 158 B
519 B 47ms
47ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/icon-camera.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bfd2fa3b3b5924e3655bcf9f63427e792bd8572b7ed0992373bdb4b21c7cb89

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1379
cf-polished: origFmt=png, origSize=1089
content-disposition: inline; filename="icon-camera.webp"
content-length: 158
cf-request-id: 084c85d7240000cc36f9055000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 13:05:22 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b6b0ecc36-ZRH
cf-bgj: imgq:100,h2pri

GET
H2 200 icon-abuse.png
st.prntscr.com/2021/02/09/0221/img/ 126 B
341 B 46ms
46ms Image
image/webp 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://st.prntscr.com/2021/02/09/0221/img/icon-abuse.png
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/css/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2875a6fc4266fec00a383377cb4530b6407912897b0727e26249d89c6dfe0359

Request headers

Referer: https://st.prntscr.com/2021/02/09/0221/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
cf-cache-status: HIT
age: 1379
cf-polished: origFmt=png, origSize=327
content-disposition: inline; filename="icon-abuse.webp"
content-length: 126
cf-request-id: 084c85d7240000cc36508a3000000001
last-modified: Tue, 09 Feb 2021 02:21:38 GMT
server: cloudflare
etag: "6021f1b2-147"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Tue, 16 Feb 2021 12:52:33 GMT
cache-control: max-age=1800
accept-ranges: bytes
cf-ray: 6227726b6b10cc36-ZRH
cf-bgj: imgq:100,h2pri

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 4 B
64 B 14ms
13ms XHR
text/plain 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1562925338&t=pageview&_s=1&dl=https%3A%2F%2Fprnt.sc%2Fzlspa2&ul=en-us&de=UTF-8&dt=Screenshot%20by%20Lightshot&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=2082565337&gjid=465296501&cid=332265398.1613480378&tid=UA-12353127-1&_gid=1136159062.1613480378&_r=1&_slc=1&z=938879612

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
api.prntscr.com/v1/ Frame 0
0 219ms
218ms Other 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.prntscr.com/v1/
Protocol: H2
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://prnt.sc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-max-age: 86400
cf-cache-status: DYNAMIC
cf-request-id: 084c85d73a0000cc4ea2a30000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6227726b9851cc4e-ZRH

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d9c8f6535743ddc62fc8ae54d352c85e2875df234b6023fb6f7acf1af9a9107

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: hRYEbwHYNFnpRNZ+8/vz1g==
cross-origin-resource-policy: cross-origin
expires: Tue, 16 Feb 2021 13:12:28 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1781
x-fb-rlafr: 0
x-fb-debug: qrZlVjDfUqf4jXl0zOFEX92d/YI94PnMyl/OfvIIT7xzGXvRRlkTcQK/crlMaJ0CQwpHnTQ7kzyfzQxwSrH5QQ==
x-fb-trip-id: 917726464
x-fb-content-md5: b1c8fdb6bb32625292a2fd75a09ca105
date: Tue, 16 Feb 2021 12:59:38 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "01c44be54c836621af79be1513058b7f"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 13ms
13ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B96) /
Resource Hash: c34f5c51cea0ee9e05108c79c404086a24b73fbecb0999654fc9116b4c4b755e

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 16 Feb 2021 12:59:38 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 34
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28744
x-tw-cdn: VZ
Last-Modified: Mon, 08 Feb 2021 21:21:01 GMT
Server: ECS (amb/6B96)
Etag: "11a0c75a945561958f0b924da0e67334+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

POST
H2 200 / Show response
api.prntscr.com/v1/ 92 B
424 B 143ms
143ms XHR
application/json 104.23.140.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.prntscr.com/v1/
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/js/jquery.1.8.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.140.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c9935e1daafc929a9866a206e769e084cd83f19d436ca22887adc2798408646

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
cf-ray: 6227726cfeddcc36-ZRH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-request-id: 084c85d8170000cc36d7891000000001

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
82 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-12353127-1&cid=332265398.1613480378&jid=2082565337&gjid=465296501&_gid=1136159062.1613480378&_u=IEBAAEAAAAAAAC~&z=1247040859

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1b::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 16 Feb 2021 12:59:38 GMT
content-type: text/plain
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 25ms
8ms Script
application/javascript 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 437afd9de21717c919be3f40f686b33170f2447dc03ded0fc00ac0cc41839854

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: gzip
etag: "8q1rat7Mm9i+FVcOidF8/g=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 23 Feb 2021 12:59:38 GMT

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/ 278 KB
77 KB 31ms
31ms Script
text/javascript 2600:9000:20d7:9200:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/n-ZGqfdsg5894/prnt.sc/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:9200:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dc605d43d32d7a4783e0627945dc7324951c2e23ac8716a0b5f95792cdb6c284

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 16 Feb 2021 12:59:30 GMT
content-encoding: gzip
last-modified: Wed, 10 Feb 2021 19:24:20 GMT
server: AmazonS3
age: 1322
etag: W/"add138443264907a532723b6f88cce1d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 375ffc8f2a15d6fd2fa731e1cdf5a737.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-meta-qc-ineu: True
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: 0uE87QB7VeyhlUQiaD6AvIBjGcZCarVgIYvYajE5QveUwFoo_BfNug==

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 191 KB
58 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=18683302700b31d80c0d12e83b29e102&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c2d21146bc055221ba79bb9068ca918fd28f9bcecf92a53c45becd2bd998e238

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://prnt.sc
Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: b9aI9nJXFKEP+D3Q9U6W+Q==
cross-origin-resource-policy: cross-origin
expires: Wed, 16 Feb 2022 12:25:54 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 58493
x-fb-rlafr: 0
x-fb-debug: 0iEsED+GVAIWVV1nvvklyRUduIqxt4RPSkii6X3YFWC2roHRmDuJl6US6qUCppvmhEqclB9OD3jZqwrI5LMlbw==
x-fb-trip-id: 917726464
x-fb-content-md5: b06c232837b43d9771be4954c1ac5e4f
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 16 Feb 2021 12:59:38 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "2f66cb1b5c810d7549dc1591df8b1456"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H/1.1 200
OK widget_iframe.6e189c4f2b6d88c453045806323cdcf3.html Show response
platform.twitter.com/widgets/ Frame CACF 320 KB
104 KB 13ms
13ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.6e189c4f2b6d88c453045806323cdcf3.html?origin=https%3A%2F%2Fprnt.sc
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BB6) /
Resource Hash: 99adb384fd992660be76df488633e76fe86ed9bba2a7cdf143a97e03fc3ee94d

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/zlspa2
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 575604
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Tue, 16 Feb 2021 12:59:38 GMT
Etag: "d9fdaa7a36dc36e57ad53c2039f52486+gzip"
Last-Modified: Mon, 08 Feb 2021 21:19:37 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (amb/6BB6)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105677

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
109 B 31ms
29ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-12353127-1&cid=332265398.1613480378&jid=2082565337&_u=IEBAAEAAAAAAAC~&z=515151518

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 17ms
16ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-12353127-1&cid=332265398.1613480378&jid=2082565337&_u=IEBAAEAAAAAAAC~&z=515151518

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-n-ZGqfdsg5894.js Show response
rules.quantcount.com/ 3 B
356 B 196ms
139ms Script
application/x-javascript 2600:9000:20d7:1200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-n-ZGqfdsg5894.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:1200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:56:55 GMT
via: 1.1 c25bc16c1238c23c74267a81302a62f8.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 163
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
cache-control: max-age=300
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: sxSO5BTUoGnrhJM_gllHEv-vC0vtctlsX6OUUBWu2ANHoJIK7Iw_Yg==

GET
H2 200 prebid.js Show response
cdn.ad4game.com/ 258 KB
97 KB 33ms
33ms Script
application/javascript 151.139.242.3
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ad4game.com/prebid.js
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.3 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 8cd1cc7558309ce0839d31c56f33d5274b8b53e2472ec3deda3be24fcd3fe40c

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-servername: ads.ad4game.com\ 80\ 81
date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: gzip
referrer-policy: no-referrer
last-modified: Thu, 11 Feb 2021 04:29:39 GMT
server: nginx
x-serveraddr: 10.100.0.151
etag: "6024b2b3-408c3"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
x-host: ads.ad4game.com
accept-ranges: bytes
content-length: 98968

GET
H/1.1 200
OK async-ajs.php Show response
ads.ad4game.com/www/delivery/ 9 KB
3 KB 500ms
132ms Script
text/javascript 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g4406753&h=0&siteurl=https%3A%2F%2Fprnt.sc%2Fzlspa2&c=UTF-8&z=60918,70076,60916&b=7&x=7
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/async-ajs.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: 7e9a57f1be1f89cfa8a8bf05a078a6d07402195a7bdf58d58826f6ea272a9dfe

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-servername: ads.ad4game.com\ 80\ 81
Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:38 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="CUR ADM OUR NOR STA NID"
X-serveraddr: 10.100.0.151
Cache-Control: no-cache, no-store, must-revalidate
X-host: ads.ad4game.com
Connection: close
Content-Type: text/javascript; charset=UTF-8
Expires: 0

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 39ms
38ms Fetch
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=154822244543652&input_token&origin=1&redirect_uri=https%3A%2F%2Fprnt.sc%2Fzlspa2&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=18683302700b31d80c0d12e83b29e102&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prnt.sc/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: wZmGnsi9dGnpNsEsV6sYxuwAd0hht5JO2L4+jrJl4MV3XEhU7kOh1Juac04wBZe4SuRUtT7p3gdsGvlycJv9rA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
date: Tue, 16 Feb 2021 12:59:38 GMT
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame CACF 183 B
411 B 197ms
137ms Fetch
application/json 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=f6c79b08decaf50e1f240516a9d794d1ef825657

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.6e189c4f2b6d88c453045806323cdcf3.html?origin=https%3A%2F%2Fprnt.sc

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ced34f591157438ef47695f979ac95f8758408e8d9b88e63aee8b382ec975785

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/widgets/widget_iframe.6e189c4f2b6d88c453045806323cdcf3.html?origin=https%3A%2F%2Fprnt.sc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-response-time: 108
date: Tue, 16 Feb 2021 12:59:38 GMT
content-encoding: gzip
last-modified: Tue, 16 Feb 2021 12:59:38 GMT
server: tsa_o
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 7a575fd3611953106a8c027d4310daa3
strict-transport-security: max-age=631138519
content-length: 152

GET
H/1.1 200
OK button.cf7aaea83eb75b84ae4508f0ceb5dc4c.js Show response
platform.twitter.com/js/ 7 KB
3 KB 13ms
12ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.cf7aaea83eb75b84ae4508f0ceb5dc4c.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B96) /
Resource Hash: 055dd0f1e0eae12d4587b12f516a1d7a0f858d80498823cbade9f97b5962d727

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 16 Feb 2021 12:59:38 GMT
Content-Encoding: gzip
Last-Modified: Mon, 08 Feb 2021 21:19:23 GMT
Server: ECS (amb/6B96)
Age: 575604
Etag: "d85b930ed0bb252882372aca97f80615+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2296

GET
H/1.1 200
OK tweet_button.6e189c4f2b6d88c453045806323cdcf3.en.html Show response
platform.twitter.com/widgets/ Frame 915C 32 KB
13 KB 13ms
12ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.6e189c4f2b6d88c453045806323cdcf3.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B96) /
Resource Hash: 3659ceeede630f0af896dcbc7f364e1d9d9dacc3b0cdee0f2701ac18158b17ff

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://prnt.sc/zlspa2
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 575603
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Tue, 16 Feb 2021 12:59:38 GMT
Etag: "3303401d80bcb82d7d7203edac7a8123+gzip"
Last-Modified: Mon, 08 Feb 2021 21:19:30 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (amb/6B96)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 12286

GET
DATA 200
OK truncated
/ Frame 915C 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 MB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd4664da7cdeff0fb257d064ec2e94b4d95d27acf5dc5cdc796ebc5f75dda689

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
383 B 144ms
144ms Image
image/gif 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fprnt.sc%2Fzlspa2%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22light_shot%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1613480379000%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22889aa01%3A1612811843556%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Tue, 16 Feb 2021 12:59:39 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 7a575fd3611953106a8c027d4310daa3
x-transaction: 00ecebeb00f04862
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 56 KB
19 KB 47ms
13ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g4406753&h=0&siteurl=https%3A%2F%2Fprnt.sc%2Fzlspa2&c=UTF-8&z=60918,70076,60916&b=7&x=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5700b13f8d42ea1395db4ab9c6939f781e90dbde6a9ec39f671dddf8a3e20d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "785 / 525 of 1000 / last-modified: 1613477430"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19454
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:39 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 115 KB
30 KB 171ms
78ms Script
application/javascript 65.9.24.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: ads.ad4game.com
URL: https://ads.ad4game.com/www/delivery/async-ajs.php?v=1&cb=a4g4406753&h=0&siteurl=https%3A%2F%2Fprnt.sc%2Fzlspa2&c=UTF-8&z=60918,70076,60916&b=7&x=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:50:09 GMT
content-encoding: gzip
server: Server
age: 569
etag: d7c8ebbead57940cf77ae4183f7ff01a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 c3ee0b759208fdcbade39e3e283300c7.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: pkiOsnrw5ub40d2SPOSAjPBBoA7O4uIM
x-amz-cf-id: LT_kohHmKntUvIHz6GSpz6J36o6l6tNBMKQq6iamSlr_eT4-6qeNKw==

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 24 B
680 B 226ms
153ms XHR
application/json 23.37.38.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=619471&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2213fb30b4cf9dac%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fprnt.sc%2Fzlspa2%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A3%2C%22ren%22%3Afalse%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%222964e216f073c7%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22377bf77bc84128%22%2C%22ext%22%3A%7B%22siteID%22%3A%22619471%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%224e07e92031f686%22%2C%22ext%22%3A%7B%22siteID%22%3A%22610018%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.38.181 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-38-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 81563854166118109cb131fc867d992f46b0a9b944f861079348b0ae60eabcb8

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:39 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[CH], RC:[ZH], CN:[EU], CIP:[185.156.175.107], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
access-control-allow-origin: https://prnt.sc
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-type: application/json
content-length: 44
x-ak-client-geo: 12
expires: Tue, 16 Feb 2021 12:59:39 GMT

GET
H/1.1 200
OK bid Show response
ads.ad4game.com/v1/ 5 KB
2 KB 585ms
337ms XHR
application/json 192.207.255.147
AS-MNX

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.ad4game.com/v1/bid?if=0&siteurl=https%3A%2F%2Fprnt.sc%2Fzlspa2&size=970x90%3B970x90%3B300x250&id=6aa6e8539dea99%3B7eeab27247589f%3B894f0a5a06a4bc&zoneId=60918%3B70076%3B60916
Requested by: Host: cdn.ad4game.com
URL: https://cdn.ad4game.com/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.207.255.147 , United States, ASN62821 (AS-MNX, US),
Reverse DNS: haproxy2.ad4game.com
Software: nginx /
Resource Hash: 199cb43987888c359f18a98dbde4cdb9e2f11bd50342ad0e800adbdf42337937

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 16 Feb 2021 12:59:39 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://prnt.sc
Transfer-Encoding: chunked
Connection: close
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
X-Application-Context: application:12065

GET
H2 200 pubads_impl_2021021001.js Show response
securepubads.g.doubleclick.net/gpt/ 288 KB
102 KB 90ms
32ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

c11fb9ac4922e75ae9e0a017f41ae36febd8a185834b7bb608e9049ebe68da62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 10 Feb 2021 15:07:43 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 103470
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:39 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
364 B 91ms
90ms XHR
text/javascript 65.9.24.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fprnt.sc%2Fzlspa2&pid=8NkUqSWFO5gz2&cb=0&ws=1600x1200&v=7.59.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F60918%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22970x90%22%5D%2C%22sn%22%3A%22%2F60257202%2F70076%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F60257202%2F60916%22%7D%5D&cfgv=0&pubid=852e3ca3-c387-44e4-a5c1-67c46495a8c4&gdpre=1&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:39 GMT
via: 1.1 c3ee0b759208fdcbade39e3e283300c7.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: ZAG50-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://prnt.sc
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: hqjKoHn82MwIzAvslngBb8NU1kB4UOrvgtd9zEGgqtQUR3yTRyny1g==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 143ms
47ms XHR
application/javascript 65.9.24.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.24.128 Orlando, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 8kbPIzTLk7_TMvnggUSDACBTugDfX2qC
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 4445
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 06:42:57 GMT
server: AmazonS3
date: Tue, 16 Feb 2021 11:45:40 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 e4d3109086369a6becda895ae199f9ed.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: aH7YeGbPxba-t6KPp979h3yEHwggo5WW8iU6mLVF5_km8vIFe7bzKg==

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 5570 155 KB
33 KB 86ms
84ms Document
text/html 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=18683302700b31d80c0d12e83b29e102&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9cd5fd35b7545af5204717c37ee7863aebd1f03321c810b9f98cffae1bc5b297

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

vary: Accept-Encoding
x-fb-rlafr: 0
pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-encoding: br
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
x-fb-debug: Toqq6/OIrDm9KXORd0CZloP2Xwzpx49qHyhLKuXlMH5/ANk5olQBJnP2CXxmyD0QYFcreIOvJXkYnAfUUkFvnA==
date: Tue, 16 Feb 2021 12:59:39 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2

200

feedback.php Show response
www.facebook.com/plugins/ Frame 0623
Redirect Chain

https://www.facebook.com/plugins/comments.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt....
https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt....

