thebirthdaybest.com Open in urlscan Pro
18.158.98.109 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://thebirthdaybest.com/
Submission: On August 16 via manual (August 16th 2021, 3:16:19 pm UTC) from US

Summary HTTP 373 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 65 IPs in 12 countries across 63 domains to perform 373 HTTP transactions. The main IP is 18.158.98.109, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is thebirthdaybest.com.
TLS certificate: Issued by R3 on August 10th 2021. Valid for: 3 months.

This is the only time thebirthdaybest.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
88	18.158.98.109 18.158.98.109	16509 (AMAZON-02) (AMAZON-02)
21	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3036::ac43:a1d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	65.9.79.193 65.9.79.193	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
6	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
4	2606:4700:303... 2606:4700:3031::6815:160b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	139.45.197.250 139.45.197.250	9002 (RETN-AS) (RETN-AS)
6	3.66.136.156 3.66.136.156	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:51e4:db4b:4436:b305	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:219... 2600:9000:2190:4c00:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:210... 2600:9000:2104:8000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
71	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
3 6	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:828::2006	15169 (GOOGLE) (GOOGLE)
2 4	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	178.250.2.146 178.250.2.146	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	52.205.247.225 52.205.247.225	14618 (AMAZON-AES) (AMAZON-AES)
1	213.19.147.42 213.19.147.42	3356 (LEVEL3) (LEVEL3)
1	178.250.2.131 178.250.2.131	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 9	185.33.220.241 185.33.220.241	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:1901:0:7... 2600:1901:0:76b9::	15169 (GOOGLE) (GOOGLE)
14	2606:4700:303... 2606:4700:3039::6815:c03a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 4	2606:4700::68... 2606:4700::6812:d05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	81.222.128.216 81.222.128.216	20597 (ELTEL-AS) (ELTEL-AS)
7 12	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2 3	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	13.225.78.30 13.225.78.30	16509 (AMAZON-02) (AMAZON-02)
1	54.77.232.22 54.77.232.22	16509 (AMAZON-02) (AMAZON-02)
1	54.250.62.115 54.250.62.115	16509 (AMAZON-02) (AMAZON-02)
2 2	52.59.77.57 52.59.77.57	16509 (AMAZON-02) (AMAZON-02)
4 4	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3032::6815:57ae	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	51.89.9.252 51.89.9.252	16276 (OVH) (OVH)
1	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1 2	2.19.44.80 2.19.44.80	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	142.250.184.230 142.250.184.230	15169 (GOOGLE) (GOOGLE)
1	148.251.139.77 148.251.139.77	24940 (HETZNER-AS) (HETZNER-AS)
3	46.236.13.147 46.236.13.147	24931 (DEDIPOWER) (DEDIPOWER)
1	65.9.73.121 65.9.73.121	16509 (AMAZON-02) (AMAZON-02)
1	81.29.72.47 81.29.72.47	24931 (DEDIPOWER) (DEDIPOWER)
2	54.77.236.168 54.77.236.168	16509 (AMAZON-02) (AMAZON-02)
2	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	51.89.20.87 51.89.20.87	16276 (OVH) (OVH)
2	2.18.233.180 2.18.233.180	16625 (AKAMAI-AS) (AKAMAI-AS)
2	151.101.13.108 151.101.13.108	54113 (FASTLY) (FASTLY)
3 4	37.157.6.245 37.157.6.245	198622 (ADFORM) (ADFORM)
2 2	213.155.156.167 213.155.156.167	1299 (TELIANET ...) (TELIANET Telia Carrier)
20	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	178.250.0.163 178.250.0.163	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	85.114.159.93 85.114.159.93	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
2 3	52.30.92.119 52.30.92.119	16509 (AMAZON-02) (AMAZON-02)
1	162.55.6.211 162.55.6.211	24940 (HETZNER-AS) (HETZNER-AS)
2 2	213.19.147.44 213.19.147.44	3356 (LEVEL3) (LEVEL3)
5 5	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
1 1	213.19.147.45 213.19.147.45	26120 (RHYTHMONE) (RHYTHMONE)
1 1	87.98.252.5 87.98.252.5	16276 (OVH) (OVH)
1 1	198.148.27.140 198.148.27.140	19189 (PULSEPOINT) (PULSEPOINT)
1	63.251.232.170 63.251.232.170	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1 1	2a04:4e42:3::300 2a04:4e42:3::300	54113 (FASTLY) (FASTLY)
1	151.101.13.44 151.101.13.44	54113 (FASTLY) (FASTLY)
2 2	185.29.132.245 185.29.132.245	30419 (MEDIAMATH...) (MEDIAMATH-INC)
2	185.64.189.114 185.64.189.114	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 4	51.222.80.231 51.222.80.231	16276 (OVH) (OVH)
2 2	34.253.109.165 34.253.109.165	16509 (AMAZON-02) (AMAZON-02)
2 2	54.78.254.47 54.78.254.47	16509 (AMAZON-02) (AMAZON-02)
1	159.253.128.183 159.253.128.183	36351 (SOFTLAYER) (SOFTLAYER)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
3 3	35.157.197.70 35.157.197.70	16509 (AMAZON-02) (AMAZON-02)
2 2	54.194.211.3 54.194.211.3	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (TURN) (TURN)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1 1	178.62.202.251 178.62.202.251	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1 1	66.155.71.149 66.155.71.149	13768 (COGECO-PEER1) (COGECO-PEER1)
1 1	34.98.107.212 34.98.107.212	15169 (GOOGLE) (GOOGLE)
1 1	185.33.220.243 185.33.220.243	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	52.208.41.69 52.208.41.69	16509 (AMAZON-02) (AMAZON-02)
1	185.64.190.81 185.64.190.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
373	65

88 18.158.98.109 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

thebirthdaybest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:a1d1 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 65.9.79.193 (United States)

ASN16509 (AMAZON-02, US)

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.77.37 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3031::6815:160b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-0.thebirthdaybest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 139.45.197.250 (United Kingdom)

ASN9002 (RETN-AS, GB)

dibsemey.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.66.136.156 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:51e4:db4b:4436:b305 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:4c00:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2104:8000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

71 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:2638::1c (France) 2 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.205.247.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-247-225.compute-1.amazonaws.com

pb-server.ezoic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.19.147.42 (United Kingdom)

ASN3356 (LEVEL3, US)

tag.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.131 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: bidder.am5.vip.prod.criteo.com

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 185.33.220.241 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:76b9:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

prod-rtb.ad4mat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:4700:3039::6815:c03a (United States)

ASN13335 (CLOUDFLARENET, US)

ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as.ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.ad4m.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:d05 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.222.128.216 (Russian Federation) 1 redirects

ASN20597 (ELTEL-AS, RU)
PTR: ad16.adriver.ru

ssp.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.186.130 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.190.78 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.30 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-30.fra2.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.77.232.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-232-22.eu-west-1.compute.amazonaws.com

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.250.62.115 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-250-62-115.ap-northeast-1.compute.amazonaws.com

cc.adingo.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.59.77.57 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-77-57.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.126.56.137 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3032::6815:57ae (United States)

ASN13335 (CLOUDFLARENET, US)

static-de.ad4mat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.89.9.252 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip252.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.76.3 (United States)

ASN2635 (AUTOMATTIC, US)

pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.19.44.80 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-44-80.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.230 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.251.139.77 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.77.139.251.148.clients.your-server.de

banner.congstar.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 46.236.13.147 (United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.73.121 (United States)

ASN16509 (AMAZON-02, US)

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.29.72.47 (Epsom, United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 81-29-72-47.servers.dedipower.net

diapi.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.77.236.168 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-236-168.eu-west-1.compute.amazonaws.com

api.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.20.87 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: p19.id5-sync.com

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.180 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.13.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.6.245 (Denmark) 3 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.167 (Uppsala, Sweden) 2 redirects

ASN1299 (TELIANET Telia Carrier, SE)
PTR: 213-155-156-167.teliacarrier-cust.com

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.163 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Schopfheim, Germany) 1 redirects

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.30.92.119 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-92-119.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.55.6.211 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.211.6.55.162.clients.your-server.de

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.19.147.44 (United Kingdom) 2 redirects

ASN3356 (LEVEL3, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 76.223.111.131 (United States) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.19.147.45 (United Kingdom) 1 redirects

ASN26120 (RHYTHMONE, US)

sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 87.98.252.5 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ip5.ip-87-98-252.eu

green.erne.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.140 (New York, United States) 1 redirects

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.251.232.170 (United States)

ASN29791 (VOXEL-DOT-NET, US)
PTR: ams-mon-1.sys.adgear.com

cm.adgrx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::300 (United States) 1 redirects

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

match.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.29.132.245 (United Kingdom) 2 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.114 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 51.222.80.231 (Canada) 3 redirects

ASN16276 (OVH, FR)
PTR: ns574734.ip-51-222-80.net

pixel.onaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.253.109.165 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-109-165.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.78.254.47 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com

loada.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.253.128.183 (Amsterdam, Netherlands)

ASN36351 (SOFTLAYER, US)
PTR: b7.80.fd9f.ip4.static.sl-reverse.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.157.197.70 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-197-70.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.194.211.3 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-211-3.eu-west-1.compute.amazonaws.com

ads.avct.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.194.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (TURN, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (United States)

ASN41041 (VCLK-EU-SE, US)

pubmatic-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.62.202.251 (Amsterdam, Netherlands) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

match.adsby.bidtheatre.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.155.71.149 (Portsmouth, United Kingdom) 1 redirects