149 KB
30 KB

82ms
81ms

Document
text/html

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=18683302700b31d80c0d12e83b29e102&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

65782774b737eba60b0735ff3f191d442613b1194ed05b1c18b292544d996b3b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

vary: Accept-Encoding
x-fb-rlafr: 0
pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-encoding: br
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
x-fb-debug: IKN3qBblRmQReycr9PmysBTbc/t33BsHvXs4Ip6JzCCMcSBkT1Hh9WGfFf1ulGW5aHbdnss/2dUPm6tBhz7qEA==
date: Tue, 16 Feb 2021 12:59:39 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

location: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: nGsIGdNyqTHhPK4YUqofBpu4ny+oZmzBLiBVVV3zFZ+VBPOtDuRf/dW6UV0i6Y5WRt9X3MIJ0uYxDzOKjh3tuA==
content-length: 0
date: Tue, 16 Feb 2021 12:59:39 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 like_box.php Show response
www.facebook.com/plugins/ Frame 0A19 156 KB
32 KB 88ms
88ms Document
text/html 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=18683302700b31d80c0d12e83b29e102&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ad74c389ce3adb124a1d4fa373f91b954cc45c4eba1d5184da4ad99c212a37a8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

vary: Accept-Encoding
x-fb-rlafr: 0
pragma: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-encoding: br
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
x-fb-debug: LRCMKULo3y9oybAxa1gX1qMGZbJ5tJF4fBe+CZyW1hwHijobYXZJxuu0qZwDSF7GMBi/qOhyyWEcE1tVP+pTzw==
date: Tue, 16 Feb 2021 12:59:39 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 OqOE21UvWe3.png
www.facebook.com/rsrc.php/v3/y5/r/ Frame 5570 400 B
667 B 6ms
5ms Image
image/png 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/y5/r/OqOE21UvWe3.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: rU80UoBNQPLk4z4WeBeWjFCko1zxNIV/RubGbi2S27Tr2xtumO9o9h406Lhe/hX1J7J6UcrF8b8deWAyjMd0Mg==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: uF0RL4E+h23ClLQmPOTTMw==
date: Thu, 04 Feb 2021 22:00:17 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 400
x-fb-rlafr: 0
expires: Fri, 04 Feb 2022 22:00:17 GMT

GET
H2 200 pUW5VaFoCW2.js Show response
www.facebook.com/rsrc.php/v3iEpO4/yS/l/en_US/ Frame 5570 477 KB
123 KB 6ms
6ms XHR
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3iEpO4/yS/l/en_US/pUW5VaFoCW2.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7c0571c4439bc71a810f1f6021ead277b6b22fb193908d99202edaa4e6e56fe5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: YXd3tlSWFjyTOh/y6TiDKE4xrShlOw86ka+tTTUA3Ciui/pJmejsX0fZCOCe2iRNkDfcyerutXQNZ6OWSsbf2Q==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: xmrT/mxSM8e//A6AQwDR6g==
date: Sat, 13 Feb 2021 03:50:05 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 125162
x-fb-rlafr: 0
expires: Sun, 13 Feb 2022 03:50:05 GMT

GET
H2 200 Fl5LaP_p44_.css
www.facebook.com/rsrc.php/v3/yD/l/0,cross/ Frame 0A19 22 KB
6 KB 10ms
8ms Stylesheet
text/css 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yD/l/0,cross/Fl5LaP_p44_.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

79b65266dcc689a6d5eeed90308abce82a2ac72081d8bb9012881a3d3196f8e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: VyumCqiSlEPQu+HG30j3npU258IJ8xN7lXWljYJGBwOTCj0a1t1g1pRNgPOWc2uVf5XChBufFU0MPHOnbFR9bw==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OlHmMq0I4Fs0STO2K5RRng==
date: Sun, 14 Feb 2021 19:48:35 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 5847
x-fb-rlafr: 0
expires: Mon, 14 Feb 2022 19:48:35 GMT

GET
H2 200 l6bd8n36H9V.js Show response
www.facebook.com/rsrc.php/v3/y9/r/ Frame 0A19 270 KB
71 KB 10ms
8ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/y9/r/l6bd8n36H9V.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5e6e38efe361effb2b05fba9a24521eee8539324a1a75668442493bf9af2919e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: caVVS1tE0w2NbdFkk3/9sKgSBhfFJd7bttIldiwQuDDuTui5DG9RdBRn6j/PwbZJfAkgCowbJ1oTNqDNwXZorw==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: kSbzZXfqGed2dBjYaPta0g==
date: Sat, 13 Feb 2021 03:49:59 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 72555
x-fb-rlafr: 0
expires: Sun, 13 Feb 2022 03:49:59 GMT

GET
H2 200 Dpg9ss8VaH0.js Show response
www.facebook.com/rsrc.php/v3/yX/r/ Frame 0A19 64 KB
19 KB 10ms
8ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yX/r/Dpg9ss8VaH0.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

415af67f7c8589dae48efc186058a2feb0baa3a998c55f01123a02008f7d1712

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: 6ckP4Wh2ZRXOpmNA/damgtgxSO7JC9k2YHR3a75E0AJCxNB/amlGo8bqty8cGwnVWNPEcH051cTDJLgjYkJLtA==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 4ckBMRiJ2oAZclveQEGjEg==
date: Mon, 15 Feb 2021 19:47:49 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 19463
x-fb-rlafr: 0
expires: Tue, 15 Feb 2022 19:47:49 GMT

GET
H2 200 cV7OV--371c.js Show response
www.facebook.com/rsrc.php/v3iEpO4/yp/l/en_US/ Frame 0A19 124 KB
35 KB 13ms
11ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3iEpO4/yp/l/en_US/cV7OV--371c.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ff6f2b33b098e5cc045a7204752569b93301258047ef6823631529c385635681

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: ExvuyxjdViLBGwi5QO1CDXVCAJFRxrA1ZEI0nYOVGK4QNSXnueV9d3JAqxLGcOHLFmpwNynGHeJqv1lm07wr2w==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 2WtgVsF+ktahxGUWfFUbjg==
date: Fri, 12 Feb 2021 17:44:10 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 35190
x-fb-rlafr: 0
expires: Sat, 12 Feb 2022 17:44:10 GMT

GET
H2 200 Tz9295wgBhk.js Show response
www.facebook.com/rsrc.php/v3/yt/r/ Frame 0A19 6 KB
2 KB 13ms
12ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yt/r/Tz9295wgBhk.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

feb78712a78e071f82039ca2b97bbf0142ba6874fff826fa7d0b77ccbd110a0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: +FByQ/bhh1GF2tiPFwf1ee1c/xLjsOONGNWCDNgJ7DzOZJmlEO6VsqchwlXjHYzpgpI1HzmMfljMXL5QlU496A==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 7enxQF/cHCC1GG7TkdheZw==
date: Thu, 11 Feb 2021 21:50:14 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 1838
x-fb-rlafr: 0
expires: Fri, 11 Feb 2022 21:50:14 GMT

GET
H2 200 10380207_10152455232975761_8123100998967752904_o.png
scontent-frt3-2.xx.fbcdn.net/v/t31.0-0/p130x130/ Frame 0A19 35 KB
35 KB 25ms
6ms Image
image/png 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frt3-2.xx.fbcdn.net/v/t31.0-0/p130x130/10380207_10152455232975761_8123100998967752904_o.png?_nc_cat=1&ccb=3&_nc_sid=dd9801&_nc_ohc=jfeQUQvdqKIAX8l8eCB&_nc_ht=scontent-frt3-2.xx&_nc_tp=30&oh=f8c200dd91eb749079a3550011597761&oe=6052376C
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 5259164580b701ca5116d20edce61c9299accdf3227a00cf8b9973e434af640e

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-haystack-needlechecksum: 591433749
date: Tue, 16 Feb 2021 12:59:39 GMT
cross-origin-resource-policy: cross-origin
x-fb-config-version-olb-prod: 1021
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 35628
x-fb-trip-id: 686109401
last-modified: Thu, 22 May 2014 08:24:07 GMT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
x-content-id: 10152455232975761
x-needle-checksum: 1994070467
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 277895_10151200062570761_1904128644_o.jpg
scontent-frt3-2.xx.fbcdn.net/v/t31.0-1/cp0/p50x50/ Frame 0A19 1 KB
1 KB 28ms
9ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frt3-2.xx.fbcdn.net/v/t31.0-1/cp0/p50x50/277895_10151200062570761_1904128644_o.jpg?_nc_cat=1&ccb=3&_nc_sid=dbb9e7&_nc_ohc=y6Da9ZOt_R0AX84EL2Y&_nc_ht=scontent-frt3-2.xx&tp=27&oh=438682daf2057b91eab56e972ce3dd97&oe=6052D86B
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/like_box.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df1eaad9798fdf54%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&header=false&href=https%3A%2F%2Fwww.facebook.com%2Fpages%2FLightShot%2F242750885760&locale=en_US&sdk=joey&show_faces=true&stream=false&width=300
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: fe0b009af4d6be99bb24436d2b2c67706fa3698e059d8df3bfa9f9c8857b42ae

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-haystack-needlechecksum: 3015587832
date: Tue, 16 Feb 2021 12:59:39 GMT
x-fb-trip-id: 686109401
last-modified: Wed, 22 Aug 2012 00:00:00 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
x-content-id: 10151200062570761
cross-origin-resource-policy: cross-origin
x-needle-checksum: 1162695912
x-fb-config-version-olb-prod: 1007
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1288

GET
H2 200 cavalry_endpoint.php
www.facebook.com/common/ Frame 5570 67 B
767 B 40ms
36ms Image
image/png 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/common/cavalry_endpoint.php?t_cstart=1613480379536&t_start=1613480379536&t_domcontent=1613480379563&t_layout=1613480379603&t_onload=1613480379603&t_paint=1613480379603&t_creport=1613480379603&t_tti=1613480379563&lid=6929845462205339441-0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.facebook.com/plugins/like.php?action=like&app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfd2e1142ee211%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&width=100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: br
x-content-type-options: nosniff
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: 5lAs4YJRl3XZlvIXyyeNkaEqR1LGpSVpStMfW75nqx6zmxZobOzRGOpR8l3IgJmKV6UqR1jZeq0dNqH2RN2IOQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-frame-options: DENY
date: Tue, 16 Feb 2021 12:59:39 GMT
strict-transport-security: max-age=15552000; preload
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: image/png
vary: Accept-Encoding
cache-control: private, no-store, no-cache, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 8WHx3Z8IFoG.css
www.facebook.com/rsrc.php/v3/yU/l/0,cross/ Frame 0623 128 KB
21 KB 7ms
6ms Stylesheet
text/css 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yU/l/0,cross/8WHx3Z8IFoG.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

35fe3377279d21fb5a2e01f92eddc9f816cd4fac3e303ca246596104a81eba95

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: mHUqx/GMpBmazQ8Pwx7B7o7YL9dYoZ7GB+nO5SzMaqI+e0JVb7uHbuH/vDjvUJRp6r7gEqDSnq2Oer3jwas12w==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: 9zv2T1PIYDE9iijrIp7/zQ==
date: Thu, 11 Feb 2021 19:48:29 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 20921
x-fb-rlafr: 0
expires: Fri, 11 Feb 2022 19:48:29 GMT

GET
H2 200 l6bd8n36H9V.js Show response
www.facebook.com/rsrc.php/v3/y9/r/ Frame 0623 270 KB
71 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/y9/r/l6bd8n36H9V.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5e6e38efe361effb2b05fba9a24521eee8539324a1a75668442493bf9af2919e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: caVVS1tE0w2NbdFkk3/9sKgSBhfFJd7bttIldiwQuDDuTui5DG9RdBRn6j/PwbZJfAkgCowbJ1oTNqDNwXZorw==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: kSbzZXfqGed2dBjYaPta0g==
date: Sat, 13 Feb 2021 03:49:59 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 72555
x-fb-rlafr: 0
expires: Sun, 13 Feb 2022 03:49:59 GMT

GET
H2 200 zbMmM-_9j0u.js Show response
www.facebook.com/rsrc.php/v3/ym/r/ Frame 0623 41 KB
12 KB 9ms
9ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/ym/r/zbMmM-_9j0u.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b0a71905c848ae9415bc5f7ff01744d43cd419c124ffea02038a016cd046601d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: rY9LnCP8xhINK0Eh5YZkX//Ls8pErpctr2UakzMbTv3RUyRL4j2iI7yBStsog7+tYcQ33WJHmaKcey7gdytkkA==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: UkiFmHRvC1xEq3IDm+9UOQ==
date: Thu, 04 Feb 2021 19:37:09 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 12398
x-fb-rlafr: 0
expires: Fri, 04 Feb 2022 19:37:09 GMT

GET
H2 200 ApcBOUT5FoS.png
www.facebook.com/rsrc.php/v3/y_/r/ Frame 0A19 573 B
784 B 11ms
5ms Image
image/png 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/rsrc.php/v3/y_/r/ApcBOUT5FoS.png

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/rsrc.php/v3/yD/l/0,cross/Fl5LaP_p44_.css?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

641e03dfeee60c05e0794bace5fc58d2fba409fee529a114459e44cee0d9d069

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/rsrc.php/v3/yD/l/0,cross/Fl5LaP_p44_.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: k08tGtLRWKYYjsAGBVuCgAGlijQyybqKvR5yxQ3Lj+WlL//TeUqMuWovaCXL/FVej56MpfAb9xN5p1vqhOFTvQ==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: Y/eW3MWFNJnkcpEqoXzG3Q==
date: Fri, 05 Feb 2021 02:17:17 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 573
x-fb-rlafr: 0
expires: Sat, 05 Feb 2022 02:17:17 GMT

GET
H2 200 IiLBPaprHvE.js Show response
www.facebook.com/rsrc.php/v3i7M54/yW/l/en_US/ Frame 0623 145 KB
40 KB 10ms
9ms Script
application/x-javascript 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3i7M54/yW/l/en_US/IiLBPaprHvE.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/rsrc.php/v3/y9/r/l6bd8n36H9V.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c52c1d248454c1e7ce1f1ba5c951d56f7cb66dff364677148dde10fea10b6e86

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: ngHp7LyffdXgSy3Le1F4NADt2awi0IZolnrr/rvL6CAEydUO+KwWyMNrJXbQLzDJLhvqlB75OoAq+jC4ZbiAZw==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: fkKrnnRZfgfX5pulZ+MTBw==
date: Fri, 12 Feb 2021 17:44:13 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 41116
x-fb-rlafr: 0
expires: Sat, 12 Feb 2022 17:44:13 GMT

GET
H2 200 1vtxI2eVxx3.css
www.facebook.com/rsrc.php/v3/yc/l/0,cross/ Frame 0623 1 KB
715 B 11ms
11ms Stylesheet
text/css 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/rsrc.php/v3/yc/l/0,cross/1vtxI2eVxx3.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/rsrc.php/v3/y9/r/l6bd8n36H9V.js?_nc_x=Ij3Wp8lg5Kz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

09cd042f140a4f9886e8fbc7c3fb92532c8a842ee4b68e479add3172c22fd8e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/plugins/feedback.php?app_id=154822244543652&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2a0080066d044c%26domain%3Dprnt.sc%26origin%3Dhttps%253A%252F%252Fprnt.sc%252Ff3449ecb58c9c78%26relation%3Dparent.parent&container_width=340&height=100&href=https%3A%2F%2Fprnt.sc%2Fzlspa2&locale=en_US&migrated=1&sdk=joey&width=NaN&xid=zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fb-debug: PRNdSzQFVJwVvuAVhf/jmT1cGgTgU5ucOpV5bWHrXy+joMxDTvjHzBdrTs/GtyZzZ8+obS/68Mp0SCM2exP9VQ==
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: r7IqCuYseV/gcFU2RVGeww==
date: Sun, 07 Feb 2021 21:11:18 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 502
x-fb-rlafr: 0
expires: Mon, 07 Feb 2022 21:11:18 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
803 B 49ms
28ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 16 Feb 2021 12:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
803 B 59ms
29ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=prnt.sc

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 16 Feb 2021 12:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 44 KB
18 KB 586ms
544ms XHR
text/plain 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3205280526817701&correlator=2597297207805210&output=ldjh&impl=fifs&eid=21068773%2C21068891&vrg=2021021001&ptt=17&gdpr=1&us_privacy=1---&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20210216&iu_parts=60257202%2C60918%2C70076%2C60916&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3&prev_iu_szs=970x90%2C970x90%2C300x250&prev_scp=amznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D970x90%26hb_pb_a4g%3D0.05%26hb_adid_a4g%3D6aa6e8539dea99%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D970x90%26hb_pb%3D0.05%26hb_adid%3D6aa6e8539dea99%26hb_bidder%3Da4g%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_format_a4g%3Dbanner%26hb_source_a4g%3Dclient%26hb_size_a4g%3D300x250%26hb_pb_a4g%3D0.01%26hb_adid_a4g%3D894f0a5a06a4bc%26hb_bidder_a4g%3Da4g%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D300x250%26hb_pb%3D0.01%26hb_adid%3D894f0a5a06a4bc%26hb_bidder%3Da4g&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1613480379&dt=1613480379833&dlt=1613480377947&idt=1459&frm=20&biw=1600&bih=1200&oid=3&adxs=315%2C315%2C315&adys=70%2C1133%2C1255&adks=1432691387%2C3120184932%2C4042975291&ucis=1%7C2%7C3&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fprnt.sc%2Fzlspa2&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x90%7C970x90%7C300x250&msz=970x-1%7C970x-1%7C300x-1&ga_vid=332265398.1613480378&ga_sid=1613480380&ga_hid=1562925338&fws=0%2C0%2C0&ohw=0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

859ded66e754fc423c879c565cd3bad6d5b46eb2cb67c5cb50e771421c239120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17417
x-xss-protection: 0
google-lineitem-id: -1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://prnt.sc
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 52ms
14ms Other
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 44ms
8ms Other
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 container.html Show response
c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 93F4 6 KB
3 KB 35ms
22ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Tue, 16 Feb 2021 12:59:39 GMT
expires: Wed, 16 Feb 2022 12:59:39 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 container.html Show response
c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame B8A0 6 KB
3 KB 30ms
21ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Tue, 16 Feb 2021 12:59:39 GMT
expires: Wed, 16 Feb 2022 12:59:39 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
28 KB 41ms
27ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1082b879cd43a0dec9ab3cc9ae2ddad7426c64e73fed45067c89afcac5bdd227

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1613161064837431"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28346
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H3-Q050 200 container.html Show response
c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame F181 6 KB
3 KB 22ms
22ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Tue, 16 Feb 2021 12:59:39 GMT
expires: Wed, 16 Feb 2022 12:59:39 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 52ms
31ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021021001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

427f32df0171b235458430b3fdce6c64b7c2c3d66eef78c17870002d90bddc27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6419
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1BCD 510 B
551 B 31ms
31ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ec204561656bab028c2fb1d77312a95e26333f39b4a2a274049423f023acf5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 16 Feb 2021 12:59:40 GMT
server: cafe
cache-control: private
content-length: 236
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUl4gAthx5SFrwoyPViB80BRpupaVWYyF97pz6SPkRag1womm86tXvUC300a; expires=Sun, 13-Mar-2022 12:59:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame B8A0 39 KB
19 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BrwLxi0ixCrLQCfsr1QMC7yf4ePqr5W5NIgoT2juZgN-8HoGBqLAV9EsWayPTVTm2Cx2szv9zPPge6UYudbmwEgydFB-rLENnpz2yomNKO_xDrbdKLx4SwMknapOnCooOyP23TYAFylOhvDsVrhc5j4cvJkA&dbm_d=AKAmf-DBUzwwEDWwqykDv0h1TXRq8UN5idpj-08UszUX0EAtb0SgfpQxKfp_JAjRWBdpMbXrTqzZ1k_CnvcbLA_GiRTu4zNbaYFur-NY5ZMtbM5hg3_8dEJ7Ns9f_dof3Xk4E5tXcW5rJCXIuWP2StvZaPv2XSUMyc0ZQF1l_TMqqmeO5dYkYWmmmCZsqLGrCJYAUELWMTn2AuyG-L4jHLRLRR_kodYBlsY19DvRSnGJmp6oLDtZA-81K573_xlhVSVfMy_RbEYmuBdQI4VyRzin33AIHjcCdOAfutvQCdFfvaMmJqXZQ1jUbZWlTXNvQ3aFtlhVWY0i-vupepHJvyfl_3-Ri159Rgc1IA2MJiEpKvkSMGIV3g_KWViHw7n0M8nBW8q1m-eYOj1dWA4zTjDuFQ7lv7H9l-CZ1WbGGhCRlU2w0opmSVxY2jXuDydjnbSKoJpvKhGcaLDOL6eC3roqM9TXSHlSiTUZHko38LPEh2KAlbPQp3y8VuPRCE_MbqHWkkwfQq28Pagm8_VSj26WzE-6O7QSxBrHX5ytk91Cxv72ELlRPnmafnqBqmFK4CR5tDztB66m_aDiPumbLLWMoFSETyqV-JwgDuJJak0LnGXagNLBuvFLRXM043M3l8sIa5MzoerL3zajfgEAE2LS2VhzXFRVYlr1PGZBgSz9sdcMCZXoHMMKIBi4PhC7L9fpicmNsd9tVSnolHpNvcyapN4RBkEm32eDaaPrBdcbra8rwGWkcOpU2WXP7hqPItSlSc0uxqmmi-PPpDKSU3VbFu_iayHLG5y9gxAFis_E6eQdKOxLRzm1cq3ipzETb8WotmLLS5fjkQBEoES1EdQ7m7uOUDTerN46ae0HUQqv4Ulw21oIwn7a1H6-3-fbQ3bglviK6OLvdn3FUuouCZVUbU8RmbTcLwnyR4VRjFBzGPJ_ppuELwTvBVadTJoXTYeO_wq3KMkY2hboRLxyvGwi-WRs61fL_u46PRPzkKjo7YtnQS-D0ywip8ZiH4Ns3AuXinJiYnpES5WZ90IxuQsjUD4EaBRn9Xur-U6d97kbpk98lG22odqH2nZ_LsvhmsWhcDPK2aEDDVPKSygNQPmIVEl5Xch2Zye6nag8wewi302eXNfsfFmSx1s-fUsEBJEhWewYJSw7rGPiuXyM8YNSEvoJFDvwfBHRxJI7iJPt187felKhkkh5K1_h4wT-6KqaBMZKaWNFYdR5pkXDRqQyiKHKiHEM_vkIp-ur8vGowSHYv_XD-d1SAt9BQEiHzKr0Ph10FBVTSYeWY07-cWl8mAclL1kqU8CliXWnB487-I4M4mkltvCWOJMcPiETe7A9crPirijbVo0Qnr4GxGx-ksT7Sgte75cne6XHtVw11FrFlBuehuWJv_31WsvafVyrZ5ZPNw2fEOotG_-OGSYgWKN0NPxMbkJCiZ_kbTAgpm0P9iKL55ekhtnjvZ0KaRP2l3mtILwmgZaBnDxXT_xl2Oxv2QPX-ZVQL40K3WmgKE7a4JtwC5gzpClkweGcATh-pl-bJpNVlm_ofu_41ID_6gs-Ajb9tCzZBKc4xb-VqowYYCKBDL7Pug8OwihzdIC8QXYintRCgFkmhDzMuKFLG9yxcYtzLtQwPsB3JjxBn11AbR1Dqe8GBbcj-EffOF_VfBuXrQFT3FtO9TqmtsHDvFJAzzLXo_j2ffjzSNZrpgl8tghw3kj-PFW7h5UAjPe2DKiNtPXIk4dK79UDEELnxGZFyPMn0oBnyxsnMF1tqON9NxMD8-xXJHpeUFx8hQC8FhuIgl9QylKioZOYxakXTOg5mEIV51CPZT3cC9NXQgXDHo9rha-jKgPuAnQTHHEQ0CaoWxy4F9T-MbuL1PoYol5g3ZbGPe1pmAQvsusWmlgNh3HJJp0HaokLWTJCo_75JTCZDNlWIeCeZ3UBPe40JL555oq_12dPzQLD0q68p_g4AAwCPoT359wrZXL2EQOKjRnQT6fgalZurH1TJi6XxeosCRhLuClWmk_vWtMcoMdq9OBAfn2F_HPyVBwJ_TyQsvNxHS9HcvyVzowyy4BMIb9sxKOgAIPHzB3xFr81QTFFPdzNW2v6lCZloHcwaU-0JGOgf0krWrExMu9so8LGkggRdrJN-TRLjrDVJN8L0pNyW1bNhnig-XahQ-tp-ZP17r6z9f6ZpRfcIsHEKE9PPp007cqibV1fU9dx4xgTFkyQd0wFAr9OLefsacj1U-1Gr-_8CvzCmcuw6XlGdqvYo-GEQvGzaDd7aVj14jzYbp0OdAnzn9LQ_XiKymUJBvaPFLGD7Nqk8NTJstDSOnP3jlCZ_-64PdqGXSkLFj6jffGmJ7HoiQJjayKRjFLrbCi5NnGu3YZ064WteQ-gbhjsTkQUr0Z19AKVN0GVuDkMQMQDwN9KkITgPTNOSJ5aRdoy2cz9ut4sEx3PU-6RwwImGoDVKJ5_epXU7FF6-we6Q2SqFTl7p0Cwd0hlMWkIg4rWIDPPY1CoutTp6CcLAv2a8jxowh0GqO8gR6qpxvnOVp_MOXGTprKCC8-G1heJmFyDiYjBB4tlN3hbmtJV3XqtMTEFOrSGf9E1RKAYz3pVR4AHCR6tBIhiNGG8EmxavmlPQzdzN8DLPtYUS0IOhtyCsars_yzUOFBFK_cIbbU6DEDWJHLiTKgHv8dRLUYNImao5Nbbacoy80egDC-xDQpLChFGsaQrFP6XU-TMy5ZryWdcFs-SHy9HL2jVwPf0jXBjnxgusVQbwT1YkqOtzYLlatOCPtuLBuQoSdmYg2A-46T0B7_XgAVIMEKCRYxAzIT1wGFmLI-oPirkw4tnJb7Bxae3QVeM767W0BGcqWdTLM6x4S7miXwO7zbIRkHc3AaryTp83ymjOykSdrYztUQ1sSVmY9sd7niJXoxbRVJXYLJXW-9IX8kW0KHA1FGP29t2a8eF_VPBCnB0wfh99ScXIUaP-ruypK9dA-FfbuTDf4-UF3y2icsifH08Vz1F5XEFPAAYvRMQf4zha2DckNH7XMHUNnZVntY4PipoC7f2KMbmDi4-GAxAwKuWfedSn3vflSUESHjG&cid=CAASPeRoPBDAzdeOK-WJGPRhH9GLH1hMkoFD8Dm_lBSEcvKpMYFnzPqj8esKaZc7d0E9l6tTM4eUK7s6pMcnKlg

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7687196bb002f79b05865878132ec2a79d5f824a5a27a70754a8410fc577895f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 18851
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B8A0 42 B
744 B 60ms
38ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CpMolyYrzCR9X2Bo3_JTeVYu2my9q9nwk-8xQqnGDi0kIzfNJQbsIkb7UV4XBFzGCe_KxtLJAmzSU0uYNIc1aWPVi-HIB6OOq06DS2dpfc05uWLR4

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame B8A0 3 KB
2 KB 33ms
15ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/window_focus_fy2019.js

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:56:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: cafe
etag: 8852521427838746165
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:56:05 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B8A0 107 KB
33 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

782db5605136a4b7d143bfdacf544a921cd7b8b2bd8c1fcfb1ff51baeb1d4cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1612960666436283"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33367
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame B8A0 14 KB
6 KB 30ms
12ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

718d8e9bf93740a3a90b67e53219319342074524b2dede8ba219eea4c41ea0c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:58:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6139
x-xss-protection: 0
server: cafe
etag: 15217341015479086142
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:58:49 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame B8A0 0
0 14ms
13ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQcbaalDnqZ4VnOL9il56t1px5m2ZF6KkZ0JQgtFO4Cu8mpSbpZGxVsssi6ctI_VKtJ-yea
Requested by: Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E9FD 510 B
518 B 29ms
29ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ec204561656bab028c2fb1d77312a95e26333f39b4a2a274049423f023acf5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 16 Feb 2021 12:59:40 GMT
server: cafe
cache-control: private
content-length: 236
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUnEAa4_pbmi-HeXJaFuaeUWxe7hiQ2kyj1mfRpujU4V2WllE5sMwJAgUUUI; expires=Sun, 13-Mar-2022 12:59:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0908 52 KB
21 KB 59ms
57ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DET_rWyi6cCGUVSUHZ_DDDz4G3rOMKtEdnum7W8gp61LcqUMwmciCJY-517QDeayw5UINTpvLWGn5G1ARcwwZetpWyqy9Q4fKz65O4zdfO8isWHDHVdU8tbYgGbs21JwkVuArK7o4oc6145R6Cx4A2ZoQBig&dbm_d=AKAmf-DH01CvoVITIyMEs7nAXIKNRgBaGHhOiHCecK_hDy6ktBQn2cFDxHycjceMZVMuoHqMznnw5pZx7ddQXkboLw5xYaDH5efTCe9JX1I54rK_A3MPi69zdS665vb28xDxbAstLIGsiPuZwaw8MTgDlvSAgEznvmGJ-RegbeJATbtjNO1TPokCKGgW4i_Iy_atNnKpgRaBDoaFu77sMgpD5RGd6i9vhyJGfbbgVCaVvU7X5ignCvnjlBaXewxPWZpErXJP5fj9e6oD-gnZPwpnU8XIcM6kSOe2mmCjuQQuJ0ZWxty4jD8NZXNFI9_2K7W8Z_NqYZuHOLqc-wleXHfvd9243UBuJv5vp-DL_7xoQYZ5p2tvt2Tnjar8KN0Xr9RZtpHU4jBiHF53RB7IX6QHQrT1D9eJxgmxo5iiPZ8jLjcjfKpgdR9U4O0hltA_4a18JxsIXHAuvDjMnqI4GJ7gSDlgG4rWC3-faTQyzzk9554p3BFN-0Rzj11xE0nA31xlUrZd7Lrl4NU040Bc6u21ADOJrSnzT6tRRY-9v0hEYtlbo7zVSqpeR6CtXMO7q_TNkWjERbl7zg7cjDhy_iTEPOPfAxIUOswcO4XYPnupgko8T2RjzNOTHr7kTAEu35NuwDhRdY3t9X20PN7dMF-wR3RravkLvMOyHDTKqVW8-SAloEIHMzh4NgJB6W8wQQQWm5zebS71kEJqCsvpQaMBRcvLrIH84-etzIfz5sRDivZM5OeLi1w2lbDBjLHAzmLP2udykRx0fLb8gOxiHleDI9MqJHeWZnjfGqU6dgLvWZNqJfJNoBPQWO37vAh_abKYCqkYmpnInJ1iRDOLGtBYsJaZjFe1bo0UfP2s6PObkDIdUXccdfdHTP87RSuFSsQUlc_m2GGYe29AnF81WTWFcUkrTAK8x5d4LE16JKWZl8m_TnlBCiykzEhWcR5DaqWpb0kK1CLPbE95yKlWsmk8V84Lgn9ztbgxUN85T9pFvV5yIK0-mClZfAQjG8_WuZTuRaifFJi16jFv2YX1xxw_dFYsl18a0KJpzTfmuxtZLBZD6Ghk3hR6qVjDkLg8iXgSDZohUucD0bl1MSW99uTXarmfwwypJzixloz8fwrSc1VJMAQyGDSDWWUu1ON6p_0u4QMRPltUW3ldPqd6TN1UsAg-kMHnZlLhviSRkrXICMiH95Jto0TqhsEMhLGP8_O12-75MaBZVHNNyyBBOfXFYJQQr3w8GG-ZM2s4ktYtfQ3dqlMMMGb37lm6x2hSKo-ErNeAkuFep4kXOPzkRAi6WOGMEMsiqW__GmmbWWW7onm_mKtIGsajfrlsw294SucBggLYpWqeuowZpZDGqg6wQIVWELmDSGPP9BWkSWsBK4xt1botne0KIok9WSlmCFzwGxTIwwapYB0kvsSmrVTEjskPUfVNqgY5lvE3X4CYL0LmS-a43VsxnOXVxYZ35YcwgWUF0ImjMS0JinnMHJDSwXjoQRy1f27rEvq6Zz4prrvkL3VOcZMMDw2Q4HJVG63YFtv7jZu0zTDemULZFsiPoIjqwn5yraYygG5Y062bTRERKkSrMrTK7jgSV9ytwKGRfVQMROXmOH-cxDBN9zpUJ4AJzJwoxE_VrQIkJ60QQClMw3we2c2LodQ_F-KHhpJcwmwU7s5nYYrvR_1tAF3t4Mk3YWBbD2fAeP_3GtPB6EHhEodJOG94OShij4HEv6F-SBwfOj2BtuP_1UoHXzCccoi7O2r4SEhhIEFvMHz6-CcrKPMQRuC705n_orXXQi3i0AdYGD3nViYU3h-rAuTKRnzaJAlObS52-n4y8aBtaCbF58LAnuBuFcQACnXLqC3C6tY_eOJYrC3-Vst_sXmabsv_cg36o3PWcivTw-4be2RRJ02bJn6RPIWfjxdNrnOsGr1c0a5Bwd-3XGjeN7psh459fSxy6b8NjWjFInE22HyOQ_CRFiOzT8TTSwu_QNd2oBYxFUKH31Qtd77adswA6s0FIK0S8XiG0M6AqYouk8OoyvuBzRlay_7UDFyNQjx3k1I_AOG040qQr5HBErUWKpO70IWaneOMGBeIrXLE00zZdPtNHqdv9cCOrXeZ9-vDPIWol0sxYC517VIfK8P4DqcvRFLb0GBe-HU78PprGFwgwSwsq9epVHA5Fcjx1hMzS-2JYgHjtEnxw14fZuas7KJhmMiW0SJmiokq2INYiX9q1nSflSyvHIIlKnt7tCp-PfIPc1J2LKf9_1l5UJzA9-APSsGxMKZU4TrALZHuc8utPo0T4PBaMpLkbF3V3aC9OYH67J7qdHHLij-rslIcaWIQuFcs3vIdZF33lhaiiIpkgfMQFH_HNCBItNXmmsGeCTeOaZG86Nfat8MAYGdhTNev2G_JATSYc3NfZAQluTbgBDGb2IUfNZtITcuWbzPUf9cS4rW2PKqRP_SDay3_pDXvp-wZvM--iNnNFRmBFYZP2BEfrkAUmcz9e1oPZ_-gFrVSaAWWBRPjgPtCZwOolFeqQWNp8Az6fEI8dDd2iOnrzssrIXfU51r4cpAKpcrhoMZEMznF_aJxUVeQL27uEaxRsHL2BrLH2x4VZaws8-QrYvaC2DdvFay2KHaHV5RJ8MGCbtkP8KKFIiwPIawZhT1IeEkS9Tr0DEnodUI_2BYFhb_HGbe8WUDoApN7spuHYUDcCDiA4cmGDSGB6HuKe37PR_0ZAjqMmV-hZ3IK-Zswvj-sUhqRpu2W5067qH7pcDWMw0amKOmk4s0uldNvxcPfgWPllxyXSHb9QKeeqNWr1Qi8j2Q2D-YO8M8bM0mkDdwPAiVX40H1H0QfzfPGbo3B8TGlNAQULrLEXq4Zi1iVIsBDQf57SzuTUvZ01Tj7e7NS6MVEkXzyDizGm4kuC3eEv-dUPQKqqNFhCsHTDdokXbqEDJb7u9HQowaNFCLh9wktpBCjRLbUzmaOQE3Zck1w0JOq43K6oKxO8OpLMcOS8l8AqL9mfBfD00JqArBu4UhHKJ4A5xdob77kGYImCs71c4rhoA7dERF83PR2ai3fX0Rvw06wSly5Lr-sspTRV2tGZKXp&cid=CAASPeRoAVVrI5sl7W8DY5Ssx0t2WLklmcx72f3JuejNCo_1H9C5uMRcIvuxOpB1Pj9QICS7cIPcCdZNXeIJQIo

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8832cd4a31f82cb5a72600525d600bbc587a732c5e4abd5487c229c1e0564d08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 21519
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame 0908 3 KB
2 KB 25ms
15ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/window_focus_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:56:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: cafe
etag: 8852521427838746165
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:56:05 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0908 107 KB
33 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

782db5605136a4b7d143bfdacf544a921cd7b8b2bd8c1fcfb1ff51baeb1d4cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1612960666436283"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33367
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame 0908 14 KB
6 KB 23ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