ASN13768 (COGECO-PEER1, CA)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.107.212 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 212.107.98.34.bc.googleusercontent.com

ads.playground.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.220.243 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.208.41.69 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-41-69.eu-west-1.compute.amazonaws.com

rtb.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.81 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
92	thebirthdaybest.com thebirthdaybest.com cdn-0.thebirthdaybest.com	598 KB
84	googlesyndication.com 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	328 KB
48	doubleclick.net 9 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net static.doubleclick.net cm.g.doubleclick.net ad.doubleclick.net	298 KB
29	pubmatic.com 2 redirects hbopenbid.pubmatic.com image6.pubmatic.com ads.pubmatic.com image2.pubmatic.com simage2.pubmatic.com image4.pubmatic.com simage4.pubmatic.com	32 KB
16	google.com 3 redirects adservice.google.com www.google.com	2 KB
14	ad4m.at ad4m.at as.ad4m.at assets.ad4m.at	314 KB
12	adnxs.com 4 redirects ib.adnxs.com acdn.adnxs.com secure.adnxs.com	42 KB
10	google.de adservice.google.de	1 KB
9	criteo.com 3 redirects gum.criteo.com mug.criteo.com bidder.criteo.com dis.criteo.com	8 KB
9	gstatic.com fonts.gstatic.com	137 KB
7	ezoic.net g.ezoic.net go.ezoic.net	2 KB
7	wp.com c0.wp.com pixel.wp.com	173 KB
5	adsrvr.org 5 redirects match.adsrvr.org	2 KB
5	yahoo.com 4 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	5 KB
5	googletagservices.com www.googletagservices.com	177 KB
5	googleapis.com ajax.googleapis.com fonts.googleapis.com	56 KB
4	onaudience.com 3 redirects pixel.onaudience.com	2 KB
4	adform.net 3 redirects c1.adform.net	2 KB
4	webgains.com track.webgains.com diapi.webgains.com	39 KB
4	tribalfusion.com 2 redirects a.tribalfusion.com s.tribalfusion.com	2 KB
4	amazon-adsystem.com c.amazon-adsystem.com	36 KB
3	bidswitch.net 3 redirects x.bidswitch.net	1 KB
3	bidr.io 2 redirects match.prod.bidr.io	2 KB
3	webgains.io analytics.webgains.io api.webgains.io	61 KB
3	1rx.io 2 redirects tag.1rx.io sync.1rx.io	1 KB
3	ezoic.com pb-server.ezoic.com	2 KB
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	10 KB
3	dibsemey.com dibsemey.com	45 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	742 B
2	avct.cloud 2 redirects ads.avct.cloud	894 B
2	exelator.com 2 redirects loada.exelator.com	2 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	mathtag.com 2 redirects sync.mathtag.com	1 KB
2	taboola.com 1 redirects trc.taboola.com match.taboola.com	652 B
2	de17a.com 2 redirects d5p.de17a.com	637 B
2	criteo.net static.criteo.net	52 KB
2	awin1.com 1 redirects www.awin1.com	1 KB
2	onetag-sys.com onetag-sys.com	2 KB
2	advertising.com 2 redirects pixel.advertising.com	933 B
2	ad4mat.net prod-rtb.ad4mat.net static-de.ad4mat.net	4 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	gumgum.com 1 redirects rtb.gumgum.com	338 B
1	playground.xyz 1 redirects ads.playground.xyz	487 B
1	sitescout.com 1 redirects pixel-sync.sitescout.com	337 B
1	bidtheatre.com 1 redirects match.adsby.bidtheatre.com	550 B
1	dotomi.com pubmatic-match.dotomi.com	104 B
1	turn.com 1 redirects ad.turn.com	518 B
1	simpli.fi um.simpli.fi	611 B
1	adgrx.com cm.adgrx.com	408 B
1	contextweb.com 1 redirects bh.contextweb.com	462 B
1	erne.co 1 redirects green.erne.co	326 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com	535 B
1	loopme.me csync.loopme.me	152 B
1	adition.com 1 redirects dsp.adfarm1.adition.com	501 B
1	id5-sync.com id5-sync.com	537 B
1	congstar.de banner.congstar.de	518 B
1	adingo.jp cc.adingo.jp	44 B
1	yieldmo.com ads.yieldmo.com	35 B
1	smaato.net 1 redirects s.ad.smaato.net	429 B
1	adriver.ru 1 redirects ssp.adriver.ru	340 B
1	quantcount.com rules.quantcount.com	427 B
1	googletagmanager.com www.googletagmanager.com	40 KB
1	ezodn.com go.ezodn.com	87 KB
373	63

	Domain	Requested by
88	thebirthdaybest.com	thebirthdaybest.com
71	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com thebirthdaybest.com 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
21	securepubads.g.doubleclick.net	thebirthdaybest.com securepubads.g.doubleclick.net
13	simage2.pubmatic.com	ads.pubmatic.com
12	cm.g.doubleclick.net	7 redirects 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
10	adservice.google.com	securepubads.g.doubleclick.net
10	adservice.google.de	securepubads.g.doubleclick.net
9	ib.adnxs.com	3 redirects go.ezodn.com acdn.adnxs.com
9	fonts.gstatic.com	fonts.googleapis.com
8	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com www.googletagservices.com
7	image2.pubmatic.com	ads.pubmatic.com
6	assets.ad4m.at	as.ad4m.at
6	ad4m.at	8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com ad4m.at ads.pubmatic.com
6	static.doubleclick.net
6	googleads.g.doubleclick.net	8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
6	www.google.com	3 redirects tpc.googlesyndication.com 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
6	g.ezoic.net	thebirthdaybest.com
6	c0.wp.com	thebirthdaybest.com
5	match.adsrvr.org	5 redirects
5	www.googletagservices.com	securepubads.g.doubleclick.net 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
5	8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	pixel.onaudience.com	3 redirects ads.pubmatic.com
4	c1.adform.net	3 redirects ads.pubmatic.com
4	ups.analytics.yahoo.com	4 redirects
4	gum.criteo.com	2 redirects static.criteo.net
4	cdn-0.thebirthdaybest.com	thebirthdaybest.com
4	fonts.googleapis.com	thebirthdaybest.com tpc.googlesyndication.com
4	c.amazon-adsystem.com	thebirthdaybest.com c.amazon-adsystem.com
3	x.bidswitch.net	3 redirects
3	match.prod.bidr.io	2 redirects ads.pubmatic.com
3	track.webgains.com	as.ad4m.at analytics.webgains.io
3	image6.pubmatic.com	2 redirects ads.pubmatic.com
3	pb-server.ezoic.com	go.ezodn.com onetag-sys.com
3	mug.criteo.com
3	dibsemey.com	thebirthdaybest.com
2	sync-tm.everesttech.net	2 redirects
2	ads.avct.cloud	2 redirects
2	loada.exelator.com	2 redirects
2	sync.crwdcntrl.net	2 redirects
2	image4.pubmatic.com	ads.pubmatic.com
2	sync.mathtag.com	2 redirects
2	sync.1rx.io	2 redirects
2	d5p.de17a.com	2 redirects
2	acdn.adnxs.com	go.ezodn.com
2	ads.pubmatic.com	go.ezodn.com ads.pubmatic.com
2	static.criteo.net	go.ezodn.com static.criteo.net
2	api.webgains.io	analytics.webgains.io
2	ad.doubleclick.net	2 redirects
2	www.awin1.com	1 redirects as.ad4m.at
2	as.ad4m.at	ad4m.at as.ad4m.at
2	onetag-sys.com	go.ezodn.com
2	pixel.advertising.com	2 redirects
2	s.tribalfusion.com	ads.pubmatic.com
2	a.tribalfusion.com	2 redirects
2	pixel.quantserve.com	1 redirects thebirthdaybest.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	rtb.gumgum.com	1 redirects
1	secure.adnxs.com	1 redirects
1	ads.playground.xyz	1 redirects
1	pixel-sync.sitescout.com	1 redirects
1	match.adsby.bidtheatre.com	1 redirects
1	pubmatic-match.dotomi.com	ads.pubmatic.com
1	ad.turn.com	1 redirects
1	pr-bh.ybp.yahoo.com	ads.pubmatic.com
1	um.simpli.fi	ads.pubmatic.com
1	match.taboola.com	ads.pubmatic.com
1	trc.taboola.com	1 redirects
1	cm.adgrx.com	ads.pubmatic.com
1	bh.contextweb.com	1 redirects
1	green.erne.co	1 redirects
1	sync.targeting.unrulymedia.com	1 redirects
1	csync.loopme.me	ads.pubmatic.com
1	dsp.adfarm1.adition.com	1 redirects
1	dis.criteo.com	1 redirects
1	id5-sync.com	go.ezodn.com
1	diapi.webgains.com	track.webgains.com
1	analytics.webgains.io	track.webgains.com
1	banner.congstar.de	as.ad4m.at
1	pixel.wp.com
1	static-de.ad4mat.net	ad4m.at
1	cc.adingo.jp	8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
1	ads.yieldmo.com	8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
1	s.ad.smaato.net	1 redirects
1	ssp.adriver.ru	1 redirects
1	prod-rtb.ad4mat.net	thebirthdaybest.com
1	hbopenbid.pubmatic.com	go.ezodn.com
1	bidder.criteo.com	go.ezodn.com
1	tag.1rx.io	go.ezodn.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	rules.quantcount.com	secure.quantserve.com
1	go.ezoic.net	thebirthdaybest.com
1	secure.quantserve.com	thebirthdaybest.com
1	www.googletagmanager.com	thebirthdaybest.com
1	ajax.googleapis.com	thebirthdaybest.com
1	go.ezodn.com	thebirthdaybest.com
373	96

This site contains links to these domains. Also see Links.

Domain
www.ezoic.com
twitter.com
www.facebook.com
t.me
wa.me
www.reddit.com

Subject Issuer	Validity	Valid
thebirthdaybest.com R3	`2021-08-10` - `2021-11-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-05` - `2022-07-04`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
dibsemey.com R3	`2021-06-24` - `2021-09-22`	3 months	crt.sh
ezoic.net R3	`2021-07-22` - `2021-10-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
*.google.de GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-06-27` - `2021-09-24`	3 months	crt.sh
*.ezoic.com Sectigo RSA Domain Validation Secure Server CA	`2021-04-19` - `2022-05-20`	a year	crt.sh
*.1rx.io Sectigo RSA Domain Validation Secure Server CA	`2021-06-01` - `2022-07-02`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.ad4mat.net AlphaSSL CA - SHA256 - G2	`2019-08-06` - `2021-09-08`	2 years	crt.sh
*.yieldmo.com Amazon	`2021-05-25` - `2022-06-23`	a year	crt.sh
*.adingo.jp DigiCert TLS RSA SHA256 2020 CA1	`2021-03-26` - `2022-04-14`	a year	crt.sh
onetag-sys.com R3	`2021-07-26` - `2021-10-24`	3 months	crt.sh
www.awin1.com DigiCert SHA2 Secure Server CA	`2021-06-11` - `2022-06-16`	a year	crt.sh
*.congstar.de TeleSec ServerPass Class 2 CA	`2021-05-18` - `2022-05-23`	a year	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-20` - `2022-06-20`	a year	crt.sh
*.webgains.io Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-06-27` - `2021-09-24`	3 months	crt.sh
*.id5-sync.com R3	`2021-07-13` - `2021-10-11`	3 months	crt.sh
cdn.adnxs.com GlobalSign Organization Validated CA - SHA256 - G4	`2021-05-10` - `2022-06-11`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.match.prod.bidr.io Amazon	`2021-02-26` - `2022-03-27`	a year	crt.sh
loopme.me R3	`2021-07-11` - `2021-10-09`	3 months	crt.sh
public1.adgear.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-24` - `2022-03-26`	a year	crt.sh
*.taboola.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.onaudience.com Certyfikat SSL	`2021-05-28` - `2022-05-28`	a year	crt.sh
*.simpli.fi DigiCert SHA2 Secure Server CA	`2019-09-18` - `2021-12-12`	2 years	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-29` - `2021-09-22`	6 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh

This page contains 37 frames:

Primary Page: https://thebirthdaybest.com/
Frame ID: C5F92001A242486525CC3214760F76BC
Requests: 182 HTTP requests in this frame

Frame: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 59167880056F8753797D70927BA587C3
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: D375014723190483CF75F9CD61270961
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4B7B7BFF88343E2CAC676AF8A7EA40DD
Requests: 1 HTTP requests in this frame

Frame: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: D5B34DC06B86178A006CA3F80B1C2C97
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html
Frame ID: BA71B56773BB8811AF5E34CA25B9701B
Requests: 14 HTTP requests in this frame

Frame: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 21CA1F0E6238B47CFC39CE92E38B7F02
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 50F30A965ADD6CD201FCCC1FFFA54DAC
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html
Frame ID: 86C07AA07761BA0B62A0BBE31C2A010D
Requests: 44 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 4ECAA379D9D4F35D78C290872A6CF481
Requests: 2 HTTP requests in this frame

Frame: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: E46C1C5C5EBCC1FBEE7C80979A7E0FA8
Requests: 10 HTTP requests in this frame

Frame: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
Frame ID: 5374BA1157F70CDA26C6CD139B9BAFA2
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 1CE8E884C00C3552CB7BC03B4F59E87A
Requests: 9 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
Frame ID: 3954196D8E213A05D0F70F0524631E6E
Requests: 2 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: 33CEF777E1DD669A37C2CB4ED83953AC
Requests: 1 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Frame ID: 3AB5446431F87F06FA01FCC090EF8412
Requests: 16 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=thebirthdaybest.com
Frame ID: 6BBE194EAA4CA3E5ABDB7865800BB1E0
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Frame ID: CBFB6C893F2E23C9FC3EDDFF4F7C14DB
Requests: 24 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 8D8B2F9D3A70CBC02D34037E1E482E15
Requests: 3 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1629126968021
Frame ID: 77E091E19343A5558DC05A5A3A6B1AA3
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 427DD22D8A0889EFA759457048063EE5
Requests: 3 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73
Frame ID: 836B414E53F6B6772790A03CCDDEDB48
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1161241209470756643
Frame ID: B1D8D5436C30D9AFAE301C131AACAD88
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Frame ID: E5458984E2892566595487EF9298022A
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6997047065782450315
Frame ID: 7D2B953884338C6123288E6EE98075AF
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
Frame ID: 43DBDFDA6066D67EE1608EF635C24CA1
Requests: 1 HTTP requests in this frame

Frame: https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
Frame ID: 7E9169D294B0F0ABA603BFD8492BCD7D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003
Frame ID: 1EDC536EFC51135F62594CCEC6AD07AE
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=nvDMi3Vzq0XxomMrR7K6XUm0
Frame ID: 6302FA67277229AF6205CC88677F0CB6
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
Frame ID: 9E1BBA6F0C564B936C1F1737DAD0E890
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 3E6E0AB0446007BC38FB4A26255E3F01
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=pszfTlNH7dka&pid=557219
Frame ID: 2394539F7DA98028D43656BAD465FC61
Requests: 1 HTTP requests in this frame

Frame: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Frame ID: 1283702BA0D6532C9B90FF2ADAED4ABC
Requests: 1 HTTP requests in this frame

Frame: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Frame ID: 9246989384E3CCCD5F07A1BC3AF65ABE
Requests: 1 HTTP requests in this frame

Frame: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: F60F88A16AFA27B749E99F7F2F477264
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html
Frame ID: 542A2EB6245923EDC9783A0BAA813C27
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 8B15A28C266B8AA957FE3CB2933E8019
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

373
Requests

100 %
HTTPS

32 %
IPv6

63
Domains

96
Subdomains

65
IPs

12
Countries

2563 kB
Transfer

6034 kB
Size

22
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=%url%&text=%prefix%%text%%suffix%
Title: Tweet

Search URL Search Domain Scan URL

URL: https://www.facebook.com/dialog/share?app_id=1112398375633735&display=popup&quote=%prefix%%text%%suffix%&href=%url%
Title: Share

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=%url%&text=%prefix%%text%%suffix%
Title: Telegram

Search URL Search Domain Scan URL

URL: https://wa.me/?text=%prefix%%text%%suffix%:%20%url%
Title: WhatsApp

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?resubmit=true&url=%url%&title=%title%
Title: Reddit

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 197

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 202

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 220

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthebirthdaybest.com%2F&domain=thebirthdaybest.com&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=QJgLEHx3MjZrRndiTUJNMUU3Sm5kWWRpOXVFR1U3NlJLWUhUQ3pwZk5NVkNpQXd3WjVkWHU4Q2VjWXM0b3QvTUYwbE9jNEYrR0tITlNTU21TWHkvQ3duamVpQUwrMGlGbit4aElOSk9LVWM2dTVGT2dYZmh1dm5BL0FkVVEzSytBcE5KakFsSnpleDMxM2hEQ05hNWZmbDhMR2IrYUVzU2JyaVY2a2JDa1ljZXRJN3pkUFc1SlVkM3RiTGx6Q1Uvd21DWWJIWlJ1bEx6UUNRQ3YwWXBTbHZIbWROUENmVzJYbkRJYTRETVBVelYwOWNzPXw&cppv=2

Request Chain 246

https://a.tribalfusion.com/i.match?p=b6&u=CAESED2_GWW3H3oCmN5fQgfx4pc&google_cver=1&google_push=AYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESED2_GWW3H3oCmN5fQgfx4pc&google_cver=1&google_push=AYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 247

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEFB5YuqvxTXzWYocOjTAJDg&google_cver=1&google_push=AYg5qPL5oBL1HyJxxL3rCOPOs4V7k3OewVujAMyLaC0wVuJfAi4uHn-E52htT3Racy3DBqvb6W7wr-hGtG5XQkLUtChC4dBh0GG7 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL5oBL1HyJxxL3rCOPOs4V7k3OewVujAMyLaC0wVuJfAi4uHn-E52htT3Racy3DBqvb6W7wr-hGtG5XQkLUtChC4dBh0GG7&google_hm=QWsyRUZsSEF5alp2dW9BY1plQ0xXTnc=

Request Chain 248

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEERm1ZOPq976GK3D32htLdA&google_cver=1&google_push=AYg5qPKejzgdYHBwFgTW8r5mmVbIQxNFrwAgD4yuav6rBTVJptBpte39UeMQlMk3jiG_Q-h11tXW0O-jIYBePJbi9LRKNyUikpN3 HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEERm1ZOPq976GK3D32htLdA&google_cver=1&google_push=AYg5qPKejzgdYHBwFgTW8r5mmVbIQxNFrwAgD4yuav6rBTVJptBpte39UeMQlMk3jiG_Q-h11tXW0O-jIYBePJbi9LRKNyUikpN3&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=t_PTb09wTx2def_VaFJiLA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKejzgdYHBwFgTW8r5mmVbIQxNFrwAgD4yuav6rBTVJptBpte39UeMQlMk3jiG_Q-h11tXW0O-jIYBePJbi9LRKNyUikpN3

Request Chain 249

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMimzrruJIE53RcwdVIvWpU&google_cver=1&google_push=AYg5qPJfIWbM9tQwJlPSO2bdfX_5p6WLvmWqTcyDzOHGGWjZI6bqS-SsroCqdKYlWYtyN_jcIQFBTt2bof5Gf4_PO9zw5fc5EUlH HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJfIWbM9tQwJlPSO2bdfX_5p6WLvmWqTcyDzOHGGWjZI6bqS-SsroCqdKYlWYtyN_jcIQFBTt2bof5Gf4_PO9zw5fc5EUlH

Request Chain 252

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH HTTP 302
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH&apid=UPe1aff9fe-fea4-11eb-900e-0284259a852a HTTP 302
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH&apid=UPe1aff9fe-fea4-11eb-900e-0284259a852a&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlMWFmZjlmZS1mZWE0LTExZWItOTAwZS0wMjg0MjU5YTg1MmE%3D&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH

Request Chain 276

https://ad.doubleclick.net/ddm/trackimp/N38306.140903ZANOX.COMDE/B22845801.273544483;dc_trk_aid=467891017;dc_trk_cid=64219029;ord=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?https%3A%2F%2Fwww.awin1.com%2Fcawshow.php%3Fv=11938&s=2542680&q=367022&r=412871&pv=1&pref3=oneid4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1Eoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N38306.140903ZANOX.COMDE/B22845801.273544483;dc_pre=CPLb7PHqtfICFQYHiwodjp4MJw;dc_trk_aid=467891017;dc_trk_cid=64219029;ord=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?https%3A%2F%2Fwww.awin1.com%2Fcawshow.php%3Fv=11938&s=2542680&q=367022&r=412871&pv=1&pref3=oneid4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1Eoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
https://www.awin1.com/cawshow.php?v=11938&s=2542680&q=367022&r=412871&pv=1&pref3=oneid4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1Eoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
https://banner.congstar.de/cookie/?sp=awin&spfr=412871&awc=11938_412871_1629126968_e1d9efa0-fea4-11eb-9a09-692d00d40ca2

Request Chain 303

https://gum.criteo.com/sid/json?origin=publishertag&domain=thebirthdaybest.com&sn=ChromeSyncframe&so=0&topUrl=thebirthdaybest.com&cw=1 HTTP 302
https://mug.criteo.com/sid?cpp=yDx4lXxXRTl6QjBZQjBGOW5oSmwyQ0lWUURZTlZNci93RHBLVUNNWGNVUWR0ZWJsVTFHM3h0a2IweTNXTU9SeW12a29ienBMSVczS1RGa0JuZFR2T2kxc2UyY3RBUnlldktvTUJqT0JrTkhnQ25Ud3lyZ05md0hNNGdiNW5tODVyR2grUlZWRXhwZ1JvZEtGVGFudUExZGlDbmZIK213dGtlZ3Ewb2ZUZGM0WUVHU2lIRDFSa0ZHQTE1dHF4cW1TbHpxNHlCNkpvQjJBY3UxMU5EWnJDYmcrb0ZPa2E3Si9qZDVPYnlQNW1JSk5PTmFKclhjZVh6czlrdG5wR0x1UmtXVHVJVEtVL2tlUHF3bUJDaDRuVGx0MkQ0UT09fA&cppv=2