718d8e9bf93740a3a90b67e53219319342074524b2dede8ba219eea4c41ea0c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:58:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6139
x-xss-protection: 0
server: cafe
etag: 15217341015479086142
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:58:49 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 0908 0
0 14ms
13ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSy7FDUfEOkAZDtXihh8iDw0GUg_QMagkU1VXOobFuooU4hT78Gnkay7nJaZF2pKKzKV9ou
Requested by: Host: prnt.sc
URL: https://prnt.sc/zlspa2
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0908 42 B
107 B 52ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-COR81sx37FnCjrp_EkiEDwnd9HTNk_E6HfJE0bw2CBEnA3tGDpX0vFo0t6GwqwkuJoqDAlS23YgW1CUJO0I00oMgQ5Jdtxhed1QQARWGmr_yzUwrI

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D824 510 B
520 B 33ms
29ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ec204561656bab028c2fb1d77312a95e26333f39b4a2a274049423f023acf5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 16 Feb 2021 12:59:40 GMT
server: cafe
cache-control: private
content-length: 236
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUm8CU4VZ_1eWOdY10MENYVE9hapGfzPUnjAvK5ykh3AhvIeYVGXn_T7RHmF; expires=Sun, 13-Mar-2022 12:59:40 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F181 22 KB
11 KB 55ms
52ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B2BfqYB-oSZQvOP6gawV_OZNFQ08azkgXeufwcsvAssTnZScOnBki_oPZd2HTcfGNVFCojaumlMFbxuvlrwD5sIg6j48Un9AiXu67zRHKGTHr-YrZ9S9J0hx6XIqSGJXZyhrX9ctd6UT9_4sIRkLm2fQYczA&cry=1&dbm_d=AKAmf-Bvc1_n-Z5zrbDyQaJYcI_AJi6k-qK1QN_MmY4tdztAol2T1NTpHAsSSuZ8Vf4OI6v0hRI-SLge_iyeWB-5NdZ9Iyz7AMkvpFOl2_kDeWOy0tcLT5uwjSQfOji70RmmSy-ASt-YylJXkn1BU_TBNPYrVu_ei010v2vl-4dNjyq6pSXfNbQIkszPXyxQcyNP8L63OC4X8OrTCajYmijm3lTW6YKUSvJM_b6ZMFqAJPMRR9jqd9D4nOOye2VclFuimeJYZ4P7crwen3MEpVosBzaKb58k0ELf7RC9g9N_A9jZh3tRVZULEJjkXeYi736_90iFwSh-Wi75l4Qe_tPCYEsXZY9Garm6Se2yC3g7Z1xCOC7AsWisYg8W_moZQBl9j-IwTL3x_NtDgTgt15HW6FxijDx0Cx9HlHUxhsdVU7FBASfHdqDfVWPzlhdLiYqInWgMlqCQ--835BA-WoLb3FBEp8jCY6JrIaY7yAOXv65Yu21OXDkJMMfdMzHWnfH6GgqvdMdVxhjBn9DyLpDgeX4K8bheEYqWtvIQ3IsPb3ad1zZ4OV2t4ii2gSPmrLdld9IqskIHXbyRtlU2LD0XjED7s1sQPFMe7EEDoJvfgRd11xzDol2r5cV59p7FF-_vvm9uBg0SsZYDBPS7WNURq_olOYOBdkjt3jSbtn7V4ExN5-qTRJag48mnjRS_s9K8fatLNrPYbrdkT_KIo7U3JywkDOfAroAzB-UrdDa9ljA_FoNzwf4ZGAdcAjBecE2Lq0PhQNJXqV6ePreEZ7aFThJhLLJUglsJ1CD3UfKtEGZOGB3xkyGRihJvt7WpwBE10Vi4seEKrWkveZVmHSYMHg7S-T6ObIUIQue9gQdSO5tVIUWOFK_XG2oN-1e9UaVH6glnvjjkVyBm6a7wTWNEXC0T-8zq9S1g5f8-XvjDktCQgXohTCHofUxE11UgHQo79rR613PrIPdkddW0G42RomuRWZVkUuRvUtjBZmPpakpZoyrRPESHwDfQxcmJlRkM8ghpPq6umlcvrxbOVaOndZ-Fyf_Sa5QdOJpk1WdpBGZSeHUq-_-v4Nu6e7nP95d2CoV2yZ2MPmgewd_Pb7H8C2wKjeYp6m9bU1AhW31w2BN5tOpub_ku3HP2H4XLnE3ss9T-wrb7VUgJyWS4DA_Aiq-PbD9MSzAb9Ah6fsqV4g0qAu0Ho6bOrcDkdQPGdPKgNM4zt0Po8mZO9hmJ8m-tDJN9vxo6FydNbdBrflvSiuiZnwveH0V1MEIclmXbN3lB3Lhug3UGIk54NZ6-fqIH38pkStvpHPae5FNpioWnRJuAeUwmzqytn7gpTEqJKIfBepIkn-Bl6FZL3MB-0EEsXhTib34TokAeneeh5KlVsU0Sdmqs_xRCiDaQe202wxcxeHXpC3T-DtACu9ADXrZZBEUMkZaDrn_7La38CMsTghvrl-6HnRrPC71iDT__PliQQAkYfQDlQHA3g-WiHYh6CdcBMbHvZFaKljmQl3VsdG3o4ymOC-xUzuTe4sGAQMlqwgnCBYID0fljUhGTY70PphBdc9L3U1gs-gbZfaIkw_by7_txWTzRZXQV72TmdsmSpxH8M9-dJYlbxglA93-cnSNq-mR2RBgXzfRIBDZAR-kiRJVuCUQD4iR7syxBD9EfJ5_Acx4qHaEvyp7X7cpX3CY90Avw12Of6H_LhkCp-SWbpGbaupqywrKF3pnOa1so0ldfVNcTi4n1a-uyFx3jHnnQ8PdddYyPYCM7sbkD6NxPcVPoIcas__JEF3HSlSG9-C99ZH1lW7KBCxcGobMahCotcYza1f4huOh0fwUqDPCMEL2JNIweUE15NlL-d4gcd-HGZIqArkiG-K8kv0R1z33AtnYa4a4sKSKDdEPWbK-5gAMd4ivKqf71J7XXppmzotU8_s8rYk1OjjgAFi5WtNMzC50tpvdsTwxWXudPOnAn0owe062NYOZIUPPL0J1VcfForSeaZw5HS29st66xIwYJOoNJ5TXCv0_BNriA_K30cdc-_ovV8k2e3eHyjJTEw19JLlZrYZ5_VJ0_i_ywuBq__WffU5iUruJ8vpbNNwGwOQ6OZH3inGQlcQvrXNoIaIe4-y2u1jilvz-SqIq15hXyqPq-fIfRJky-nHWDv5NHsP8lMZpHnt_RzhTs_B08A0TCmU6PzBhEemF9-ALI7QFnoS77U0g-ajnHLWjq_emK3SZgduz26Z8HYrGcB0OO9oJKiGfAVL-yPoZTOdjkBcIiae3U20yQM7IupGiAOja_MKBbTuLtJDMs_ngasQEr3VmSZ_VKlE0QHO5Kc3G8wNqza9mAAqm5EiVl0ksY1qNZU2G9u9H0noI25CtrNSharFxfJXbFeQ9l4VAxmI6YWwRomVW6QPseynhiZ8k-dOUTjCoLPoVBkVjGh2SQydpBQ1Lt9VDmn3GZduiBC0BkylKLdcniyu3vKUGCHxUZqxo8hwIDlZYmJVk8r-tAC8ddd23wzkXwhhaWgL-4usLFDjr8QiaKSpFQwhhpos4Q2C4Crp1O-iRpS8GrC6MIm2FR1OnzLwQ39Vwui56vo6Epy3qPkxZSnB2hGmFkJFRZF-JbeyjPp2o0tIgyK8PDSWUQTS5tVJ4mpF59X_Ga-XO8OaCbNEpf0gJs-VbWeMSLJRw6DL77Ryn2Em8PvaAs4BJdnsOXb2lZ3vXFNTs1dSXOS8uCSqCnUXpIooY7abZpZjZ6UjoaDtf_QIjuU9lu84Ps7_PL9wUqI0IQEpaeyzoP-nE9JsbsHNNInmJKsV2AzG18VUM3Klk7ioCN8cdrItG_PGk_MPh0vhdFDeBA6NdgDgiMr4f75sv9tXamEZzZo0YpuhvgD9zJmtGCNeL5xCAuxsx-14_4R7T9GV85bqcDjjNFEdDnVc_XzffFtYds7jSifOs3keNDjwkBGYutou3SMGDJNk48qj35un5yksQ9jypilVQuMnTC7yAqqiMCRQVfwEBI_C7avvAWy4vRLSQ_dpdGO44ojcO0qnj85hzvfqb7dX6ITCVslUWzGBrI0RRo56Y0ah76lLAag9-IU7XW4b1Kh8F2MCRpGS83BMcX7xyQ1332uayGX1e1DBcmPMXhxVqVZIVDNR1_4HO1MZMbNV9OpWa60ImL0rtGv33sihNpI9FpRzo1Ur2s_0n8owV1wT86WHw&cid=CAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eddb994832063abc72c356b4c686046d62b1c5ae4bba1b646267e4de6bcda0b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11337
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F181 42 B
207 B 42ms
39ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Did5sjAl5azSJVSpDf35vJHwgijRGXznxwvoPXuMfNzoVNi8f7fkBGHLedtEY64FDeU2FThdWT51HE1m3eJXg3PT2_IeaRDIx3Cth_t6nAMU_8k-U

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame F181 3 KB
2 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/window_focus_fy2019.js

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:56:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 215
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1546
x-xss-protection: 0
server: cafe
etag: 8852521427838746165
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:56:05 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F181 107 KB
33 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

782db5605136a4b7d143bfdacf544a921cd7b8b2bd8c1fcfb1ff51baeb1d4cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1612960666436283"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33367
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/ Frame F181 14 KB
6 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210211/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

718d8e9bf93740a3a90b67e53219319342074524b2dede8ba219eea4c41ea0c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:58:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6139
x-xss-protection: 0
server: cafe
etag: 15217341015479086142
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:58:49 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame F181 0
0 17ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTpYy5CZQdlv0d7KwHWtk-x9tGd3uma5DCHrYWTThHBJMp7u18v2MZ_w6Fx0OwQWB-snmpa
Requested by: Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 20ms
14ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021021001.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1611170586013198"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6403
x-xss-protection: 0
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/ Frame B8A0 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BrwLxi0ixCrLQCfsr1QMC7yf4ePqr5W5NIgoT2juZgN-8HoGBqLAV9EsWayPTVTm2Cx2szv9zPPge6UYudbmwEgydFB-rLENnpz2yomNKO_xDrbdKLx4SwMknapOnCooOyP23TYAFylOhvDsVrhc5j4cvJkA&dbm_d=AKAmf-DBUzwwEDWwqykDv0h1TXRq8UN5idpj-08UszUX0EAtb0SgfpQxKfp_JAjRWBdpMbXrTqzZ1k_CnvcbLA_GiRTu4zNbaYFur-NY5ZMtbM5hg3_8dEJ7Ns9f_dof3Xk4E5tXcW5rJCXIuWP2StvZaPv2XSUMyc0ZQF1l_TMqqmeO5dYkYWmmmCZsqLGrCJYAUELWMTn2AuyG-L4jHLRLRR_kodYBlsY19DvRSnGJmp6oLDtZA-81K573_xlhVSVfMy_RbEYmuBdQI4VyRzin33AIHjcCdOAfutvQCdFfvaMmJqXZQ1jUbZWlTXNvQ3aFtlhVWY0i-vupepHJvyfl_3-Ri159Rgc1IA2MJiEpKvkSMGIV3g_KWViHw7n0M8nBW8q1m-eYOj1dWA4zTjDuFQ7lv7H9l-CZ1WbGGhCRlU2w0opmSVxY2jXuDydjnbSKoJpvKhGcaLDOL6eC3roqM9TXSHlSiTUZHko38LPEh2KAlbPQp3y8VuPRCE_MbqHWkkwfQq28Pagm8_VSj26WzE-6O7QSxBrHX5ytk91Cxv72ELlRPnmafnqBqmFK4CR5tDztB66m_aDiPumbLLWMoFSETyqV-JwgDuJJak0LnGXagNLBuvFLRXM043M3l8sIa5MzoerL3zajfgEAE2LS2VhzXFRVYlr1PGZBgSz9sdcMCZXoHMMKIBi4PhC7L9fpicmNsd9tVSnolHpNvcyapN4RBkEm32eDaaPrBdcbra8rwGWkcOpU2WXP7hqPItSlSc0uxqmmi-PPpDKSU3VbFu_iayHLG5y9gxAFis_E6eQdKOxLRzm1cq3ipzETb8WotmLLS5fjkQBEoES1EdQ7m7uOUDTerN46ae0HUQqv4Ulw21oIwn7a1H6-3-fbQ3bglviK6OLvdn3FUuouCZVUbU8RmbTcLwnyR4VRjFBzGPJ_ppuELwTvBVadTJoXTYeO_wq3KMkY2hboRLxyvGwi-WRs61fL_u46PRPzkKjo7YtnQS-D0ywip8ZiH4Ns3AuXinJiYnpES5WZ90IxuQsjUD4EaBRn9Xur-U6d97kbpk98lG22odqH2nZ_LsvhmsWhcDPK2aEDDVPKSygNQPmIVEl5Xch2Zye6nag8wewi302eXNfsfFmSx1s-fUsEBJEhWewYJSw7rGPiuXyM8YNSEvoJFDvwfBHRxJI7iJPt187felKhkkh5K1_h4wT-6KqaBMZKaWNFYdR5pkXDRqQyiKHKiHEM_vkIp-ur8vGowSHYv_XD-d1SAt9BQEiHzKr0Ph10FBVTSYeWY07-cWl8mAclL1kqU8CliXWnB487-I4M4mkltvCWOJMcPiETe7A9crPirijbVo0Qnr4GxGx-ksT7Sgte75cne6XHtVw11FrFlBuehuWJv_31WsvafVyrZ5ZPNw2fEOotG_-OGSYgWKN0NPxMbkJCiZ_kbTAgpm0P9iKL55ekhtnjvZ0KaRP2l3mtILwmgZaBnDxXT_xl2Oxv2QPX-ZVQL40K3WmgKE7a4JtwC5gzpClkweGcATh-pl-bJpNVlm_ofu_41ID_6gs-Ajb9tCzZBKc4xb-VqowYYCKBDL7Pug8OwihzdIC8QXYintRCgFkmhDzMuKFLG9yxcYtzLtQwPsB3JjxBn11AbR1Dqe8GBbcj-EffOF_VfBuXrQFT3FtO9TqmtsHDvFJAzzLXo_j2ffjzSNZrpgl8tghw3kj-PFW7h5UAjPe2DKiNtPXIk4dK79UDEELnxGZFyPMn0oBnyxsnMF1tqON9NxMD8-xXJHpeUFx8hQC8FhuIgl9QylKioZOYxakXTOg5mEIV51CPZT3cC9NXQgXDHo9rha-jKgPuAnQTHHEQ0CaoWxy4F9T-MbuL1PoYol5g3ZbGPe1pmAQvsusWmlgNh3HJJp0HaokLWTJCo_75JTCZDNlWIeCeZ3UBPe40JL555oq_12dPzQLD0q68p_g4AAwCPoT359wrZXL2EQOKjRnQT6fgalZurH1TJi6XxeosCRhLuClWmk_vWtMcoMdq9OBAfn2F_HPyVBwJ_TyQsvNxHS9HcvyVzowyy4BMIb9sxKOgAIPHzB3xFr81QTFFPdzNW2v6lCZloHcwaU-0JGOgf0krWrExMu9so8LGkggRdrJN-TRLjrDVJN8L0pNyW1bNhnig-XahQ-tp-ZP17r6z9f6ZpRfcIsHEKE9PPp007cqibV1fU9dx4xgTFkyQd0wFAr9OLefsacj1U-1Gr-_8CvzCmcuw6XlGdqvYo-GEQvGzaDd7aVj14jzYbp0OdAnzn9LQ_XiKymUJBvaPFLGD7Nqk8NTJstDSOnP3jlCZ_-64PdqGXSkLFj6jffGmJ7HoiQJjayKRjFLrbCi5NnGu3YZ064WteQ-gbhjsTkQUr0Z19AKVN0GVuDkMQMQDwN9KkITgPTNOSJ5aRdoy2cz9ut4sEx3PU-6RwwImGoDVKJ5_epXU7FF6-we6Q2SqFTl7p0Cwd0hlMWkIg4rWIDPPY1CoutTp6CcLAv2a8jxowh0GqO8gR6qpxvnOVp_MOXGTprKCC8-G1heJmFyDiYjBB4tlN3hbmtJV3XqtMTEFOrSGf9E1RKAYz3pVR4AHCR6tBIhiNGG8EmxavmlPQzdzN8DLPtYUS0IOhtyCsars_yzUOFBFK_cIbbU6DEDWJHLiTKgHv8dRLUYNImao5Nbbacoy80egDC-xDQpLChFGsaQrFP6XU-TMy5ZryWdcFs-SHy9HL2jVwPf0jXBjnxgusVQbwT1YkqOtzYLlatOCPtuLBuQoSdmYg2A-46T0B7_XgAVIMEKCRYxAzIT1wGFmLI-oPirkw4tnJb7Bxae3QVeM767W0BGcqWdTLM6x4S7miXwO7zbIRkHc3AaryTp83ymjOykSdrYztUQ1sSVmY9sd7niJXoxbRVJXYLJXW-9IX8kW0KHA1FGP29t2a8eF_VPBCnB0wfh99ScXIUaP-ruypK9dA-FfbuTDf4-UF3y2icsifH08Vz1F5XEFPAAYvRMQf4zha2DckNH7XMHUNnZVntY4PipoC7f2KMbmDi4-GAxAwKuWfedSn3vflSUESHjG&cid=CAASPeRoPBDAzdeOK-WJGPRhH9GLH1hMkoFD8Dm_lBSEcvKpMYFnzPqj8esKaZc7d0E9l6tTM4eUK7s6pMcnKlg