Request Chain 309

https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Request Chain 310

https://ib.adnxs.com/async_usersync?cbfn=queuePixels HTTP 307
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Request Chain 312

https://c1.adform.net/serving/cookie/match?party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73

Request Chain 313

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1161241209470756643

Request Chain 314

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

Request Chain 315

https://dsp.adfarm1.adition.com/cookie/?ssp=9 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6997047065782450315

Request Chain 316

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCTWRFN0NOUUlBQUNFYUpMbDVmZw&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Request Chain 318

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5050582433 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5050582433 HTTP 302
https://sync.1rx.io/usersync/tradedesk/026de713-7954-4bf6-932d-4c169e7c9b16 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003

Request Chain 319

https://green.erne.co/pubmatic/cm HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=nvDMi3Vzq0XxomMrR7K6XUm0

Request Chain 321

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}

Request Chain 322

https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%% HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=pszfTlNH7dka&pid=557219

Request Chain 324

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID HTTP 302
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0

Request Chain 325

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Mque2QNnQEexC7jDfFJNcw%3D%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Mque2QNnQEexC7jDfFJNcw%3D%3D&google_tc= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 326

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1b2a611a-813a-4200-9588-01eb38e8db69

Request Chain 327

https://pixel.onaudience.com/?partner=214&mapped=32AB9ED9-0367-4047-B10B-B8C37C524D73 HTTP 302
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D HTTP 302
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=a882b54667c3aee6a83dd19981a7fd41 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1 HTTP 302
https://pixel.onaudience.com/?partner=147&mapped=026de713-7954-4bf6-932d-4c169e7c9b16&icm HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25 HTTP 302
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1 HTTP 302
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=36719a81cc31a89526d0c209f2fedd75

Request Chain 328

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzJBQjlFRDktMDM2Ny00MDQ3LUIxMEItQjhDMzdDNTI0RDcz&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzJBQjlFRDktMDM2Ny00MDQ3LUIxMEItQjhDMzdDNTI0RDcz&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 329

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO7qhtYija0XAqyA9GIKkD0&google_cver=1

Request Chain 331

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4382504918052637665

Request Chain 332

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e26a611a-813b-4900-8eff-a53732e214f0&gdpr=0&gdpr_consent=

Request Chain 333

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=026de713-7954-4bf6-932d-4c169e7c9b16

Request Chain 334

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7604873109588400523&gdpr=0&gdpr_consent=

Request Chain 336

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=32AB9ED9-0367-4047-B10B-B8C37C524D73&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=32AB9ED9-0367-4047-B10B-B8C37C524D73&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5WML.8RE2uU7p5SLb1qrOOfa6oXLklM-~A&gdpr=0&gdpr_consent=

Request Chain 337

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI

Request Chain 338

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic HTTP 307
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic HTTP 302
https://x.bidswitch.net/sync?dsp_id=59&user_id=e463f93f-ce6c-436d-ac31-b2bda777518e&ssp=pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c429e33f-a79a-460e-a3a6-e6f7ba962817&gdpr=&gdpr_consent=&gdpr_pd=

Request Chain 339

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&_test=YRqBPAADoL250gAC HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YRqBPAADoL250gAC&gdpr=0&gdpr_consent=&_test=YRqBPAADoL250gAC

Request Chain 340

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3736374374794588885&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 342

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:756bcf45-8bfb-4051-8e41-0d0362ceaf4d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

Request Chain 343

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=

Request Chain 344

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7604873109588400523

Request Chain 345

https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4f9fbf2b-e6d7-4f33-83fb-06db7938f223

Request Chain 364

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

373 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
thebirthdaybest.com/ 372 KB
63 KB 244ms
191ms Document
text/html 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a726199a71923c42f93af1ecbc5c68c36d9f059e9122df74bf42a2a1f2e7bf17

Request headers

:method: GET
:authority: thebirthdaybest.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control: max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 16 Aug 2021 15:16:01 GMT
display: pub_site_sol
expires: Sun, 15 Aug 2021 15:16:01 GMT
link: <https://thebirthdaybest.com/wp-json/>; rel="https://api.w.org/"
pagespeed: off
response: 200
server: nginx
set-cookie: ezoadgid_185419=-1; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 15:46:00 UTC ezoref_185419=; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 17:16:00 UTC ezoab_185419=mod12; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 17:16:00 UTC active_template::185419=pub_site.1629126960; Path=/; Domain=thebirthdaybest.com; Expires=Wed, 18 Aug 2021 15:16:00 UTC ezopvc_185419=1; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 15:46:01 UTC ezepvv=0; Path=/; Domain=thebirthdaybest.com; Expires=Tue, 17 Aug 2021 15:16:01 UTC ezovid_185419=926060370; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 15:46:01 UTC lp_185419=https://thebirthdaybest.com/; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 15:46:01 UTC ezovuuidtime_185419=1629126961; Path=/; Domain=thebirthdaybest.com; Expires=Wed, 18 Aug 2021 15:16:01 UTC ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; Path=/; Domain=thebirthdaybest.com; Expires=Mon, 16 Aug 2021 15:46:01 UTC ezCMPCCS=true; Path=/; Domain=thebirthdaybest.com; Expires=Tue, 16 Aug 2022 15:16:01 GMT
vary: Accept-Encoding Accept-Encoding,User-Agent
x-ez-minify-html: 6.12% 380991 / 405833
x-ezoic-cdn: Hit ds;mm;b27cad3832b22249b6bf0387fe502047;2-185419-22;63931f08-fff8-4169-4598-1ba19226e3ec
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-sol: pub_site

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 72 KB
25 KB 43ms
18ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

sffe /

Resource Hash

eaea61820092665c1a2bd21110eee0a777ef2c7d6048b39646e7680540cc7cea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "960 / 594 of 1000 / last-modified: 1629112347"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25233
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:01 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 281 KB
87 KB 62ms
38ms Script
application/javascript 2606:4700:3036::ac43:a1d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:a1d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eceb3544d41694df2c09dd939e55bc742e2a2a1e50bdc82f1b8ec6be84143d78

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 23 Jul 2021 22:04:40 GMT
server: cloudflare
age: 2049081
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qmKsiydXsutcPzyIwfyuo%2F%2BDjkFSmL2gDKKL%2BySpv%2FEgofLf%2FBs39Ff%2BcNPPUQqtBAELPL8SCMb2aKDfEQKaeeuUPfZwmhPF2un17a0wlt%2F%2BlGzNgzzaHcloGsPaBQX5GtkvMMcH5pB%2Bxdc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 67fb9f1319ccbf00-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 74ms
16ms Script
application/javascript 65.9.79.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.79.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:10:32 GMT
content-encoding: gzip
server: Server
age: 329
etag: f8520ea4ebd91256d6b4f461d472242a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: cdBhoWYDE8U.miXtMaq72_QdUztpgDZw
x-amz-cf-id: UIB5Jlyk1PrZYPvq3yj-ezri_zPiGWTdFWV6z7SRx3oo_ggkfJDrtA==

GET
H2 200 cowork.jpg
thebirthdaybest.com/ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/07/ 7 KB
8 KB 71ms
69ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/07/cowork.jpg?ezimgfmt=ng%3Awebp%2Fngcb8%2Frs%3Adevice%2Frscb8-1&resize=300%2C160&ssl=1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 04a315ffd43347fe61b369379c000169016ebfcde5f10fc661bbea51906f7306

Request headers

:path: /ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/07/cowork.jpg?ezimgfmt=ng%3Awebp%2Fngcb8%2Frs%3Adevice%2Frscb8-1&resize=300%2C160&ssl=1
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: f904f28c-42ac-4eda-85a9-f6812edfa3c2
x-ezoic-cdn: Hit ds;ds;7c029230071c99b1f45be10eb91a29a0;2-185419-22;af915990-c1f8-425b-7b27-52846865fc7e
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DJBdgF1AIAMF9ig=
response: 200
server: nginx
x-amzn-trace-id: Root=1-61004923-476dc46668ab5c1b5c178244;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 2bbba694ff55d664208103e9c25dce14.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: KV74kdbMtG_E6H9i-oSQxv7o3Qn4gvhXR9R4ernEARRaHF8-RIKNBQ==

GET
H2 200 40th-women-bday-gift.jpg
thebirthdaybest.com/ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/ 6 KB
7 KB 212ms
211ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/40th-women-bday-gift.jpg?ezimgfmt=ng%3Awebp%2Fngcb8%2Frs%3Adevice%2Frscb8-1&resize=300%2C160&ssl=1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d69439261429c76c1f7643d3437d6cbfa7b0f7a8148e55d1bcdf0fddc89c51e7

Request headers

:path: /ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/40th-women-bday-gift.jpg?ezimgfmt=ng%3Awebp%2Fngcb8%2Frs%3Adevice%2Frscb8-1&resize=300%2C160&ssl=1
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: 1e0cce70-158d-4f2a-a180-5d17802520d0
x-ezoic-cdn: Hit ds;ds;7fa4493d4e53f4b7e88f6cc164ece68d;2-185419-22;271b587c-45b5-478b-485a-cb11b50a2e3b
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DJBdgEp5oAMFeDQ=
response: 200
server: nginx
x-amzn-trace-id: Root=1-61004923-7b4c038944c3872651962cbb;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: TZBYFwZNnyWtvc23bqSCgEwyrfYrt5vhYhCQd1Iizdw4BL0dbaHqKQ==

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 14 Aug 2021 02:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 219732
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 14 Aug 2022 02:13:49 GMT

GET
H2 200 style.min.css
c0.wp.com/c/5.4.6/wp-includes/css/dist/block-library/ 52 KB
7 KB 42ms
14ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.6/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Fri, 24 Apr 2020 15:32:14 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Tue, 16 Aug 2022 15:16:01 GMT

GET
H2 200 animate.min.css
thebirthdaybest.com/wp-content/plugins/cool-image-share/inc/ 202 B
240 B 76ms
73ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/cool-image-share/inc/animate.min.css?ver=5.4.6&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e74d690c55c4d97d5a5d5fe50352ba1c78651037684fb59c6acba97ea98c99cb

Request headers

:path: /wp-content/plugins/cool-image-share/inc/animate.min.css?ver=5.4.6&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "ce35-5c462a9935977-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;483693f5cd967105d7a4891d7b5daf8a;2-185419-22;e4fe4fba-e4bb-4447-6302-71568f653c1f
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 91