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1bbb1cf040948bea2829656ed20814d5ecabdeb106bff79cad43af8e6ed78161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:03:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 8953
x-xss-protection: 0
server: cafe
etag: 10862945726693812791
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:03:31 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/elements/html/ Frame B8A0 6 KB
3 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02a94215980e0a9b1534964bf8c1fe26b45710405f9e0c9ebfab99ee961bf84e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:03:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3398
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 2661
x-xss-protection: 0
server: cafe
etag: 15787534883320419827
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:03:02 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame B8A0 0
730 B 130ms
72ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssvZvN5cLC7K9ZthoMzMjcGJOAYO87S5nICRgeR1QUqxpWjCV0q_FPOkhzkxaZGEBrZl1ZcqUweNT7fTVfP6QZzvKRdkqdy9JHcJbiS1n265iFVPHux0z6wcdIcIJocY6UpyuqmK6rSLu9JfVjACel2CcI57WniUIv39BXXl1ScDk8JXZfBppYl0nohUiFgvfNNdWzr_OaG_JKX3Yl6qauEaHfITZMWYNmXVUzwyuYtMZiutaNTRycYSE0WO4yPsgQrVVCConbuI78O6noOVmDh37EcakJhe5ieOAZT2yffq7zYM8TJm_DHDcoy20u02_jGNmWcOpU3igYQQhmnXflQhAJijI84pfe8HDnzM64UB5c7sEi1Tjcva57c5qAhN4CQIFFXhbZcoNGtghwa-XxZpIzeLW8uiu1r7qQMJ7QSVRGPQZJ2eIl9A001GCVxBVLezYR0OuOkmjAPPNEf_qSaqMLdgnObERdPZYCVvJPJwAYEaEpGaGrCUQvWiF4xHeYvMyQ4WyQ3Hc2tOHo96-RAhGp6VaCaV1R3LKBaKDo3BZJRcakUZA9WbJCp7nosf619JIzJot4zgpkS_liayY7sxR3xTNCeEF3lEKvA0C9iv7Z9Wbg69hNGQxXKenPoQgO4NgkkA69CoiyHuv9uyyWrtyD1eS53skLq1biFfEXr31ZdlML7xCtf_FHEZWccgFF7l8L5kHLhXhSFz-ZF-u0hkT9JG95w6sD8jdZqXCwIPDwP3GMWg0BM-XmyGk0I7RJH6WnEES24XLeIZBtJGGQfMWogoSyFF8EupOwgnwsM2fHC9EvcXFrkPxEMsTZu4cePhPeL0MnnlrjT2NQcBaViX14azxwpSfdD8JahHRUBkLziaZyPmMx0QCPN5GniZiB0QXRbN_hvtEiU0LwIPjcXt8k8tlRcyxdGktkxXe9KraQ9l2p7a9rYdt4JBSV_VKkLKzTGJeuPBT0TNdwyek3cQjt3A6DLS70Re5_QhMdtUc6d5_ZCBvx6sdxiZKriF8QmeJVK6fnbtWIQjSAuIJwPhLY8bbFa4WuVk9b94Xd-BCkn2lspVQ3KbERF65lUksklmtG2uj0TmngbJ5ApUkwlKhyrVyPf4MKSsUjX_Br7YO1U5zw5MuziPSEc9reaaoao_L41PbuGMZVUotTlxqM&sai=AMfl-YSJjgI5K_6ykhfdoKWg_lzpCiDFefIeIULqotfhQGmkhfUnsieYdl_KxFFyy2TbVrd1V_-Kx4Lb92UbyCKAiW2L15DjVmY8boRxHsiFWYa4aoGOnBvBvCFv6npIPPQZwCNoT-b9rwfkXsobusLoGwnfXNqFGyy6TvOBqsvDAqDe355JGwbvbZLMeD45zrQGFt0sCnjAvGMO0HdHZXxRLpJR_GIG8xuFG9ARNsX1HQ&sig=Cg0ArKJSzC5ux6wcNbSXEAE&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210211.27432&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 16 Feb 2021 12:59:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame B8A0 41 KB
15 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 15 Feb 2021 14:48:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79854
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Feb 2022 14:48:46 GMT

GET
H2 200 02022021-093840506-YMK_1498_Lebara_Valentine_728x90_en.jpg
s0.2mdn.net/9738666/ Frame B8A0 59 KB
59 KB 29ms
7ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9738666/02022021-093840506-YMK_1498_Lebara_Valentine_728x90_en.jpg

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

860bf7d8c1eabff7f01fa644744a01d25f0f751157bc3570bcf165f53ccfc012

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 07:04:56 GMT
x-content-type-options: nosniff
last-modified: Tue, 02 Feb 2021 17:38:40 GMT
server: sffe
age: 21284
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60329
x-xss-protection: 0
expires: Wed, 17 Feb 2021 07:04:56 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 0908 111 KB
39 KB 25ms
5ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:00:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3529
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Feb 2021 12:00:51 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/elements/html/ Frame 0908 6 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DET_rWyi6cCGUVSUHZ_DDDz4G3rOMKtEdnum7W8gp61LcqUMwmciCJY-517QDeayw5UINTpvLWGn5G1ARcwwZetpWyqy9Q4fKz65O4zdfO8isWHDHVdU8tbYgGbs21JwkVuArK7o4oc6145R6Cx4A2ZoQBig&dbm_d=AKAmf-DH01CvoVITIyMEs7nAXIKNRgBaGHhOiHCecK_hDy6ktBQn2cFDxHycjceMZVMuoHqMznnw5pZx7ddQXkboLw5xYaDH5efTCe9JX1I54rK_A3MPi69zdS665vb28xDxbAstLIGsiPuZwaw8MTgDlvSAgEznvmGJ-RegbeJATbtjNO1TPokCKGgW4i_Iy_atNnKpgRaBDoaFu77sMgpD5RGd6i9vhyJGfbbgVCaVvU7X5ignCvnjlBaXewxPWZpErXJP5fj9e6oD-gnZPwpnU8XIcM6kSOe2mmCjuQQuJ0ZWxty4jD8NZXNFI9_2K7W8Z_NqYZuHOLqc-wleXHfvd9243UBuJv5vp-DL_7xoQYZ5p2tvt2Tnjar8KN0Xr9RZtpHU4jBiHF53RB7IX6QHQrT1D9eJxgmxo5iiPZ8jLjcjfKpgdR9U4O0hltA_4a18JxsIXHAuvDjMnqI4GJ7gSDlgG4rWC3-faTQyzzk9554p3BFN-0Rzj11xE0nA31xlUrZd7Lrl4NU040Bc6u21ADOJrSnzT6tRRY-9v0hEYtlbo7zVSqpeR6CtXMO7q_TNkWjERbl7zg7cjDhy_iTEPOPfAxIUOswcO4XYPnupgko8T2RjzNOTHr7kTAEu35NuwDhRdY3t9X20PN7dMF-wR3RravkLvMOyHDTKqVW8-SAloEIHMzh4NgJB6W8wQQQWm5zebS71kEJqCsvpQaMBRcvLrIH84-etzIfz5sRDivZM5OeLi1w2lbDBjLHAzmLP2udykRx0fLb8gOxiHleDI9MqJHeWZnjfGqU6dgLvWZNqJfJNoBPQWO37vAh_abKYCqkYmpnInJ1iRDOLGtBYsJaZjFe1bo0UfP2s6PObkDIdUXccdfdHTP87RSuFSsQUlc_m2GGYe29AnF81WTWFcUkrTAK8x5d4LE16JKWZl8m_TnlBCiykzEhWcR5DaqWpb0kK1CLPbE95yKlWsmk8V84Lgn9ztbgxUN85T9pFvV5yIK0-mClZfAQjG8_WuZTuRaifFJi16jFv2YX1xxw_dFYsl18a0KJpzTfmuxtZLBZD6Ghk3hR6qVjDkLg8iXgSDZohUucD0bl1MSW99uTXarmfwwypJzixloz8fwrSc1VJMAQyGDSDWWUu1ON6p_0u4QMRPltUW3ldPqd6TN1UsAg-kMHnZlLhviSRkrXICMiH95Jto0TqhsEMhLGP8_O12-75MaBZVHNNyyBBOfXFYJQQr3w8GG-ZM2s4ktYtfQ3dqlMMMGb37lm6x2hSKo-ErNeAkuFep4kXOPzkRAi6WOGMEMsiqW__GmmbWWW7onm_mKtIGsajfrlsw294SucBggLYpWqeuowZpZDGqg6wQIVWELmDSGPP9BWkSWsBK4xt1botne0KIok9WSlmCFzwGxTIwwapYB0kvsSmrVTEjskPUfVNqgY5lvE3X4CYL0LmS-a43VsxnOXVxYZ35YcwgWUF0ImjMS0JinnMHJDSwXjoQRy1f27rEvq6Zz4prrvkL3VOcZMMDw2Q4HJVG63YFtv7jZu0zTDemULZFsiPoIjqwn5yraYygG5Y062bTRERKkSrMrTK7jgSV9ytwKGRfVQMROXmOH-cxDBN9zpUJ4AJzJwoxE_VrQIkJ60QQClMw3we2c2LodQ_F-KHhpJcwmwU7s5nYYrvR_1tAF3t4Mk3YWBbD2fAeP_3GtPB6EHhEodJOG94OShij4HEv6F-SBwfOj2BtuP_1UoHXzCccoi7O2r4SEhhIEFvMHz6-CcrKPMQRuC705n_orXXQi3i0AdYGD3nViYU3h-rAuTKRnzaJAlObS52-n4y8aBtaCbF58LAnuBuFcQACnXLqC3C6tY_eOJYrC3-Vst_sXmabsv_cg36o3PWcivTw-4be2RRJ02bJn6RPIWfjxdNrnOsGr1c0a5Bwd-3XGjeN7psh459fSxy6b8NjWjFInE22HyOQ_CRFiOzT8TTSwu_QNd2oBYxFUKH31Qtd77adswA6s0FIK0S8XiG0M6AqYouk8OoyvuBzRlay_7UDFyNQjx3k1I_AOG040qQr5HBErUWKpO70IWaneOMGBeIrXLE00zZdPtNHqdv9cCOrXeZ9-vDPIWol0sxYC517VIfK8P4DqcvRFLb0GBe-HU78PprGFwgwSwsq9epVHA5Fcjx1hMzS-2JYgHjtEnxw14fZuas7KJhmMiW0SJmiokq2INYiX9q1nSflSyvHIIlKnt7tCp-PfIPc1J2LKf9_1l5UJzA9-APSsGxMKZU4TrALZHuc8utPo0T4PBaMpLkbF3V3aC9OYH67J7qdHHLij-rslIcaWIQuFcs3vIdZF33lhaiiIpkgfMQFH_HNCBItNXmmsGeCTeOaZG86Nfat8MAYGdhTNev2G_JATSYc3NfZAQluTbgBDGb2IUfNZtITcuWbzPUf9cS4rW2PKqRP_SDay3_pDXvp-wZvM--iNnNFRmBFYZP2BEfrkAUmcz9e1oPZ_-gFrVSaAWWBRPjgPtCZwOolFeqQWNp8Az6fEI8dDd2iOnrzssrIXfU51r4cpAKpcrhoMZEMznF_aJxUVeQL27uEaxRsHL2BrLH2x4VZaws8-QrYvaC2DdvFay2KHaHV5RJ8MGCbtkP8KKFIiwPIawZhT1IeEkS9Tr0DEnodUI_2BYFhb_HGbe8WUDoApN7spuHYUDcCDiA4cmGDSGB6HuKe37PR_0ZAjqMmV-hZ3IK-Zswvj-sUhqRpu2W5067qH7pcDWMw0amKOmk4s0uldNvxcPfgWPllxyXSHb9QKeeqNWr1Qi8j2Q2D-YO8M8bM0mkDdwPAiVX40H1H0QfzfPGbo3B8TGlNAQULrLEXq4Zi1iVIsBDQf57SzuTUvZ01Tj7e7NS6MVEkXzyDizGm4kuC3eEv-dUPQKqqNFhCsHTDdokXbqEDJb7u9HQowaNFCLh9wktpBCjRLbUzmaOQE3Zck1w0JOq43K6oKxO8OpLMcOS8l8AqL9mfBfD00JqArBu4UhHKJ4A5xdob77kGYImCs71c4rhoA7dERF83PR2ai3fX0Rvw06wSly5Lr-sspTRV2tGZKXp&cid=CAASPeRoAVVrI5sl7W8DY5Ssx0t2WLklmcx72f3JuejNCo_1H9C5uMRcIvuxOpB1Pj9QICS7cIPcCdZNXeIJQIo

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02a94215980e0a9b1534964bf8c1fe26b45710405f9e0c9ebfab99ee961bf84e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:03:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3398
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 2661
x-xss-protection: 0
server: cafe
etag: 15787534883320419827
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:03:02 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/ Frame 0908 23 KB
9 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/abg_lite.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1bbb1cf040948bea2829656ed20814d5ecabdeb106bff79cad43af8e6ed78161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:03:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 8953
x-xss-protection: 0
server: cafe
etag: 10862945726693812791
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:03:31 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/ Frame F181 23 KB
9 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210211/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B2BfqYB-oSZQvOP6gawV_OZNFQ08azkgXeufwcsvAssTnZScOnBki_oPZd2HTcfGNVFCojaumlMFbxuvlrwD5sIg6j48Un9AiXu67zRHKGTHr-YrZ9S9J0hx6XIqSGJXZyhrX9ctd6UT9_4sIRkLm2fQYczA&cry=1&dbm_d=AKAmf-Bvc1_n-Z5zrbDyQaJYcI_AJi6k-qK1QN_MmY4tdztAol2T1NTpHAsSSuZ8Vf4OI6v0hRI-SLge_iyeWB-5NdZ9Iyz7AMkvpFOl2_kDeWOy0tcLT5uwjSQfOji70RmmSy-ASt-YylJXkn1BU_TBNPYrVu_ei010v2vl-4dNjyq6pSXfNbQIkszPXyxQcyNP8L63OC4X8OrTCajYmijm3lTW6YKUSvJM_b6ZMFqAJPMRR9jqd9D4nOOye2VclFuimeJYZ4P7crwen3MEpVosBzaKb58k0ELf7RC9g9N_A9jZh3tRVZULEJjkXeYi736_90iFwSh-Wi75l4Qe_tPCYEsXZY9Garm6Se2yC3g7Z1xCOC7AsWisYg8W_moZQBl9j-IwTL3x_NtDgTgt15HW6FxijDx0Cx9HlHUxhsdVU7FBASfHdqDfVWPzlhdLiYqInWgMlqCQ--835BA-WoLb3FBEp8jCY6JrIaY7yAOXv65Yu21OXDkJMMfdMzHWnfH6GgqvdMdVxhjBn9DyLpDgeX4K8bheEYqWtvIQ3IsPb3ad1zZ4OV2t4ii2gSPmrLdld9IqskIHXbyRtlU2LD0XjED7s1sQPFMe7EEDoJvfgRd11xzDol2r5cV59p7FF-_vvm9uBg0SsZYDBPS7WNURq_olOYOBdkjt3jSbtn7V4ExN5-qTRJag48mnjRS_s9K8fatLNrPYbrdkT_KIo7U3JywkDOfAroAzB-UrdDa9ljA_FoNzwf4ZGAdcAjBecE2Lq0PhQNJXqV6ePreEZ7aFThJhLLJUglsJ1CD3UfKtEGZOGB3xkyGRihJvt7WpwBE10Vi4seEKrWkveZVmHSYMHg7S-T6ObIUIQue9gQdSO5tVIUWOFK_XG2oN-1e9UaVH6glnvjjkVyBm6a7wTWNEXC0T-8zq9S1g5f8-XvjDktCQgXohTCHofUxE11UgHQo79rR613PrIPdkddW0G42RomuRWZVkUuRvUtjBZmPpakpZoyrRPESHwDfQxcmJlRkM8ghpPq6umlcvrxbOVaOndZ-Fyf_Sa5QdOJpk1WdpBGZSeHUq-_-v4Nu6e7nP95d2CoV2yZ2MPmgewd_Pb7H8C2wKjeYp6m9bU1AhW31w2BN5tOpub_ku3HP2H4XLnE3ss9T-wrb7VUgJyWS4DA_Aiq-PbD9MSzAb9Ah6fsqV4g0qAu0Ho6bOrcDkdQPGdPKgNM4zt0Po8mZO9hmJ8m-tDJN9vxo6FydNbdBrflvSiuiZnwveH0V1MEIclmXbN3lB3Lhug3UGIk54NZ6-fqIH38pkStvpHPae5FNpioWnRJuAeUwmzqytn7gpTEqJKIfBepIkn-Bl6FZL3MB-0EEsXhTib34TokAeneeh5KlVsU0Sdmqs_xRCiDaQe202wxcxeHXpC3T-DtACu9ADXrZZBEUMkZaDrn_7La38CMsTghvrl-6HnRrPC71iDT__PliQQAkYfQDlQHA3g-WiHYh6CdcBMbHvZFaKljmQl3VsdG3o4ymOC-xUzuTe4sGAQMlqwgnCBYID0fljUhGTY70PphBdc9L3U1gs-gbZfaIkw_by7_txWTzRZXQV72TmdsmSpxH8M9-dJYlbxglA93-cnSNq-mR2RBgXzfRIBDZAR-kiRJVuCUQD4iR7syxBD9EfJ5_Acx4qHaEvyp7X7cpX3CY90Avw12Of6H_LhkCp-SWbpGbaupqywrKF3pnOa1so0ldfVNcTi4n1a-uyFx3jHnnQ8PdddYyPYCM7sbkD6NxPcVPoIcas__JEF3HSlSG9-C99ZH1lW7KBCxcGobMahCotcYza1f4huOh0fwUqDPCMEL2JNIweUE15NlL-d4gcd-HGZIqArkiG-K8kv0R1z33AtnYa4a4sKSKDdEPWbK-5gAMd4ivKqf71J7XXppmzotU8_s8rYk1OjjgAFi5WtNMzC50tpvdsTwxWXudPOnAn0owe062NYOZIUPPL0J1VcfForSeaZw5HS29st66xIwYJOoNJ5TXCv0_BNriA_K30cdc-_ovV8k2e3eHyjJTEw19JLlZrYZ5_VJ0_i_ywuBq__WffU5iUruJ8vpbNNwGwOQ6OZH3inGQlcQvrXNoIaIe4-y2u1jilvz-SqIq15hXyqPq-fIfRJky-nHWDv5NHsP8lMZpHnt_RzhTs_B08A0TCmU6PzBhEemF9-ALI7QFnoS77U0g-ajnHLWjq_emK3SZgduz26Z8HYrGcB0OO9oJKiGfAVL-yPoZTOdjkBcIiae3U20yQM7IupGiAOja_MKBbTuLtJDMs_ngasQEr3VmSZ_VKlE0QHO5Kc3G8wNqza9mAAqm5EiVl0ksY1qNZU2G9u9H0noI25CtrNSharFxfJXbFeQ9l4VAxmI6YWwRomVW6QPseynhiZ8k-dOUTjCoLPoVBkVjGh2SQydpBQ1Lt9VDmn3GZduiBC0BkylKLdcniyu3vKUGCHxUZqxo8hwIDlZYmJVk8r-tAC8ddd23wzkXwhhaWgL-4usLFDjr8QiaKSpFQwhhpos4Q2C4Crp1O-iRpS8GrC6MIm2FR1OnzLwQ39Vwui56vo6Epy3qPkxZSnB2hGmFkJFRZF-JbeyjPp2o0tIgyK8PDSWUQTS5tVJ4mpF59X_Ga-XO8OaCbNEpf0gJs-VbWeMSLJRw6DL77Ryn2Em8PvaAs4BJdnsOXb2lZ3vXFNTs1dSXOS8uCSqCnUXpIooY7abZpZjZ6UjoaDtf_QIjuU9lu84Ps7_PL9wUqI0IQEpaeyzoP-nE9JsbsHNNInmJKsV2AzG18VUM3Klk7ioCN8cdrItG_PGk_MPh0vhdFDeBA6NdgDgiMr4f75sv9tXamEZzZo0YpuhvgD9zJmtGCNeL5xCAuxsx-14_4R7T9GV85bqcDjjNFEdDnVc_XzffFtYds7jSifOs3keNDjwkBGYutou3SMGDJNk48qj35un5yksQ9jypilVQuMnTC7yAqqiMCRQVfwEBI_C7avvAWy4vRLSQ_dpdGO44ojcO0qnj85hzvfqb7dX6ITCVslUWzGBrI0RRo56Y0ah76lLAag9-IU7XW4b1Kh8F2MCRpGS83BMcX7xyQ1332uayGX1e1DBcmPMXhxVqVZIVDNR1_4HO1MZMbNV9OpWa60ImL0rtGv33sihNpI9FpRzo1Ur2s_0n8owV1wT86WHw&cid=CAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1bbb1cf040948bea2829656ed20814d5ecabdeb106bff79cad43af8e6ed78161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:03:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 8953
x-xss-protection: 0
server: cafe
etag: 10862945726693812791
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 02 Mar 2021 12:03:31 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F181 41 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 15 Feb 2021 14:48:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79854
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Feb 2022 14:48:46 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 52CF 12 KB
5 KB 11ms
8ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/221/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://prnt.sc/zlspa2
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://prnt.sc/zlspa2

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4984
date: Tue, 16 Feb 2021 11:16:02 GMT
expires: Wed, 16 Feb 2022 11:16:02 GMT
last-modified: Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 6218
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 1BCD 170 B
752 B 93ms
34ms Image
image/png 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1BCD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

43 B
894 B

2011ms
92ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 16 Feb 2021 12:59:42 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1BCD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YCvBuzy3R9Sgbt5kLOm27AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

43 B
894 B

280ms
276ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNOuLBDq08sCGPTG-JsBMAE&v=APEucNXcZVnEfJVC4aznWmPospjNPR5oG3KdeOrZV2jxSbZRkQTNtYSBmBiiMoRATnZ_u0HrL5rwOj59w7UklAamvEkoFG86LH44uVj-aeqhishwby6MyiMHaXafmj5nPoiofLWnYYe5fJo_pGDyuKZYQOimyf03GdsmLwJ9xOkaolS88vqYnAIo5zv-byFgAQbP8ULOHbUZ5Ur5KuauhCS6Xxf_dhPiYg
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:43 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 16 Feb 2021 12:59:43 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame E9FD 170 B
232 B 92ms
37ms Image
image/png 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame E9FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

43 B
894 B

2102ms
90ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 16 Feb 2021 12:59:42 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame E9FD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YCvBuzy3R9Sgbt5kLOm27AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

43 B
894 B

236ms
142ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMDEjwIQuMCtAhi6y49pMAE&v=APEucNXFbsM844gXsohNCXkM5gC-eLHNOtcAzyBkHcPWQOkNihClJn_UoIz6keny4mb39Fn3MRz9s1n9DWIw8E_qKlf3Y0qWwBFYacZxYnfvzjF4pUcaQfeOYecVVsoSzSR9paCnahepgz9cZdWR1g419D9lpPBNlIm0Yllo9WOjW3CNMyQR2_IYdmPGPjwlBo1SCo67rs8gniHP58EZFj1I7e8itduWFA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 16 Feb 2021 12:59:42 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame D824 170 B
232 B 92ms
38ms Image
image/png 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D824
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

43 B
894 B

2103ms
91ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 16 Feb 2021 12:59:42 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame D824
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YCvBuzy3R9Sgbt5kLOm27AAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1

43 B
894 B

73ms
72ms

Image
image/gif

23.218.208.246
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.218.208.246 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-218-208-246.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYzNKYVzAB&v=APEucNWG3VF-XVN7ejFWpF-UC8FcP7TANgaiwnFIhzHJcK8zjWMzT7J35AJ_mb39zDvNbBdV_Um5Mg_oRq4nRFSos_59qr7eiEtBpAU5DrUukX1k5U388kODgX3Zaz97BoUV-yYket7IMH9DBd0ftVHfYvg3Rg8rtcXIjqc5WmgAV-Mg0VzVqeMrBPjvcB8fXfbzfK2uaBoIhdDbvQlVpdZSkc04bPw_EQ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 16 Feb 2021 12:59:42 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEG6jMfosscGY5R96wqM0k&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0908 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 15 Feb 2021 14:48:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79854
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Feb 2022 14:48:46 GMT

GET
DATA 200
OK truncated
/ Frame 0908 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b988d49a234d18d17e9dee608a6d8638b4574345a2f82ecc5b11921cc41bba1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A4F4 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Feb 2021 14:48:46 GMT
expires: Tue, 15 Feb 2022 14:48:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 79854
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame B8A0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0c62a0d783682a2f99b7fe3eae0bdcedaf8f5cb9de99013074509974747ef9e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame B8A0 0
32 B 43ms
42ms Other
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 16 Feb 2021 12:59:40 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1EE8 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Feb 2021 14:48:46 GMT
expires: Tue, 15 Feb 2022 14:48:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 79854
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK fmcs5wnh4tfi Show response
hal9000.redintelligence.net/zone/ Frame F181 11 KB
4 KB 107ms
36ms Script
text/html 138.201.84.253
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/fmcs5wnh4tfi?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D
Requested by: Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.253 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.253.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d4e89f3e12c2411ce38b4f8a27044caeba00ebe4be361559f4b32798aa26c42e

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 16 Feb 2021 12:59:40 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3908
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B2F1 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Feb 2021 14:48:46 GMT
expires: Tue, 15 Feb 2022 14:48:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 79854
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 index.html Show response
s0.2mdn.net/9492030/1584717169061/ Frame 7A70 5 KB
2 KB 35ms
20ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9492030/1584717169061/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4092ea8b44ebec21d9e7ddfdb319a3a53403092a5b7c29395ddc1448b2c24c04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9492030/1584717169061/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1880
date: Mon, 15 Feb 2021 13:49:48 GMT
expires: Tue, 16 Feb 2021 13:49:48 GMT
last-modified: Fri, 20 Mar 2020 15:12:49 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 83392
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0908 0
69 B 50ms
49ms Other
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvmDFtiQBm9Slnp6c8FGVWJBg4e_meJ8u74ab9-Knd9zqgrBk-15TNtklc3ZIImKWPbECbEsoGS448b0LaoJDKTGgkhEFzB7vzVQGfDO-InW7gTRCfsv3sLn7fN9KEEOttJlNkh7N2lGVQuk3hn0xWXydhA7-pzpVqf7-oUCVN3WaLO13vy1Z8-xMRHmt4AVewb69glJVmF9jcynnwIswbAzLXSC5PdQXMP6ifCCGsUMd70D7pKuSV5_yt7wy5Q0XjnL2cCpiuteBjAVQk80T7Xg-h5j9m6Gr2ZhBvu3-h-v9hGeQl3_aPYK2tAUV3c8RQczP2l9ckDaVLycDd4hQOrjyyEXEnJdaxgGmVTJYB4-MMPhxw4VyrzXK92DpOWrfbKcbZcF8T0zxQD6APUyRRdoETBwbXCM_JdndJy7hxxOxOYleJ3ZfpnbqKw5Zgh4pvnZBmrCUeKkrf15Kd2d8v_8tTl69Ms6Yt2HL2eXO7eQp6uDAuzMw1UHa_0E6ZiwlHcHDFZubxJcShoXuFSwNvNz9sDviOTq9RibG04zbYsT2e-zYXEBAdPb5TStNP1W_kASOBaePKnwkmdi16JoO8Nb0pWppS9YMpj0hk018lvX43Lbbg5hcieaK7v8FKr4rKqeFw4_2BFZvkUYJcA1FGixd2oeg80HZU6RaohyzIvf8ehbtTQMmrxTSjQZc5SLiJBwS09pN09joc0JHrWA7BAI0nXFLdFp1NE71eegYXDMArDPmphlFs6mY4pevH73qSocys1A62HOxVqPcff6fmCb260pIXPVl3YADQwlxc-pDaFmvyx224Cp6vZqPttddAE8ckfMcNgdt5bsjMajHFrY7HGLq2ZSvAZdq0ELuDbKeiAIe5h3HXF__v6Dha7g5Sw2XkEX6AVoRVj3s64QdjvruQOLBW4CSkLvrpwJE5m7aKikGe-33rp8eGvik3wdRQFMfwJkw2oR8Gr3Kyf6SFJmqccoYXGrQklwZjMzd53TyvLDxI5PmUrWH1ZWod7emyx0sb3XmpvShoN2X2FZgPRyK85dO5DfDSAgbUar9favjPgUe9JBC4VmqG06M-OX4HKZyEn0gviuqfHqLYj9B54HXgUgjh8hAuqu5k0RAXAy_IFuSPF-YYgiDOyie00eV0phK5CVgkFIcnf840t-r3sPWOeO_lfA4Zpxw&sai=AMfl-YQR6hWBkzNPFXvjpowVaAZBsYjbCdpZoaY_IXfpeNRkUtNlV4ODk2kX2j9ciVKzGExjEB9eeukK2Xa5Ml8zhS2HeBNTR08OUhtsvExdV2DH6lAEBj3tIkAwIpc7ecey-RT3FU4i7G4_VOS4Qthh8ifIzDnr_h-K_c1byL0ep4e5hpAEWgmHBB9ecagqRQgUbuDvVq2BQghc8MlKaARWoZ2CShB2fz0Jjn-PJvSeOQ&sig=Cg0ArKJSzBSy9B68MJPAEAE&urlfix=1&omid=0&rm=1&ctpt=220&cbvp=1&cstd=216&cisv=r20210211.95372&adurl=

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 16 Feb 2021 12:59:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 Ss-Dm7K1R8Y8ZBbOoHstP-uzJpKZal01rHChStaWcmU.js Show response
pagead2.googlesyndication.com/bg/ Frame A4F4 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ss-Dm7K1R8Y8ZBbOoHstP-uzJpKZal01rHChStaWcmU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4acf839bb2b547c63c6416cea07b2d3febb32692996a5d35ac70a14ad6967265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 13:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 03 Feb 2021 00:15:00 GMT
server: sffe
age: 343542
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6290
x-xss-protection: 0
expires: Sat, 12 Feb 2022 13:33:58 GMT

GET
H3-Q050 200 KMBS0uYb27SoXpRfeqhVXCVI9MZcOZ5lTWsq5C5IQSA.js Show response
pagead2.googlesyndication.com/bg/ Frame 52CF 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/KMBS0uYb27SoXpRfeqhVXCVI9MZcOZ5lTWsq5C5IQSA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28c052d2e61bdbb4a85e945f7aa8555c2548f4c65c399e654d6b2ae42e484120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 14 Feb 2021 02:51:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 09 Feb 2021 09:15:00 GMT
server: sffe
age: 209262
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6236
x-xss-protection: 0
expires: Mon, 14 Feb 2022 02:51:58 GMT

GET
H3-Q050 200 Ss-Dm7K1R8Y8ZBbOoHstP-uzJpKZal01rHChStaWcmU.js Show response
pagead2.googlesyndication.com/bg/ Frame 1EE8 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ss-Dm7K1R8Y8ZBbOoHstP-uzJpKZal01rHChStaWcmU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4acf839bb2b547c63c6416cea07b2d3febb32692996a5d35ac70a14ad6967265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 13:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 03 Feb 2021 00:15:00 GMT
server: sffe
age: 343542
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6290
x-xss-protection: 0
expires: Sat, 12 Feb 2022 13:33:58 GMT

GET
H3-Q050 200 Ss-Dm7K1R8Y8ZBbOoHstP-uzJpKZal01rHChStaWcmU.js Show response
pagead2.googlesyndication.com/bg/ Frame B2F1 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Ss-Dm7K1R8Y8ZBbOoHstP-uzJpKZal01rHChStaWcmU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4acf839bb2b547c63c6416cea07b2d3febb32692996a5d35ac70a14ad6967265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 13:33:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 03 Feb 2021 00:15:00 GMT
server: sffe
age: 343542
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6290
x-xss-protection: 0
expires: Sat, 12 Feb 2022 13:33:58 GMT

GET
H3-Q050 200 createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7A70 186 KB
48 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9492030/1584717169061/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9492030/1584717169061/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49100
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Feb 2021 12:59:40 GMT

GET
H3-Q050 200 vF728x90_Swisscard_Cashback-Planung_en_S4.js Show response
s0.2mdn.net/9492030/1584717169061/ Frame 7A70 28 KB
18 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9492030/1584717169061/vF728x90_Swisscard_Cashback-Planung_en_S4.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9492030/1584717169061/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

789efdc8b850e58bd1ca2b2513465163a194ab986b97a027ad5997e741bddd22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9492030/1584717169061/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 15 Feb 2021 13:00:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86362
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18233
x-xss-protection: 0
last-modified: Fri, 20 Mar 2020 15:12:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 16 Feb 2021 13:00:18 GMT

GET
H/1.1

200
OK

request.php Show response
hal900022.redintelligence.net/ Frame F181
Redirect Chain

https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
1 KB

168ms
100ms

Script
application/x-javascript

144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x18&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D&documentReferer=https%3A%2F%2Fprnt.sc%2Fzlspa2&ancestorOrigins=https%3A%2F%2Fprnt.sc&random=1420699143299&isIframe=1&container=&adPos=0x14&adPosCheck=1x15&adtagId=0&uidRedirect=1
Requested by: Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.53.104.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 3e648c4cf667ee35d239450647613d274c350a153190d1c48a479dd7f67f7017

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:41 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 74913800125699900710156011507022
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 806
Expires: Tue, 16 Feb 2021 12:59:41 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 16 Feb 2021 12:59:41 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x18&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D&documentReferer=https%3A%2F%2Fprnt.sc%2Fzlspa2&ancestorOrigins=https%3A%2F%2Fprnt.sc&random=1420699143299&isIframe=1&container=&adPos=0x14&adPosCheck=1x15&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Tue, 16 Feb 2021 12:59:41 +0100

GET
H3-Q050 200 karte_blau.png
s0.2mdn.net/9492030/1584717169061/ Frame 7A70 20 KB
20 KB 7ms
7ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9492030/1584717169061/karte_blau.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9492030/1584717169061/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2789568a4a66c78d3bf4dbc2bec66efe724510caa80e0c1b0ddd7d8e20012380

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9492030/1584717169061/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 08:10:57 GMT
x-content-type-options: nosniff
last-modified: Fri, 20 Mar 2020 15:12:49 GMT
server: sffe
age: 17324
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20155
x-xss-protection: 0
expires: Wed, 17 Feb 2021 08:10:57 GMT

GET
H3-Q050 200 karte_rot.png
s0.2mdn.net/9492030/1584717169061/ Frame 7A70 25 KB
25 KB 7ms
7ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9492030/1584717169061/karte_rot.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9492030/1584717169061/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4b7444def1ea1f636a286e3ad738f62a66953528c150922aab893f1a4c3306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9492030/1584717169061/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 02:00:51 GMT
x-content-type-options: nosniff
last-modified: Fri, 20 Mar 2020 15:12:49 GMT
server: sffe
age: 39530
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25382
x-xss-protection: 0
expires: Wed, 17 Feb 2021 02:00:51 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0908 0
221 B 43ms
43ms Other
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: prnt.sc
URL: https://prnt.sc/zlspa2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK Cookie set cshow.php Show response
www.awin1.com/ Frame 64EA 43 B
704 B 123ms
47ms Document
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.awin1.com/cshow.php?s=2347560&v=14114&q=358322&r=414915&pref1=74913800125699900710156011507022&pv=1