GET
H2 200 jquery-ui.css
thebirthdaybest.com/wp-content/plugins/faq-schema-for-pages-and-posts//css/ 1 KB
425 B 57ms
54ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/faq-schema-for-pages-and-posts//css/jquery-ui.css?ver=2.0.0&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5b26ee86153154b851ce4b3cd06aad16600d75dad7df3e8fd346a07c22bffc0d

Request headers

:path: /wp-content/plugins/faq-schema-for-pages-and-posts//css/jquery-ui.css?ver=2.0.0&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "4995-5c462a990c2a6-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;23bbe0d1c5eedbdd9f7bf87ab8a821b9;2-185419-22;9a48ac3c-9c42-407d-737b-8b9383afb6a1
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 294

GET
H2 200 style.min.css
thebirthdaybest.com/wp-content/plugins/mememe/css/ 19 KB
4 KB 52ms
49ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/mememe/css/style.min.css?ver=1.8.9&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2d723f58b0fb857b7d0ecb2679a1f5a015a63f61b6e1aeb585538da8e91e8f4f

Request headers

:path: /wp-content/plugins/mememe/css/style.min.css?ver=1.8.9&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "8f93-5c462a8089ad9-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;2ff122184178c630e176f663b9adbf0f;2-185419-22;c697dbfa-0711-493d-7a80-55285e60b90f
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 3703

GET
H2 200 style.min.css
thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/ 396 B
289 B 48ms
45ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a1a54f027b2f546b2ebe3cee0298f519e32124f3d8462b3525d8208caa7c44f3

Request headers

:path: /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "1b6-5c462a94dc44f-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;b82d219962ea7e857044888800a14306;2-185419-22;dbe1d3a7-521d-4cfe-6421-423884103385
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 158

GET
H2 200 screen.min.css
thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/assets/css/ 4 KB
1 KB 114ms
112ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a7070d8f512699929458dd165b0e21205696f9eed9b6577380753be156b85bbd

Request headers

:path: /wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "13ef-5c462a94bcb47-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;e935da673fc4557fcf8ffea250acac78;2-185419-22;03978ff0-8f9e-42e0-447f-3ba8e3214d4d
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 1136

GET
H2 200 bootstrap.min.css
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/vendor/ 148 B
217 B 74ms
71ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/vendor/bootstrap.min.css?ver=3.3.2&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a8cb93ebf2fd2978b6cc72dae22948c5709b1c2c4ea4463c1bb2ad8353e194b5

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/vendor/bootstrap.min.css?ver=3.3.2&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "113b-5c462a82cebbd-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;0912a2564066317cf242058934a127bf;2-185419-22;6cb9660f-6981-4a53-70c7-9cb9272476f7
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 75

GET
H2 200 popovers.css
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/ 0
116 B 45ms
41ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/popovers.css?ver=4.0.13&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/popovers.css?ver=4.0.13&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "25c-5c462a82b6384-gzip"
x-ezoic-cdn: Hit ds;mm;8675e71a7dc9635057d46b5025548bf4;2-185419-22;39e90fd3-b9ab-4cdd-4301-c36c4fc42677
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 0

GET
H2 200 css
fonts.googleapis.com/ 23 KB
1 KB 18ms
15ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Roboto+Condensed:300,300italic,400,400italic,700,700italic&display=optional

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00c8824ecd4185f6acd8847bcc1fdd8d860e57f4ad34e6fb1ad064ec892c85be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:16:01 GMT
server: ESF
date: Mon, 16 Aug 2021 15:16:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Aug 2021 15:16:01 GMT

GET
H2 200 highlight-and-share-emails.css
thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/ 56 B
254 B 39ms
36ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/highlight-and-share-emails.css?ver=3.5.5&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 80e06a90757503a0f1f6c5ae3082f17b00bdb1f4bff5d92a65f0bb40afc5be53

Request headers

:path: /wp-content/plugins/highlight-and-share/css/highlight-and-share-emails.css?ver=3.5.5&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "8eb-5c52d80ee8659-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;f2838e22e73bacc99442a9a16a78b1ef;2-185419-22;15b0f2fd-b6c4-4c43-495a-81f58cd62cd9
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 40

GET
H2 200 highlight-and-share.css
thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/ 2 KB
558 B 62ms
60ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/highlight-and-share.css?ver=3.5.5&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9ab4e83b12ee7a3c4af979efc4d5b78b70f320bb94a8f3cb91b699c539baaf80

Request headers

:path: /wp-content/plugins/highlight-and-share/css/highlight-and-share.css?ver=3.5.5&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "bc2-5c52d80ee5f18-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;f10ce9f3d157344a4a4aec788a7379bd;2-185419-22;b289e80e-0fc3-4572-6455-5911074f9cc1
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 428

GET
H2 200 style.css
thebirthdaybest.com/wp-content/themes/Newsmag/ 50 KB
9 KB 97ms
94ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/themes/Newsmag/style.css?ff=1&ver=4.9.1&wps=true&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 671855b8fadca442d443112b8ccc8c5f97081ca7f9395f711987d8fd38e71bf6

Request headers

:path: /wp-content/themes/Newsmag/style.css?ff=1&ver=4.9.1&wps=true&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "246b1-5c462a9d1c31a-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;28a73ec9aaac252f8fa1300a6f00f4d3;2-185419-22;82d623a2-4d7e-4ced-5a8c-d7b302adc7a4
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig

GET
H2 200 banger.js Show response
thebirthdaybest.com/porpoiseant/ 43 KB
10 KB 28ms
27ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/banger.js?cb=195-0&bv=58&v=51&PageSpeed=off
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 8b081f7838da97c5394ca9e269c192f5c82c420769eac547917d4ff739032abf

Request headers

:path: /porpoiseant/banger.js?cb=195-0&bv=58&v=51&PageSpeed=off
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 td_legacy_main.css
thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/css/ 236 KB
25 KB 107ms
106ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/css/td_legacy_main.css?ff=1&ver=f778b80ab85431daf83e3194bb71bc89&wps=true&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a811cdd3cc104921de89ce0729e2e22424166e328babe3d63929a11ba1114dce

Request headers

:path: /wp-content/plugins/td-composer/legacy/Newsmag/assets/css/td_legacy_main.css?ff=1&ver=f778b80ab85431daf83e3194bb71bc89&wps=true&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "9133c-5c462a7b4d2e2-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;d2c08392dd7f22f5dda3e5c3f773f7ee;2-185419-22;dbbe462c-b9d1-48ad-56c0-9f86a6cf480f
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/9.1.1/css/ 75 KB
13 KB 13ms
12ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/9.1.1/css/jetpack.css

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

7772a9cc35fc902c0cccb8871670ec3e45e4695e1bc6941aee1c24db3de8c544

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Tue, 25 Aug 2020 15:45:57 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Tue, 16 Aug 2022 15:16:01 GMT

GET
H2 200 jquery.js Show response
c0.wp.com/c/5.4.6/wp-includes/js/jquery/ 95 KB
32 KB 13ms
10ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.6/wp-includes/js/jquery/jquery.js

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Fri, 17 May 2019 04:25:54 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Tue, 16 Aug 2022 15:16:01 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.4.6/wp-includes/js/jquery/ 10 KB
4 KB 13ms
13ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.6/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Tue, 16 Aug 2022 15:16:01 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 100 KB
40 KB 54ms
33ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-148153416-1

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f2c17a862f3be5d23186e72de051a7967ba6caf173b0a1d950fd904c67985e3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40938
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 16 Aug 2021 15:16:01 GMT

GET
H2 200 iconmememe.woff
thebirthdaybest.com/wp-content/plugins/mememe/fonts/ 7 KB
4 KB 35ms
33ms Font
font/woff 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/mememe/fonts/iconmememe.woff?iec4tb
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ed326683716e2ba42e83422611872e492783e5b610a086858518416c64ee66f1

Request headers

sec-fetch-mode: cors
origin: https://thebirthdaybest.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
:path: /wp-content/plugins/mememe/fonts/iconmememe.woff?iec4tb
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;a76748b9327485d859af546c00ed7e0e;2-185419-22;9027f6d6-437b-41ca-7950-b45abfc682a4
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "1a6c-5c462a7e3ab79-gzip"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000

GET
H2 200 newsmag.woff
cdn-0.thebirthdaybest.com/wp-content/themes/Newsmag/images/icons/ 18 KB
19 KB 60ms
15ms Font
font/woff 2606:4700:3031::6815:160b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.thebirthdaybest.com/wp-content/themes/Newsmag/images/icons/newsmag.woff?12
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:160b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a1892cc92f36f93d02f1f8fe25b9c6f9fe025ad7c6f596189bc0f00ad7ffa575

Request headers

Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1779545
x-ezoic-cdn: Hit ds;mm;1f4e8b4ec8d1854aac15b43c5594392c;2-185419-22;e3c40073-4dd4-44ea-4fdb-20fde2ac6e9d
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: cloudflare
etag: W/"48c4-5c462a9d06477-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OVYUeBMhZe8mIW36wAkERMwcYuT0Dbgo%2Bstkq8D8mhmo0TFDKqCmKGoMXOd63BoiwTVWFLmp27hasQeED6QwFeXEaVi%2BZAQa2HwpVAtorW8JWUVIempiIe1h0l%2BnMYATJ77YVbRTuNSWFPNgKthkXJDiD08EKOuY"}],"group":"cf-nel","max_age":604800}
cf-ray: 67fb9f13580a1f55-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 ez-toc-icomoon.woff2
thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/fonts/ 580 B
713 B 34ms
32ms Font
font/woff2 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/fonts/ez-toc-icomoon.woff2
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9a5d04f74cf2a5ac395114c141150def9ea2ec79fa5b06febc02cb396d2c88f7

Request headers

sec-fetch-mode: cors
origin: https://thebirthdaybest.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
:path: /wp-content/plugins/easy-table-of-contents/vendor/icomoon/fonts/ez-toc-icomoon.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;64da849e17c5b17ac55ca36764cb321f;2-185419-22;5733245e-face-46ff-70b2-6ac44db1e1f1
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 575
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "244-5c462a94d9d8c-gzip"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff2
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000

GET
H2 200 weather.woff
thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/images/icons/ 5 KB
3 KB 27ms
26ms Font
font/woff 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/images/icons/weather.woff?1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e44f709face9013da1e9679c6b316b4b59280bdcba01ad65c1e87bf4bd889e35

Request headers

sec-fetch-mode: cors
origin: https://thebirthdaybest.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
:path: /wp-content/plugins/td-composer/legacy/Newsmag/assets/images/icons/weather.woff?1
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;df3d7be83223264f8078116bbd2ea9ed;2-185419-22;1a167aeb-097a-4e29-5194-2b097ef02d1e
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 3002
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "12bc-5c462a7a1c1c2-gzip"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000

GET
H2 200 iconmememe.woff
cdn-0.thebirthdaybest.com/wp-content/plugins/mememe/fonts/ 7 KB
7 KB 60ms
15ms Font
font/woff 2606:4700:3031::6815:160b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.thebirthdaybest.com/wp-content/plugins/mememe/fonts/iconmememe.woff?iec4tb
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:160b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed326683716e2ba42e83422611872e492783e5b610a086858518416c64ee66f1

Request headers

Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1779545
x-ezoic-cdn: Hit ds;mm;a76748b9327485d859af546c00ed7e0e;2-185419-22;5aca1933-fc7b-456b-564c-4cc4f94ac6bd
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: cloudflare
etag: W/"1a6c-5c462a7e3ab79-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f08zgpdBfVi45pNX8mVEeC5ltk1v44%2B4ygpDo9x%2FfFvG2twr0d9TNP6ujYbMNS5tUKUSI7J%2BPm3J3ED09STmAveewrBX0h3Uo%2BcukIgY%2BGqpGBPMTCs7MA08aDRZYjdO%2B852q3rPcU2ELyOHKbfXSXdRW0Uz9Oec"}],"group":"cf-nel","max_age":604800}
cf-ray: 67fb9f13580e1f55-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 ez-toc-icomoon.woff2
cdn-0.thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/fonts/ 580 B
991 B 60ms
16ms Font
font/woff2 2606:4700:3031::6815:160b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/fonts/ez-toc-icomoon.woff2
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:160b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a5d04f74cf2a5ac395114c141150def9ea2ec79fa5b06febc02cb396d2c88f7

Request headers

Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1779545
x-ezoic-cdn: Hit ds;mm;64da849e17c5b17ac55ca36764cb321f;2-185419-22;64d4bb73-bbf5-4ac9-5ad4-a4734502cb7d
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 580
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: cloudflare
etag: "244-5c462a94d9d8c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff2
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ECc%2BT%2Fn6bJwGeq47IEc1b4qdpxWCy09VQHOQaiyJxH%2FUv20UdW4VfVAxRPDDmavcxQFpEq86Ki5e2xLp%2Bj7VxxVabn%2FS5XeHDr9maWAgq3422i%2FRfUkP7w79NzWkWivUqaCo2GHqxgAc8ewpRADpQlnrkM8xqs7f"}],"group":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 67fb9f1358101f55-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 newsmag.woff
thebirthdaybest.com/wp-content/themes/Newsmag/images/icons/ 18 KB
12 KB 32ms
31ms Font
font/woff 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/themes/Newsmag/images/icons/newsmag.woff?12
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a1892cc92f36f93d02f1f8fe25b9c6f9fe025ad7c6f596189bc0f00ad7ffa575

Request headers

sec-fetch-mode: cors
origin: https://thebirthdaybest.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
:path: /wp-content/themes/Newsmag/images/icons/newsmag.woff?12
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;1f4e8b4ec8d1854aac15b43c5594392c;2-185419-22;3cdbc865-0ac5-4e8c-6b21-5e0102fcc600
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "48c4-5c462a9d06477-gzip"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000

GET
H2 200 weather.woff
cdn-0.thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/images/icons/ 5 KB
5 KB 64ms
20ms Font
font/woff 2606:4700:3031::6815:160b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/images/icons/weather.woff?1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:160b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e44f709face9013da1e9679c6b316b4b59280bdcba01ad65c1e87bf4bd889e35

Request headers

Origin: https://thebirthdaybest.com
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1779545
x-ezoic-cdn: Hit ds;mm;df3d7be83223264f8078116bbd2ea9ed;2-185419-22;b16f127f-0586-411a-4d45-e571d8338cde
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: cloudflare
etag: W/"12bc-5c462a7a1c1c2-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff
access-control-allow-origin: https://thebirthdaybest.com
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n2hCdTXqf8Too3HHsawTo3kfWS7d1S77kw4yP54WUcjTLB0%2FxCSWZOZQduaeDJJw3q2LiEmm3ASiQrSJOdz4LWa1Uyg9okRCgnjqhFzqH7L8TzqE8g1sfnf85hRGwpxlMYZ87r6efxfw2svcwIA6hu3lTQjJdQRM"}],"group":"cf-nel","max_age":604800}
cf-ray: 67fb9f13580f1f55-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 ntfc.php Show response
dibsemey.com/ 15 KB
6 KB 54ms
13ms Script
application/javascript 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dibsemey.com/ntfc.php?p=3606779
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: aa7b6d5b770a73bfa79bb530f6549221a559d0e366daa55005255ec66ae752db

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:15:57 GMT
content-encoding: gzip
last-modified: Tue, 10 Aug 2021 13:13:52 GMT
server: nginx
etag: W/"61127b90-3b23"
content-type: application/javascript
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 tagdiv_theme.min.js Show response
thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/js/ 217 KB
47 KB 68ms
68ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/js/tagdiv_theme.min.js?ver=4.9.1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3e47a87d677cee8a33f85a2936354180f9a8e1998617620fb451f1b193d99e34

Request headers

:path: /wp-content/plugins/td-composer/legacy/Newsmag/js/tagdiv_theme.min.js?ver=4.9.1
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "366ee-5c462a7d5a2b6-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;27320148eceef2f87d6565bb95c6fb9e;2-185419-22;db3710cc-d4b0-4def-794a-bfeda78e0128
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 0.24% 222415 / 222958
x-middleton-response: 200

GET
H2 200 ezosuigeneris.js Show response
g.ezoic.net/ 555 B
556 B 64ms
23ms Script
text/javascript 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigeneris.js
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 4728d31a22bf0eb55d9bf50914ffc77f1c7faa27bcb509ec145a02e1d3a815d7

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: 5bbfe5ac401baa4b80b47fcbbfa92322
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cache-control: max-age=999999, private
content-length: 275
expires: Mon, 29 Apr 2020 21:44:55 GMT

GET
H2 200 cmbv2.js Show response
thebirthdaybest.com/detroitchicago/ 87 KB
25 KB 38ms
37ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f3f9d280476e08f41614dfe83939d905c8a63d2e86424f314041916338d174cd

Request headers

:path: /detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 51cd13239548a01c1be4d1fcd258e4f5b37714116e41f4f31360bc8dd75552b3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v23/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Roboto+Condensed:300,300italic,400,400italic,700,700italic&display=optional

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://thebirthdaybest.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 00:29:56 GMT
x-content-type-options: nosniff
age: 571565
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15112
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:34 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 00:29:56 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v23/ 14 KB
14 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Roboto+Condensed:300,300italic,400,400italic,700,700italic&display=optional

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://thebirthdaybest.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 00:29:56 GMT
x-content-type-options: nosniff
age: 571565
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:25 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 00:29:56 GMT

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56ce1789c91a6c4dcb67e7eee6ba0e935c416307a9ca43f1fdc43eadd3f73318

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v23/ 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Roboto+Condensed:300,300italic,400,400italic,700,700italic&display=optional

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://thebirthdaybest.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 00:29:56 GMT
x-content-type-options: nosniff
age: 571565
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14956
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:40 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 00:29:56 GMT

GET
H3-29 200 pubads_impl_2021081001.js Show response
securepubads.g.doubleclick.net/gpt/ 329 KB
115 KB 52ms
23ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

sffe /

Resource Hash

79cc39ab51de99510d98e22dfc56bd456b3ffbb29671e3d2e61719ee50792565

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Aug 2021 08:39:05 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117457
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:01 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 103 B
112 B 45ms
18ms XHR
application/json 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

d928cf17dbe2e8386eb5aaea21667a4e255118f3c59047289e114e92711a8de5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:01 GMT

GET
H2 200 imp.gif Show response
thebirthdaybest.com/detroitchicago/ 43 B
128 B 111ms
110ms XHR
image/gif 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A1%2C%22ad_location_ids%22%3A%226%2C5%2C1%2C2%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A4%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A5%2C%22city%22%3A%22Berlin%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A3%2C%22domain_id%22%3A185419%2C%22domain_test_group%22%3A20210303%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A2%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22274%22%2C%22iab_category_1%22%3A%22279%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221006%2C1100%2C1106%2C1120%2C1129%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%2219d192e6-efad-4891-5c07-888cb2232f2c%22%2C%22position_selection_id%22%3A41%2C%22postal_code%22%3A%2210178%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A301752%2C%22response_time_orig%22%3A7%2C%22serverid%22%3A%223.120.14.212%3A23239%22%2C%22state%22%3A%22BE%22%2C%22sub_page_ad_positions%22%3A%221006%2C1100%2C1106%2C1120%2C1129%22%2C%22t_epoch%22%3A1629126960%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fthebirthdaybest.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A1677%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A1%2C%22ad_location_ids%22%3A%226%2C5%2C1%2C2%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A4%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A5%2C%22city%22%3A%22Berlin%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A3%2C%22domain_id%22%3A185419%2C%22domain_test_group%22%3A20210303%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A2%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22274%22%2C%22iab_category_1%22%3A%22279%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221006%2C1100%2C1106%2C1120%2C1129%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%2219d192e6-efad-4891-5c07-888cb2232f2c%22%2C%22position_selection_id%22%3A41%2C%22postal_code%22%3A%2210178%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A301752%2C%22response_time_orig%22%3A7%2C%22serverid%22%3A%223.120.14.212%3A23239%22%2C%22state%22%3A%22BE%22%2C%22sub_page_ad_positions%22%3A%221006%2C1100%2C1106%2C1120%2C1129%22%2C%22t_epoch%22%3A1629126960%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fthebirthdaybest.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A1677%2C%22worst_bad_word_level%22%3A0%7D
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 47

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 26ms
9ms Script
application/javascript 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: gzip
etag: "lp772EpWKwf8Kq7YKMhbuw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Mon, 23 Aug 2021 15:16:01 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 greenoaks.gif Show response
thebirthdaybest.com/detroitchicago/ 0
104 B 16ms
14ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDgtMTYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6IjViYmZlNWFjNDAxYmFhNGI4MGI0N2ZjYmJmYTkyMzIyIn1dfV0=
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDgtMTYifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNyJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6IjViYmZlNWFjNDAxYmFhNGI4MGI0N2ZjYmJmYTkyMzIyIn1dfV0=
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:15:56 UTC

GET
H2 200 ezosuigenerisc.js Show response
g.ezoic.net/ 0
54 B 28ms
28ms Script
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigenerisc.js?nogen=1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
cache-control: max-age=300, private
server: nginx
content-length: 0
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H2 200 cmbdv2.js Show response
thebirthdaybest.com/detroitchicago/ 46 KB
10 KB 32ms
32ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/cmbdv2.js?gcb=195-0&cb=03-4y0c-5y18-3y34-15y57-21&cmbcb=20&sj=x03x0cx18x34x57&abt=PositionCalculator
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b7a6b79b5a02d64e0adf826fc34e94e60985e497ec956aa4fe834cf48ace2520