Requested by

Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x18&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D&documentReferer=https%3A%2F%2Fprnt.sc%2Fzlspa2&ancestorOrigins=https%3A%2F%2Fprnt.sc&random=1420699143299&isIframe=1&container=&adPos=0x14&adPosCheck=1x15&adtagId=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-148-9.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Host: www.awin1.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Content-Type: image/gif
Expires: 0
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Pragma: no-cache
Content-Length: 43
Date: Tue, 16 Feb 2021 12:59:41 GMT
Connection: keep-alive
Set-Cookie: awpv14114=414915|1613480381|d55c5ab0-7056-11eb-ac76-692d062bb2ef;domain=.awin1.com;path=/;expires=Thursday, 18-Mar-2021 12:59:41 UTC;Secure;SameSite=None AWSESS=358322:2347560;domain=.awin1.com;path=/;Secure;SameSite=None
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
H/1.1 200
OK request_content.php Show response
hal900022.redintelligence.net/ Frame B77E 6 KB
2 KB 103ms
34ms Document
text/html 144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
Requested by: Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request.php?zone=fmcs5wnh4tfi&nw=20&renderingType=javascript&namespace=bf9c2ce9ef&subid=&uid=fbfdb74f28ab5ba5&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x18&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYARMu8ErYJyxOreRx_APkLOhwAbktKqDV936iOmiCfAuEAEgopmhHGD1lc6B4ATIAQmpAoRCutjwY7Q-qAMBqgS9AU_QhEor4-lPc2kBZytjzq1DptNlUnkJ9v9qbW3Be-sBPY3n11QbS1i_JyhIfAgRFucV9s9Sm57ppomZpw5GgZ621YNkQj7M41GNI7bDLyy_kPmNvGcWMrAGe3tHLPOThZncYoZJUWmolfiXuWxa0ZuxnwI-lMkKBj6LfpzCcM_lQpmFGbLdZzOHtegFTbetODkUmMYrxF-HnrkYpV0LmK6HoFrMtMsvnyv8PrAHqJuvNdi1vcSi8srERdA8McAE5ZTf0c4B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi02NjUwMDE2MjEyNDgwOTkxgAoDmAsByAsBgAwBsBOFwLUK0BMA2BMDiBQB2BQB%26ae%3D1%26num%3D1%26cid%3DCAASPeRoI2VD2Dd1Ib8mhcwdbJKruPwwznjnbaHt0Ic9d7FUIx93ja9p6lggfpNvlt_6G0NdXKEKFUaeEofj7HY%26sig%3DAOD64_2zL3BbqlUqz4F8Jq50LvHebvwTrA%26client%3Dca-pub-1232265399417302%26dbm_c%3DAKAmf-BKeiezQ0WBSNMjKi07y9aVC6tetomprgJrSHNLQcq6FDjD6YXQb1BobIhO3-etITvQfn9isTh7jc_fqiQNOE9EHBwz9pytuGzrkQyxVeDVKGWPL537BUgcQTs46X5avSNDdu91ZrNGh0MWg8VsSFmq6_N-Lw%26cry%3D1%26dbm_d%3DAKAmf-DAjEur7td7VivDZlDpMUq2rzUP6GV2V5iEpIOl9PFct7vqZP8Jh2Bzx7MXzmgx4nN_Lw_MiFZJEUyWh4fPJVBO23OauRlLHqvSxz6OkkjdZPlmSjLua9UPGFZLhw0j0XfJmJ-HABH7f9DPbaMTesaoUZILt3wf3U3Aa5BX0TpQCJN2LCTUdVK9epyUg36lJFjtuYZdE75YJD1k4zwp4TnEB38EPchScvYKEcF6L0r6J79pE0dfmn5CBT4S8vaL8V9s5vq7EfU8DY9PRzA3w2On2JWSwBobR8BEK3KqrNrk057cyPBDR2sDgHcPTWFlZ6Y-YveGllSBcJJXZSf6Rq0uOkagy9zVGreWNHGBX6xDayE_puFSWidxprdhT6kYjXWqiMZhx7bMj9rO8yE5x9eCIMYw_q9ZMoQaI15Wagb0kS8NUSoDOIS4oTU2fKteFq-jAt6Y%26adurl%3D&documentReferer=https%3A%2F%2Fprnt.sc%2Fzlspa2&ancestorOrigins=https%3A%2F%2Fprnt.sc&random=1420699143299&isIframe=1&container=&adPos=0x14&adPosCheck=1x15&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.53.104.76.144.clients.your-server.de
Software: Apache /
Resource Hash: ae6a21608504cdf29fa2255c023ae3493b4f0da242daf58fbb32ebc6f6f23b25

Request headers

Host: hal900022.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: 8lcfmzhxc8d6_uid=7ad46f9af630dfa6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Response headers

Date: Tue, 16 Feb 2021 12:59:41 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Tue, 16 Feb 2021 12:59:41 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1860
Connection: close
Content-Type: text/html; charset=utf-8

GET
H2

200

spacer.gif
cct.connects.ch/images/ Frame F181
Redirect Chain

https://cct.connects.ch/tpv.php?t=116827V1869151989B&subid=74913800125699900710156011507022
https://cct.connects.ch/images/spacer.gif

43 B
221 B

39ms
39ms

Image
image/gif

84.200.5.215
ACCELERATED-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cct.connects.ch/images/spacer.gif

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

84.200.5.215 , Germany, ASN31400 (ACCELERATED-IT, DE),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
last-modified: Wed, 21 Nov 2018 09:35:57 GMT
server: nginx
etag: "5bf526fd-2b"
content-type: image/gif
accept-ranges: bytes
content-length: 43
x-xss-protection: 1; mode=block

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: images/spacer.gif
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

spacer.gif
cct.connects.ch/images/ Frame F181
Redirect Chain

https://cct.connects.ch/tpv.php?t=116827V1410150335B&subid=74913800125699900710156011507022
https://cct.connects.ch/images/spacer.gif

43 B
221 B

47ms
47ms

Image
image/gif

84.200.5.215
ACCELERATED-IT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cct.connects.ch/images/spacer.gif

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

84.200.5.215 , Germany, ASN31400 (ACCELERATED-IT, DE),

Reverse DNS

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
last-modified: Wed, 21 Nov 2018 09:35:57 GMT
server: nginx
etag: "5bf526fd-2b"
content-type: image/gif
accept-ranges: bytes
content-length: 43
x-xss-protection: 1; mode=block

Redirect headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: nginx
content-type: text/html; charset=UTF-8
location: images/spacer.gif
cache-control: no-store, no-cache, must-revalidate
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
DATA 200
OK truncated
/ Frame F181 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e85f782330da3806ea498687ef4e972c92def08e53d20dab8969bcecb146bb7

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 worker.nude.js Show response
st.prntscr.com/2021/02/09/0221/js/ 3 KB
1 KB 43ms
42ms XHR
application/javascript 104.23.139.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://st.prntscr.com/2021/02/09/0221/js/worker.nude.js
Requested by: Host: st.prntscr.com
URL: https://st.prntscr.com/2021/02/09/0221/js/script.mix.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.23.139.12 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:41 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Feb 2021 02:22:05 GMT
server: cloudflare
age: 1493
etag: W/"6021f1cd-ad9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: https://prnt.sc
cache-control: max-age=1800
cf-ray: 622772803ba4cc4e-ZRH
cf-request-id: 084c85e4240000cc4e6ba09000000001
expires: Tue, 16 Feb 2021 12:49:16 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame B77E 4 KB
760 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0e203332bdb8a0c387ae96935481aee57996419bc60598b9162b841d7bbd9ac0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 12:23:12 GMT
server: ESF
date: Tue, 16 Feb 2021 12:59:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 Feb 2021 12:59:41 GMT

GET
H2

200

120x60px_Linsenkontakt_a.png
www.linsenkontakt.ch/banner/ Frame B77E
Redirect Chain

https://www.awin1.com/cshow.php?s=2347560&v=14114&q=358322&r=414915&pref1=74913800125699900710156011507022&pv=0
https://www.linsenkontakt.ch/banner/120x60px_Linsenkontakt_a.png

73 KB
60 KB

57ms
15ms

Image
image/png

2a00:d70:0:b:2002:0:d91a:365b
HOSTPOINT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.linsenkontakt.ch/banner/120x60px_Linsenkontakt_a.png
Requested by: Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:d70:0:b:2002:0:d91a:365b , Switzerland, ASN29097 (HOSTPOINT-AS, CH),
Reverse DNS
Software: Apache /
Resource Hash: 7e473ad8e516170972fbe5c4760bf81cfcae18b065d87651ac534509daf29824

Request headers

Referer: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:41 GMT
content-encoding: gzip
last-modified: Mon, 15 Jan 2018 10:58:54 GMT
server: Apache
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=2592000, public, must-revalidate
accept-ranges: bytes
expires: Thu, 18 Mar 2021 12:59:41 GMT

Redirect headers

Date: Tue, 16 Feb 2021 12:59:41 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://www.linsenkontakt.ch/banner/120x60px_Linsenkontakt_a.png
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
H2

200

CHUNKY_120x60.jpg
www.adtracker.ch/upload/modissa/chunky/ Frame B77E
Redirect Chain

https://cct.connects.ch/tb.php?t=116827V1869151989B&subid=74913800125699900710156011507022
https://www.adtracker.ch/upload/modissa/chunky/CHUNKY_120x60.jpg

10 KB
10 KB

88ms
19ms

Image
image/jpeg

5.148.168.135
NINE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adtracker.ch/upload/modissa/chunky/CHUNKY_120x60.jpg
Requested by: Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.148.168.135 Zurich, Switzerland, ASN29691 (NINE, CH),
Reverse DNS: adresult08.nine.ch
Software: Apache /
Resource Hash: 6c15543164017966f4b8c08377fc6612665682030fd83a4696bc6640daa9cd16

Request headers

Referer: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:41 GMT
last-modified: Tue, 26 Jan 2021 10:54:16 GMT
server: Apache
accept-ranges: bytes
etag: "295e-5b9cb79ca4708"
content-length: 10590
content-type: image/jpeg

Redirect headers

location: https://www.adtracker.ch/upload/modissa/chunky/CHUNKY_120x60.jpg
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: nginx
accept-ranges: bytes
x-xss-protection: 1; mode=block
content-type: image/gif

GET
H2

200

pied120x60.jpg
www.adtracker.ch/upload/Zizzz/Bilder/ Frame B77E
Redirect Chain

https://cct.connects.ch/tb.php?t=116827V1410150335B&subid=74913800125699900710156011507022
https://www.adtracker.ch/upload/Zizzz/Bilder/pied120x60.jpg

37 KB
38 KB

57ms
19ms

Image
image/jpeg

5.148.168.135
NINE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adtracker.ch/upload/Zizzz/Bilder/pied120x60.jpg
Requested by: Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.148.168.135 Zurich, Switzerland, ASN29691 (NINE, CH),
Reverse DNS: adresult08.nine.ch
Software: Apache /
Resource Hash: 2bcf26566211c926eec5d81ca2fd779f373a765c0a1555f6e05fdc6d783b9efe

Request headers

Referer: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 12:59:41 GMT
last-modified: Fri, 27 Sep 2019 13:57:59 GMT
server: Apache
accept-ranges: bytes
etag: "949c-5938946199073"
content-length: 38044
content-type: image/jpeg

Redirect headers

location: https://www.adtracker.ch/upload/Zizzz/Bilder/pied120x60.jpg
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: nginx
accept-ranges: bytes
x-xss-protection: 1; mode=block
content-type: image/gif

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A4F4 0
23 B 41ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bd_5YvMErYIHeH87-tweDt4aoBAAAAAA4AeAEAg&bg=!ISKlImHNAAWP4B5EjzsAKQB2-DxaGeowqdsyLb4P1mSkEKMz_kpirGOZqApwC-GRJ1SDICfVc4trAgAAAexSAAAAPmgBBwoAkDZ96os3Sc2tH7sHvhBkGbalslniN95KDLvB3wwXA_QpUxj145UzhpKTauSoDXv-SmXpRM-jyjU8G1lslnVjEABfBBUFJ8eHpBlTKK8PYJkyUKP2-knF-TwWAWcOvgErvA4zuYeqItJrpi9mKR-MjWzWBDebEynk2AB-brU09inhbZGVpechiEPP7fdt-ywwPpkCbzBDoe6Zc1l5CblPNeuzEpHFGsKipclYwL49f1Dv5g-NZ3mkQw23Ma-ziPtz738XjM05piG4xuaMLyT21kBLEJrzV6uxALgK62mJuC-lSkGjJbsfAgkShCbIQI2a7hC6h8RopfHkp6ajK3bPSOGGS5ACOImH7Jg7QcBcHEkPGL7K5O_dtmeytmGqB96TiGjlsUOThVlJNwoGoiyH9G7irUUNYst4DutFpY_jeA31Vcxaw0DzbdbELeRDAsCfC4rTjeBaKiAGTBxjLu5Ae0NeotWz6x9ZNqUW5dGKbnUkrcr45a6hUFqbG1jyMKg85giDsmQA5lWt8-QeL0h82mw8XVB5pzKKQGO_woBFCVnDqpB-eygvE754m2OQ0knS8XSSV5IDjNgsVcxVBKYWlNnlPuFSCbf-LrKp0GTCRJHBHW7Gt0J3FJpTBWGCHRQ6QfEAnLLub-J_S1ISjDtHxoILoPU5KtuG1O-DIy-73N44QQtJDnzuKY8AYUomEfbjgrbfMQmzF5Xa-6XvaJHfDDRPlLpLJxN4n01AxyccLURtiqJPYiZoO3Uo08pbIJxTS_7MOfwtzF961OdjYGALacPfzH11BdAD01WL3KTqqSizXIWleZNlcN1UlPKpxjohp9AKSqiHA878eaZtghfPOt4Nbx6L2Cqe05TgUOKwuvMUPF12XG8beE_8OvpfTELdUsX7T--QyzoBiTv2WfYZuTJ07ljw8UPTMD7RS6c3KjsTzv2n0w4ACAkroC1xM3iQYftJb0F8hx4PRSff3ndnLuMxVHq-ctCF8bvlGCVo5mLQd7oYwo0_29bjRXNsAG5X25Jq

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900022.redintelligence.net/ Frame B77E 0
150 B 106ms
35ms Script
text/html 144.76.104.53
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900022.redintelligence.net/viewability?s=74913800125699900710156011507022&a=a0f76bec&vb=m
Requested by: Host: hal900022.redintelligence.net
URL: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.104.53 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.53.104.76.144.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://hal900022.redintelligence.net/request_content.php?s=74913800125699900710156011507022&a=da2dbe03
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 16 Feb 2021 12:59:41 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame B77E 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc772b0188bc262494be9dc529c50893ae189110dfcad5a286512b737aef93b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900022.redintelligence.net
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Feb 2021 18:32:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:16 GMT
server: sffe
age: 584823
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13108
x-xss-protection: 0
expires: Wed, 09 Feb 2022 18:32:38 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame B77E 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://hal900022.redintelligence.net
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 15 Feb 2021 13:10:52 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:14 GMT
server: sffe
age: 85729
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Tue, 15 Feb 2022 13:10:52 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
23 B 41ms
40ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021021001&jk=3205280526817701&bg=!vb6lvv3NAAXRs2QT0TsAKQB2-DxabidukitBoIdlUWXdzZNWr4dJwg3gUFn8oHGV-L_xZML5jhUDAgAAAftSAAAAP2gBBwoAgK_5Nkv8u-R1cSXBHQzeJJJmAsRcT6g0hZ7dKbRb7L-_MchvqvL1c2a6ia1Q-hKtaoOYP8d16K_U7dqItAiOTzINqn-5_tLV9AUTSsxAeN3J8yMgI1GIQDOVe2G5Smvt1ArfNeaVkkfiSpeukO2jdnq45glmcM8iG56HvZKfT6MImQHOjRXnyNHMaQjSSlbLUa9b62krGxs8qKi43PH-8Afr7ArEfW5w0LCKzPpqNWuVcIsmrXLsnOVW0tSYNM26jmp9AJOQ4pKmMO4g-8x2lKnRqUwa2Dy2ldTIUcWJa4gBMnCeaPMDMv4uSDH0mrwZQN9BdA4vkUsALdvUo5l_UyI1QrxJevSYg9vxvB1xpfyQLtEj3Cm0DBLh6QZMKOjxjeLAsUWO20ki8GGfw2GZP8PuTBsLaGKCMTgRPdtkBD_iMh90bNDQG3cIufNy0OzwLnT8sXkXGYYl7Hkh8OdHCfPO6iOzr8vnI-x_w5KTG7UQtSP_oHGeHYrTklKY44d9iG5Pu-xE9utGPtQEy8eIQVSnOZe9-FFGhfwdmtxGSyNDcVI780DAoEBVpqsyKIavJkYxnwjEPDDMa_fYNHfTdkrQmBI5qh1Wc7h--I-EJRAdm5diSBJ2g1j72dfVnG1yAGdWBz8j7ClZVI3XYe87rcZ4ye-VZj14GWCIby9l19i375MXPAHO8mcSAL5cm3zKJYBESxVgpNXNCDJCOUUqF3vD_ETsFp_fBC5JRlspgMmWWU7yVwC7uJEIZiNkMuv3YE6U2t0wp_Dgyk31fLdfTWo4

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://prnt.sc/zlspa2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 0e3551c2-7d21-4665-9a6e-47839b782995
https://prnt.sc/ 3 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prnt.sc/0e3551c2-7d21-4665-9a6e-47839b782995
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 2777
Content-Type: text/javascript

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1EE8 0
23 B 41ms
41ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Be_2RvMErYIqWIZXdtgeV2o2ADwAAAAA4AeAEAg&bg=!paalpuXNAAWP4B5EjzsAKQB2-Dxao2YFC3cga444wuTTvdAB_WF31GCacvvwny-agEUVEH6ggeiVAgAAAihSAAAALGgBBwoAjaDNqEL87sZN3Bo3jjZQBQrNWtfmvueqQPM7MZjHf9PFGzpJikuGqdDA7POtGQl-_cNMPJSFY7rGVmA29oANR-jUaGSslANVHhPutVnMMM9p1_y6Z3Q4ClTd8AflKrOX-X1XD70C2PdXOTu7TbA1hhhok8rn-igoPDG2u4zeKkahRhA8P4fZI9sneyun5ZkCXxDskq3I4vG-vuCN7v7fk5y54PDFgjmtwvkHZabCE9BsKIui5Dhw--nJXo9P92ZrIYfMk3fvW-rZCJ1as_vXCALDtBoyqsAwD6s_bx1TyvKH_FMsTFNKcxiAgz2_vhRPmGNrR1JYZt-9_HGooaNWZ6AhK_xngXRPLhmpW_t_Mv7WY3Sy2YZbTBvEmhKF27FmVsx3_yPyP7fK_PQnEpyW3HkkcxqJ1_S62NQk8j6OKuuJpqkTDdt81cvN739Wsije6UlI66yGY-E1BbYjc0ydBzboEp6qOjNhd7MNjXhwcQOvDMRmh6JtP2cQbO-3ohzqH4A5kU6f8IBfcNcA7SzGAOdvXxG_Q3oMHVoe9mRp6Rp6opHFIP4M3V2S6I42w1k7-dnmuw9byfQ0feaH4-FGNs1jTZNHLSBk4yQ0ZnPDcAqHhEzujOPI-Xy_r3uCV7vCsnIys8GUqpC1BZuMpqyIkdJ2bwikEsaEQUbl8c87EuNgNn0i188lsQcuYbWMybdv0SjK_4SmAL_ZG3rwGvM5IdI-M28I47bITD3o9l05Y63LiRCzrh82F1hnJuRkuSpbUu_UkLQ39o9eRKreqUxlOPDapYYRUzmTNU3enClcEVTaXGMVxk95En_JcAIjJB1p2nyZPaEMWYxugzD9aCxeoeSra25CngfQqPA65m-5Z86VIND1BzwAzk1gsRZtljx4umQWwADQDU15YMfoS_coHtn3plnb6t4Ptog7C9LHwVRLPmtdjd8QIEWYB-pivNvK4yxvM3XUW9TSy5Fag7zsVVPapGHwDC86PkGcgop1ZjU