Request headers

:path: /detroitchicago/cmbdv2.js?gcb=195-0&cb=03-4y0c-5y18-3y34-15y57-21&cmbcb=20&sj=x03x0cx18x34x57&abt=PositionCalculator
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
305 B 135ms
135ms XHR
text/plain 65.9.79.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthebirthdaybest.com%2F&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.79.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
via: 1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: AMS1-C1
x-cache: Miss from cloudfront
access-control-allow-origin: https://thebirthdaybest.com
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-id: YUMmlF2PHoUgg4AFjBshkMRtJTJug9SmB6LrCUmBjDEzZ19CkPvgJQ==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
372 B 75ms
74ms XHR
text/javascript 65.9.79.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthebirthdaybest.com%2F&pid=96Xxht6ybIQTf&cb=0&ws=1600x1200&v=7.67.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2C21972349194%2Fthebirthdaybest_com-medrectangle-2%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22250x250%22%5D%2C%22sn%22%3A%22%2F1254144%2C21972349194%2Fthebirthdaybest_com-box-2%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2C21972349194%2Fthebirthdaybest_com-box-3%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2C21972349194%2Fthebirthdaybest_com-medrectangle-1%22%7D%5D&cfgv=0&schain=1.0%2C1!ezoic.ai%2C7a1f2bdd293915916bf73b4e22cb3bfb%2C1%2C%2C%2C&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.79.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
via: 1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: AMS1-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: DvHpR7kJwbEnZ0h4zXzncM2LnWlr3qiURC6sVKudn7P0dHlGwk2YyA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 50ms
15ms XHR
application/javascript 65.9.79.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.79.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: UwMoja_wiYmXZ_L.v58hX8_8XzeYFzV9
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 8422
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Thu, 01 Jul 2021 22:05:10 GMT
server: AmazonS3
date: Mon, 16 Aug 2021 12:55:40 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 362b298821815168614ba932732916eb.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: dWY3y6pcYJijuGogS2wZsQ7ZUnWgr10PycrdimL06nck1Vo9Gk2L7w==

GET
H2 200 zone Show response
dibsemey.com/ 665 B
954 B 16ms
13ms Fetch
application/json 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://dibsemey.com/zone?pub=0&zone_id=3606779&is_mobile=false&domain=thebirthdaybest.com&var=&ymid=&var_3=

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

038bcd3b9fed84d18d5f9c979e559af298921f6cac0d6c826b95aa7bd7c048b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-trace-id: 38c5c5b7298e159d0fe828deebb40486
date: Mon, 16 Aug 2021 15:15:57 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=1
content-type: application/json; charset=utf-8
access-control-allow-origin: https://thebirthdaybest.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 665

GET
H2 200 universal.min.js Show response
dibsemey.com/pfe/current/ 106 KB
38 KB 47ms
19ms Fetch
application/javascript 139.45.197.250
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dibsemey.com/pfe/current/universal.min.js?v=3.1.309
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: 35751fd45cc96fc57e090b12cb1e4be8c29c99c930cc679874c6a9009c64b2f1

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:15:57 GMT
content-encoding: gzip
last-modified: Tue, 10 Aug 2021 13:13:52 GMT
server: nginx
etag: W/"61127b90-1a71b"
content-type: application/javascript
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache
access-control-allow-credentials: true

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 54ms
13ms Image
image/png 2600:9000:2190:4c00:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:4c00:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 10:44:18 GMT
via: 1.1 aa001e3127bb5bd7bbc48bc4fef44b79.cloudfront.net (CloudFront)
x-sol: middleton
age: 275503
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: pU4TQ0OeQBDo1WMcFvJEgt6QNbQvqqAxlZypVIAWbScWPKZ5giuDfw==
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "49d-5bd497273b080-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: ZRH50-C1
display: staticcontent_sol
expires: Fri, 20 Aug 2021 10:44:18 GMT

GET
H2 200 denver.js Show response
thebirthdaybest.com/detroitchicago/ 4 KB
1 KB 72ms
71ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/denver.js?gcb=0&cb=1
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e45818350fb6700935c0dce924d8317b166845c5516bc391a1dbda39203f143a

Request headers

:path: /detroitchicago/denver.js?gcb=0&cb=1
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex
content-length: 1273

GET
H2 200 style.min.css
c0.wp.com/c/5.4.6/wp-includes/css/dist/block-library/ 52 KB
52 KB 17ms
12ms Image
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c0.wp.com/c/5.4.6/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Fri, 24 Apr 2020 15:32:14 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Tue, 16 Aug 2022 15:16:01 GMT

GET
H2 200 animate.min.css
thebirthdaybest.com/wp-content/plugins/cool-image-share/inc/ 202 B
202 B 102ms
96ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/cool-image-share/inc/animate.min.css?ver=5.4.6&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/cool-image-share/inc/animate.min.css?ver=5.4.6&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "ce35-5c462a9935977-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;483693f5cd967105d7a4891d7b5daf8a;2-185419-22;e4fe4fba-e4bb-4447-6302-71568f653c1f
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 91

GET
H2 200 jquery-ui.css
thebirthdaybest.com/wp-content/plugins/faq-schema-for-pages-and-posts//css/ 1 KB
1 KB 64ms
58ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/faq-schema-for-pages-and-posts//css/jquery-ui.css?ver=2.0.0&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/faq-schema-for-pages-and-posts//css/jquery-ui.css?ver=2.0.0&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "4995-5c462a990c2a6-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;23bbe0d1c5eedbdd9f7bf87ab8a821b9;2-185419-22;9a48ac3c-9c42-407d-737b-8b9383afb6a1
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 294

GET
H2 200 style.min.css
thebirthdaybest.com/wp-content/plugins/mememe/css/ 19 KB
19 KB 57ms
51ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/mememe/css/style.min.css?ver=1.8.9&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/mememe/css/style.min.css?ver=1.8.9&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "8f93-5c462a8089ad9-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;2ff122184178c630e176f663b9adbf0f;2-185419-22;c697dbfa-0711-493d-7a80-55285e60b90f
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 3703

GET
H2 200 style.min.css
thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/ 396 B
396 B 35ms
30ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "1b6-5c462a94dc44f-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;b82d219962ea7e857044888800a14306;2-185419-22;dbe1d3a7-521d-4cfe-6421-423884103385
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 158

GET
H2 200 screen.min.css
thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/assets/css/ 4 KB
4 KB 105ms
99ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "13ef-5c462a94bcb47-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;e935da673fc4557fcf8ffea250acac78;2-185419-22;03978ff0-8f9e-42e0-447f-3ba8e3214d4d
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 1136

GET
H2 200 bootstrap.min.css
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/vendor/ 148 B
148 B 42ms
38ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/vendor/bootstrap.min.css?ver=3.3.2&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/vendor/bootstrap.min.css?ver=3.3.2&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "113b-5c462a82cebbd-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;0912a2564066317cf242058934a127bf;2-185419-22;6cb9660f-6981-4a53-70c7-9cb9272476f7
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 75

GET
H2 200 popovers.css
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/ 0
114 B 55ms
50ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/popovers.css?ver=4.0.13&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/popovers.css?ver=4.0.13&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "25c-5c462a82b6384-gzip"
x-ezoic-cdn: Hit ds;mm;8675e71a7dc9635057d46b5025548bf4;2-185419-22;39e90fd3-b9ab-4cdd-4301-c36c4fc42677
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 0

GET
H3-29 200 css
fonts.googleapis.com/ 23 KB
23 KB 33ms
17ms Image
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700|Roboto+Condensed:300,300italic,400,400italic,700,700italic&display=optional

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 15:16:01 GMT
server: ESF
date: Mon, 16 Aug 2021 15:16:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Aug 2021 15:16:01 GMT

GET
H2 200 highlight-and-share-emails.css
thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/ 56 B
56 B 43ms
39ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/highlight-and-share-emails.css?ver=3.5.5&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/highlight-and-share/css/highlight-and-share-emails.css?ver=3.5.5&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "8eb-5c52d80ee8659-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;f2838e22e73bacc99442a9a16a78b1ef;2-185419-22;15b0f2fd-b6c4-4c43-495a-81f58cd62cd9
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 40

GET
H2 200 highlight-and-share.css
thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/ 2 KB
2 KB 78ms
74ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/highlight-and-share/css/highlight-and-share.css?ver=3.5.5&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/highlight-and-share/css/highlight-and-share.css?ver=3.5.5&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "bc2-5c52d80ee5f18-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;f10ce9f3d157344a4a4aec788a7379bd;2-185419-22;b289e80e-0fc3-4572-6455-5911074f9cc1
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig
content-length: 428

GET
H2 200 style.css
thebirthdaybest.com/wp-content/themes/Newsmag/ 50 KB
50 KB 63ms
59ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/themes/Newsmag/style.css?ff=1&ver=4.9.1&wps=true&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/themes/Newsmag/style.css?ff=1&ver=4.9.1&wps=true&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "246b1-5c462a9d1c31a-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;28a73ec9aaac252f8fa1300a6f00f4d3;2-185419-22;82d623a2-4d7e-4ced-5a8c-d7b302adc7a4
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig

GET
H2 200 td_legacy_main.css
thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/css/ 64 KB
64 KB 296ms
292ms Image
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/plugins/td-composer/legacy/Newsmag/assets/css/td_legacy_main.css?ff=1&ver=f778b80ab85431daf83e3194bb71bc89&wps=true&ez_used_css_s=13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/plugins/td-composer/legacy/Newsmag/assets/css/td_legacy_main.css?ff=1&ver=f778b80ab85431daf83e3194bb71bc89&wps=true&ez_used_css_s=13
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, orig_site_sol
etag: "9133c-5c462a7b4d2e2-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;d2c08392dd7f22f5dda3e5c3f773f7ee;2-185419-22;dbbe462c-b9d1-48ad-56c0-9f86a6cf480f
content-type: text/css
x-middleton-display: staticcontent_sol, orig_site_sol
cache-control: public, max-age=31536000
x-middleton-response: 200
x-sol: orig

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/9.1.1/css/ 64 KB
64 KB 15ms
12ms Image
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c0.wp.com/p/jetpack/9.1.1/css/jetpack.css

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Tue, 25 Aug 2020 15:45:57 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Tue, 16 Aug 2022 15:16:01 GMT