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B2F1 0
23 B 43ms
42ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BJTiEvMErYPOyIJfxtwek8Z3oCwAAAAA4AeAEAg&bg=!39yl3J_NAAWP4B5EjzsAKQB2-Dxa_xhcnm0UQ0VLzPKXEs7BI5tYz9Lvyt1uGpcAYvPMQpsIFMfOAgAAAdxSAAAAOGgBB5kCpvWGkKQKYG6IMrIr86Tx2gCZIy51_lgtVnvnmULaeI3lZEi4nxoqQNjQbQOHRcolCbgdPcw6BEMy_VpdGbkQ1Tiy6H8fPvlBr_M8S22lgdrSthJQ4_aV07fv8GsdcgsAv3Lepci4f7liQ4B-3-elY5Zezmx1Jww_fFTOzUavgCTrR9dTl2mYqijVCuxh11ViWnywl1g0YBgp9p1uuAELDO05lmDrFFeTNNHvvChFsPC-CfK2Bo60eRLJehEfuwN2oa5eUxDCT6dOcWhdERUypPVRniX4CUz1RbxRHibh8Aw-6KwzqmJ87gOu1idLmICbjgJiP0XaSNSlE0wy7jvxQSNIdH9fiWJ8iCGv93q6IDi22EqD2Q1PbztIXn0RNdyiMY4FCrQlnecj_Wpz1JVAYozj51-CUQYbaYv3gxLkTP-M1rGl7m6NU7ffz6go5qrafDWeswJvpd7j6_XoXCcA0QHcpYAvM-T0XBL4aYMOeuxmnuA42HtQ_pZFvEgVf6nRTRxOSM3uYgJ2P1uJh88OSoLbX-_Bo-PzgDBPWdtto_5qJ1RcAlHVMgKSxKda-AORpj6HpKnAYe0R76mZPfq6SiozjyG60IdUF7_37NfpqT4qhQ4fGGsCZZmIKPHHLBBnPWHDxtYW7pVj01sbrm-LHxI_wFAIEqndzuAus6_vsIWApt8IqWgjVmmOX2-re8upup9pC0fA2f_T1-EW_PxGFBYYZPj_RbHKdckX6py4QtSeLMvUj12QXnPaJVzbb6i6C3V_K7tiTADKpGoCQB4Al_YZySuWRHy0SboL2auhgv51QsGrCH6d2ONXEomYtDCLv-tJbnLJVrQnGHAqjF47dEF5zwn1SK4rj7ukJMd09GsAHm9FdsmQYgtzEWbzyaJeiSgrYtHhRg

Requested by

Host: c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
URL: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0908 42 B
725 B 69ms
55ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvmpII5PFfW4OGAiQf5pCIhkSTmx3dVkclErWeXXZAuDZ4KiUYRixM-ZCsqGKEJ36hq6OAvIAN3ftZcYp7LysvGKNRQHSxDXcJLago06D3hMqhOXMbHt1IujOcCKw&sai=AMfl-YR_aXGWDZCUabgoobX47D1ertYFCcsiWCdUUlITHeQFepAMbvvz9WLEz-utNAL1U6S7K3QPKFKUGG9k7GGt9b84DiD48DmnRwvCApUGceSOEz7aWTQeX8tpFEqyjN_1&sig=Cg0ArKJSzH9RVuZd6IpqEAE&cid=CAASPeRoAVVrI5sl7W8DY5Ssx0t2WLklmcx72f3JuejNCo_1H9C5uMRcIvuxOpB1Pj9QICS7cIPcCdZNXeIJQIo&id=osdim&mcvt=1000&p=70,436,160,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210210&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1432691387&rs=4&met=ce&la=0&cr=0&osd=1&vs=4&rst=1613480380454&dlt=49&rpt=318&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B8A0 42 B
66 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuhvps21l4zhqcp_5X7fkRT-7g_suHbjBpME9gGDJvTOb0wLyVJ8O-YL7Za_DF_ZzfltLO05-IYq2bv12zBUA8BzMSoMH1crlyhLksTJscNuLyU6k3XzXe-lPHcGg&sai=AMfl-YRkWAqpu98r8LeOlFIer2-ouDeIbcu3a5kQMcRCg149Ycuu0k5I62wYECHTuSiQdjdYZ87rfhaVkRGgiGGX6n29umVUYM-ILtNr6HFx8EpGw-270FkrVQAhvefnd4J2&sig=Cg0ArKJSzGMBwjp39DDLEAE&cid=CAASPeRoPBDAzdeOK-WJGPRhH9GLH1hMkoFD8Dm_lBSEcvKpMYFnzPqj8esKaZc7d0E9l6tTM4eUK7s6pMcnKlg&id=osdim&mcvt=1000&p=1133,315,1227,1285&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&v=20210210&bin=7&avms=nio&bs=0,0&mc=0.71&if=1&app=0&itpl=20&adk=3120184932&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1613480380456&dlt=30&rpt=332&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI84C857ru7gIVl_jtCh2keAe9EAAYACDwiJ0-QhMI2vqY57ru7gIVt8gRCB2QWQho;met=1;&timestamp=1613480392967;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 0908 42 B
254 B 65ms
63ms Image
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI84C857ru7gIVl_jtCh2keAe9EAAYACDwiJ0-QhMI2vqY57ru7gIVt8gRCB2QWQho;met=1;&timestamp=1613480392967;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 Feb 2021 12:59:53 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.prnt.sc/	1970-01-19 16:11:20	Name: _gat Value: 1
.prnt.sc/	1970-01-19 16:12:46	Name: _gid Value: GA1.2.1136159062.1613480378
.prnt.sc/	1970-01-20 09:42:32	Name: _ga Value: GA1.2.332265398.1613480378
.prnt.sc/	1970-01-19 16:54:32	Name: __cfduid Value: d14df25e7f0a353a6d1a809a2359979901613480377

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/cmp2.js?referer=prnt.sc(Line 1) Message: TypeError: Cannot read property 'getItem' of null

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ade.googlesyndication.com
ads.ad4game.com
adservice.google.com
adservice.google.de
api.prntscr.com
c.amazon-adsystem.com
c867941dd53038325b45abdbe5bb0a2f.safeframe.googlesyndication.com
cct.connects.ch
cdn.ad4game.com
cm.g.doubleclick.net
connect.facebook.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hal9000.redintelligence.net
hal900022.redintelligence.net
htlb.casalemedia.com
image.prntscr.com
pagead2.googlesyndication.com
platform.twitter.com
prnt.sc
prntscr.com
quantcast.mgr.consensu.org
rules.quantcount.com
s0.2mdn.net
scontent-frt3-2.xx.fbcdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
st.prntscr.com
stats.g.doubleclick.net
syndication.twitter.com
tpc.googlesyndication.com
www.adtracker.ch
www.awin1.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagservices.com
www.linsenkontakt.ch
104.23.139.12
104.23.140.12
104.244.42.136
104.26.14.80
138.201.84.253
142.250.185.162
142.250.186.130
142.250.186.34
144.76.104.53
151.139.242.3
192.207.255.147
23.218.208.246
23.37.38.181
2600:9000:20d7:1200:6:44e3:f8c0:93a1
2600:9000:20d7:9200:9:46dc:4700:93a1
2606:2800:234:46c:e8b:1e2f:2bd:694
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:803::200e
2a00:1450:4001:808::2002
2a00:1450:4001:809::200a
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:810::2002
2a00:1450:4001:810::2003
2a00:1450:4001:810::2006
2a00:1450:4001:811::2001
2a00:1450:4001:812::2002
2a00:1450:4001:812::2004
2a00:1450:4001:82a::2004
2a00:1450:400c:c1b::9c
2a00:d70:0:b:2002:0:d91a:365b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
5.148.168.135
65.9.24.128
84.200.5.215
92.123.148.9
02a94215980e0a9b1534964bf8c1fe26b45710405f9e0c9ebfab99ee961bf84e
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
055dd0f1e0eae12d4587b12f516a1d7a0f858d80498823cbade9f97b5962d727
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
09cd042f140a4f9886e8fbc7c3fb92532c8a842ee4b68e479add3172c22fd8e9
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d9c8f6535743ddc62fc8ae54d352c85e2875df234b6023fb6f7acf1af9a9107
0e203332bdb8a0c387ae96935481aee57996419bc60598b9162b841d7bbd9ac0
1082b879cd43a0dec9ab3cc9ae2ddad7426c64e73fed45067c89afcac5bdd227
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859
199cb43987888c359f18a98dbde4cdb9e2f11bd50342ad0e800adbdf42337937
1b185d89e437f1591af8c51d5e6dad41d3666e22a81931ee9df22e2cfdacaddb
1bbb1cf040948bea2829656ed20814d5ecabdeb106bff79cad43af8e6ed78161
2789568a4a66c78d3bf4dbc2bec66efe724510caa80e0c1b0ddd7d8e20012380
2875a6fc4266fec00a383377cb4530b6407912897b0727e26249d89c6dfe0359
28c052d2e61bdbb4a85e945f7aa8555c2548f4c65c399e654d6b2ae42e484120
2bcf26566211c926eec5d81ca2fd779f373a765c0a1555f6e05fdc6d783b9efe
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
35fe3377279d21fb5a2e01f92eddc9f816cd4fac3e303ca246596104a81eba95
3659ceeede630f0af896dcbc7f364e1d9d9dacc3b0cdee0f2701ac18158b17ff
3e648c4cf667ee35d239450647613d274c350a153190d1c48a479dd7f67f7017
4092ea8b44ebec21d9e7ddfdb319a3a53403092a5b7c29395ddc1448b2c24c04
40ec0b04019845302a5052b4689b5d3477c9717dca73243e5faf7cf98f3af564
415af67f7c8589dae48efc186058a2feb0baa3a998c55f01123a02008f7d1712
427f32df0171b235458430b3fdce6c64b7c2c3d66eef78c17870002d90bddc27
437afd9de21717c919be3f40f686b33170f2447dc03ded0fc00ac0cc41839854
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
4a6ecbbb2412ecf71655072cda2d011dc14e55d949fcf8f4ed38d401c727d4fc
4acf839bb2b547c63c6416cea07b2d3febb32692996a5d35ac70a14ad6967265
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5259164580b701ca5116d20edce61c9299accdf3227a00cf8b9973e434af640e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5a3a63b2ac124cb9a194ec01ea1f0d3123e4019bf658c6f47a77b4faea84c079
5e6e38efe361effb2b05fba9a24521eee8539324a1a75668442493bf9af2919e
5e85f782330da3806ea498687ef4e972c92def08e53d20dab8969bcecb146bb7
641e03dfeee60c05e0794bace5fc58d2fba409fee529a114459e44cee0d9d069
65782774b737eba60b0735ff3f191d442613b1194ed05b1c18b292544d996b3b
6c15543164017966f4b8c08377fc6612665682030fd83a4696bc6640daa9cd16
718d8e9bf93740a3a90b67e53219319342074524b2dede8ba219eea4c41ea0c4
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7687196bb002f79b05865878132ec2a79d5f824a5a27a70754a8410fc577895f
782db5605136a4b7d143bfdacf544a921cd7b8b2bd8c1fcfb1ff51baeb1d4cbc
789efdc8b850e58bd1ca2b2513465163a194ab986b97a027ad5997e741bddd22
79b65266dcc689a6d5eeed90308abce82a2ac72081d8bb9012881a3d3196f8e7
7b67ae2416a166f4238581097d4ce984a69d9662aab12ecc4b2b881c45164e36
7c0571c4439bc71a810f1f6021ead277b6b22fb193908d99202edaa4e6e56fe5
7e473ad8e516170972fbe5c4760bf81cfcae18b065d87651ac534509daf29824
7e9a57f1be1f89cfa8a8bf05a078a6d07402195a7bdf58d58826f6ea272a9dfe
80e2eb1342eaa54b62a3ac315f53d573b1d77555f5df0cbc27926e8bbfd8236c
81563854166118109cb131fc867d992f46b0a9b944f861079348b0ae60eabcb8
83817752fb260ff66b3bca1471bb20dbb6a1e6a17174c657efe0912ad161b382
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859ded66e754fc423c879c565cd3bad6d5b46eb2cb67c5cb50e771421c239120
860bf7d8c1eabff7f01fa644744a01d25f0f751157bc3570bcf165f53ccfc012
86a1b8f94f48c4e82d2616d4c581f10a34ff447a2bd95be08714fa0d19ba3f51
873aed697d352242a06cc0e1961d2503173d4cbe93713671731d6b8928961745
8832cd4a31f82cb5a72600525d600bbc587a732c5e4abd5487c229c1e0564d08
8b988d49a234d18d17e9dee608a6d8638b4574345a2f82ecc5b11921cc41bba1
8bfd2fa3b3b5924e3655bcf9f63427e792bd8572b7ed0992373bdb4b21c7cb89
8cd1cc7558309ce0839d31c56f33d5274b8b53e2472ec3deda3be24fcd3fe40c
99adb384fd992660be76df488633e76fe86ed9bba2a7cdf143a97e03fc3ee94d
9bd7952daefc70291b0a0bc163e80b8654b7600d1c590f24fa57a5cb8a218964
9c9935e1daafc929a9866a206e769e084cd83f19d436ca22887adc2798408646
9cd5fd35b7545af5204717c37ee7863aebd1f03321c810b9f98cffae1bc5b297
9ec204561656bab028c2fb1d77312a95e26333f39b4a2a274049423f023acf5f
a093d2047e1a59b7103810b947780e5f94d865915cb923ebcaa7e50f557c2102
a0c62a0d783682a2f99b7fe3eae0bdcedaf8f5cb9de99013074509974747ef9e
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad74c389ce3adb124a1d4fa373f91b954cc45c4eba1d5184da4ad99c212a37a8
ae6a21608504cdf29fa2255c023ae3493b4f0da242daf58fbb32ebc6f6f23b25
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b0a71905c848ae9415bc5f7ff01744d43cd419c124ffea02038a016cd046601d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6a1120cc303b1c6ee6d548a5b418c2707b59de0c1f13c8ab870ca4e734b6acc
bca2c1abcf4b76a46306bc7f1a607a459371ccf5e7213aae988c33b4dabb1758
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
c11fb9ac4922e75ae9e0a017f41ae36febd8a185834b7bb608e9049ebe68da62
c2d21146bc055221ba79bb9068ca918fd28f9bcecf92a53c45becd2bd998e238
c34f5c51cea0ee9e05108c79c404086a24b73fbecb0999654fc9116b4c4b755e
c52c1d248454c1e7ce1f1ba5c951d56f7cb66dff364677148dde10fea10b6e86
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb09c3720b53d8651d6f5825cf643e6249aefbe82a1ba1417d230cdb9b36cba6
ced34f591157438ef47695f979ac95f8758408e8d9b88e63aee8b382ec975785
cf4b7444def1ea1f636a286e3ad738f62a66953528c150922aab893f1a4c3306
d4e89f3e12c2411ce38b4f8a27044caeba00ebe4be361559f4b32798aa26c42e
d91d13fd8f9d253a8213aeee7ebaa7e073683fc600a3d82902c3c669b8ffdee7
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
dc605d43d32d7a4783e0627945dc7324951c2e23ac8716a0b5f95792cdb6c284
dc9f7cdaabb3201fd2ead8c0cfd974710305362d0ea77c96069cb189796d6238
dd4664da7cdeff0fb257d064ec2e94b4d95d27acf5dc5cdc796ebc5f75dda689
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee
e926f30958d0c21d088e6a671d3356a3c3fab9cc6220b8e408f19d868a7dc5c8
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b
eddb994832063abc72c356b4c686046d62b1c5ae4bba1b646267e4de6bcda0b8
ee7c0aa7330f62b75b4e54dc5e44c543d8013358f2f2e40a655b9d0a668ba572
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729
f5700b13f8d42ea1395db4ab9c6939f781e90dbde6a9ec39f671dddf8a3e20d4
f9d17a49fbd4e61d42fb801e708edd216d2ff629aa838b04cae023b9efb24bbc
fc772b0188bc262494be9dc529c50893ae189110dfcad5a286512b737aef93b8
fe0b009af4d6be99bb24436d2b2c67706fa3698e059d8df3bfa9f9c8857b42ae
feb78712a78e071f82039ca2b97bbf0142ba6874fff826fa7d0b77ccbd110a0c
ff6f2b33b098e5cc045a7204752569b93301258047ef6823631529c385635681

prnt.sc Open in urlscan Pro 104.26.14.80 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

158 Requests

99 %HTTPS

56 %IPv6

26 Domains

42 Subdomains

40 IPs

4 Countries

3917 kBTransfer

9489 kBSize

4 Cookies

12 Outgoing links

Page URL History

Redirected requests

158 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

prnt.sc Open in urlscan Pro
104.26.14.80 Public Scan

Screenshot
Live screenshot

Full Image

158
Requests

99 %
HTTPS

56 %
IPv6

26
Domains

42
Subdomains

40
IPs

4
Countries

3917 kB
Transfer

9489 kB
Size

4
Cookies

158 HTTP transactions
5 data transactions