GET
H2 200 nmash.js
thebirthdaybest.com/porpoiseant/ 24 KB
6 KB 20ms
19ms Other
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/nmash.js?v=58
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: acbbae3ea8c718877be4d5cc6437e6837d712b847a82b4f0aed2dc10bf9fdb64

Request headers

:path: /porpoiseant/nmash.js?v=58
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
last-modified: Mon, 16 Aug 2021 13:12:28 GMT
server: nginx
etag: "60b1-5c9acf3f5d563;5c701b9c2cf40-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 2-1.png
thebirthdaybest.com/wp-content/uploads/2019/09/ 10 KB
10 KB 26ms
24ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/uploads/2019/09/2-1.png?ezimgfmt=rs:192x90/rscb8/ng:webp/ngcb8
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 14be73a59c95cc79fed0860a4327330b458e3d49598f78960140a8959ea4fbc6

Request headers

:path: /wp-content/uploads/2019/09/2-1.png?ezimgfmt=rs:192x90/rscb8/ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: be3b65a1-831f-414e-8f07-a910b36aaa47
x-ezoic-cdn: Hit ds;mm;5f4bc3b464b9c23bb28f61db12b8ab56;2-185419-22;af29e614-2055-4f9a-718c-c74ae2bc2ff0
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DHP0RHTcoAMFcaA=
response: 200
server: nginx
x-amzn-trace-id: Root=1-60ff934e-22190aec68b122777bb561a2;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 8f20db43ba7579b7216cf908572d5054.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: bqRr671nUAuGPNKVD9G5Ltowx8NK16RimJUV-ztgk9_NlpSh9XbZKg==

GET
H2 200 Artist.jpg
thebirthdaybest.com/ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/ 8 KB
9 KB 85ms
83ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/Artist.jpg?resize=300%2C160&ssl=1&ezimgfmt=ng:webp/ngcb8
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 91d52d83e6b7f1ef97ac9d040e3144b5401e3c8af59b4e5209ec671343c9498f

Request headers

:path: /ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/Artist.jpg?resize=300%2C160&ssl=1&ezimgfmt=ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
age: 1930
x-amzn-requestid: f688178e-da98-4c12-a7d0-cfe066d439f1
x-ezoic-cdn: Hit ds;mm;1a18b227af35c3b7527b8170259e61db;2-185419-22;14d37d82-6da3-44a5-70b2-57536f882767
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DHbWqFRYoAMFZ1A=
display: staticcontent_sol, staticcontent_sol
response: 200
server: nginx
x-amzn-trace-id: Root=1-60ffa5c4-3a38909065524228586f0224;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: NhRNlb_GJ4Ddlo5atnM1CKwzrEQW3QSMstPGynwrZx7vX09SIDzuoQ==

GET
H2 200 Minecraft-Birthday.jpg
thebirthdaybest.com/ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/ 10 KB
10 KB 55ms
54ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/Minecraft-Birthday.jpg?resize=300%2C160&ssl=1&ezimgfmt=ng:webp/ngcb8
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 794d3584db7884efb83cbbf8c103a17ca4651c00c0277c4b8587fe2e953b65f5

Request headers

:path: /ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/Minecraft-Birthday.jpg?resize=300%2C160&ssl=1&ezimgfmt=ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
age: 4048
x-amzn-requestid: 9023e322-3bd4-4946-bc16-f92c157339bc
x-ezoic-cdn: Hit ds;mm;c22d6edcc1ab6da2daa0625f1884e928;2-185419-22;48e78c46-a33f-4e2d-549b-5ed65175b12e
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DHWLtHxlIAMFtxA=
display: staticcontent_sol, staticcontent_sol
response: 200
server: nginx
x-amzn-trace-id: Root=1-60ff9d7d-436c618b50eb81e641bfa106;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: 2ITbtxCU4tWFox62RVk5m0JmmkxdgZ2bKtvYVGoz700JSZtjz4DCpw==

GET
H2 200 List-Lovers.jpg
thebirthdaybest.com/ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/ 6 KB
7 KB 104ms
103ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/List-Lovers.jpg?resize=300%2C160&ssl=1&ezimgfmt=ng:webp/ngcb8
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0e08306377162779d5e840b5ba35b232e2e4a76d0ef2b0f0c0625590300452fd

Request headers

:path: /ezoimgfmt/i2.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/List-Lovers.jpg?resize=300%2C160&ssl=1&ezimgfmt=ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: 87340800-653b-40b7-a82b-3db5b7f25be0
x-ezoic-cdn: Hit ds;mm;301e226813abd4faaeb9cfec5740330d;2-185419-22;42a2b872-d2ad-4a89-71e3-1837a007294c
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DHgEdHuoIAMF69g=
response: 200
server: nginx
x-amzn-trace-id: Root=1-60ffad4f-0419442e46fa079b1e4dd612;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 6e432daa93321d42e8840614082fcdc3.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: AGlYNlJaZx8w7oD78RWaKv6Kts2_DvoAwTp5-cm7pbem0RM14Y66tQ==

GET
H2 200 40th-men-bday-gift.jpg
thebirthdaybest.com/ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/ 6 KB
6 KB 55ms
55ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/40th-men-bday-gift.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ca6a11dda45eda23b30636ac74137ee1b839b417b3b59644ecc8fa59e7af28ee

Request headers

:path: /ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/06/40th-men-bday-gift.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:01 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: a372c363-b2d5-48e7-a8c2-a84b8e5cfe2d
x-ezoic-cdn: Hit ds;mm;92fd9e255ff365e9d9384a4fcaeb0892;2-185419-22;8578d4b3-2de0-4508-5f21-6f1ea478ef06
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DGxouG8XIAMF5QQ=
response: 200
server: nginx
x-amzn-trace-id: Root=1-60ff6304-24b5068746e67a56559fcec8;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 a350f357b825293e306b1b0a2cb490c1.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: Aj6Jq1Yu_MvbNcr4YlgkZ0HGlwDeqmCWjYJjHF2KHl__8pO0LRqvFQ==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-148153416-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 13 Jul 2021 18:24:06 GMT
server: Golfe2
age: 140
date: Mon, 16 Aug 2021 15:13:41 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19672
expires: Mon, 16 Aug 2021 17:13:41 GMT

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
427 B 58ms
13ms Script
application/javascript 2600:9000:2104:8000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:8000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 15 Aug 2021 21:48:44 GMT
via: 1.1 9385401cebb473e4ed1da6c81b927c52.cloudfront.net (CloudFront)
age: 62838
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
x-amz-cf-id: bmfTzVY_UK42zgR5aYtZu0oU13VW64XiRVrd4Mt2qV6NL-BMecfPkg==

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 15ms
15ms XHR
text/plain 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j92&a=1850156580&t=pageview&_s=1&dl=https%3A%2F%2Fthebirthdaybest.com%2F&ul=en-us&de=UTF-8&dt=Best%20Birthday%20Ideas%20%7C%20The%20Birthday%20Best&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=372361081&gjid=1430360666&cid=816691754.1629126962&tid=UA-148153416-1&_gid=1284201477.1629126962&_r=1&gtm=2ou8b0&z=467333173

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=454311923;labels=Domain.thebirthdaybest_com%2CDomainId.185419;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fthebirthdaybest.com%2F;uht=2;fpan=1;fpa=P0-1853437614-1629126961915;pbcn=u;pbc=;ns=0;c...
pixel.quantserve.com/ 35 B
371 B 12ms
11ms Image
image/gif 2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=454311923;labels=Domain.thebirthdaybest_com%2CDomainId.185419;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fthebirthdaybest.com%2F;uht=2;fpan=1;fpa=P0-1853437614-1629126961915;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=thebirthdaybest.com;je=0;sr=1600x1200x24;dst=1;et=1629126961915;tzo=-120;ogl=locale.en_US%2Ctype.website%2Ctitle.Best%20Birthday%20Ideas%20%7C%20The%20Birthday%20Best%2Cdescription.The%20Birthday%20Best%20Provides%20best%20happy%20birthday%20wishes%252C%20birthday%20messages%20%26%20Quote%2Curl.https%3A%2F%2Fthebirthdaybest%252Ecom%2F%2Csite_name.The%20Birthday%20Best

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:01 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
433 B 44ms
15ms XHR
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j92&tid=UA-148153416-1&cid=816691754.1629126962&jid=372361081&gjid=1430360666&_gid=1284201477.1629126962&_u=YEBAAUAAAAAAAC~&z=1987345257

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 16 Aug 2021 15:16:01 GMT
content-type: text/plain
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 12-yr-old-boy.jpg
thebirthdaybest.com/ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/05/ 6 KB
6 KB 190ms
189ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/05/12-yr-old-boy.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a7be4e9fff17af6b9714ec8bd377f2c72e49b7dee4bd192e05e1e7a02927f68c

Request headers

:path: /ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/05/12-yr-old-boy.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _dlt=1; _ga=GA1.2.816691754.1629126962; _gid=GA1.2.1284201477.1629126962; _gat_gtag_UA_148153416_1=1; __qca=P0-1853437614-1629126961915; ezux_lpl_185419=1629126961938|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: b6c1dc40-dc83-4593-9059-0ee41edd6cac
x-ezoic-cdn: Hit ds;ds;b177ed6c57f50b6ac45d43cc3c649f43;2-185419-22;c488bf05-02fd-4cf9-7066-ee4c6cec4be7
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DJGVjGZKoAMFj0g=
response: 200
server: nginx
x-amzn-trace-id: Root=1-610050f0-3370fa413fc2eafe6be012c4;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: -qVgTC7RjAw8yiinhKk_11RW1OXl_C8ggDPf5MjBztvkBXSNGr_6ig==

GET
H2 200 iin-yr-old-boy.jpg
thebirthdaybest.com/ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/05/ 8 KB
8 KB 198ms
197ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/05/iin-yr-old-boy.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1455dde8a2d3f55eed00eeded1966ba0b4e9b3fcacb1324f4f2d1b5788b4c441

Request headers

:path: /ezoimgfmt/i0.wp.com/thebirthdaybest.com/wp-content/uploads/2021/05/iin-yr-old-boy.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _dlt=1; _ga=GA1.2.816691754.1629126962; _gid=GA1.2.1284201477.1629126962; _gat_gtag_UA_148153416_1=1; __qca=P0-1853437614-1629126961915; ezux_lpl_185419=1629126961938|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: f4a66f4b-38cc-48c8-95ea-a25ab2cac89c
x-ezoic-cdn: Hit ds;ds;92fb211c0ea8ed417b137e09b83cff87;2-185419-22;45925b72-7f02-4cdc-505c-9478646453ee
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DJGVjEA2IAMF_WQ=
response: 200
server: nginx
x-amzn-trace-id: Root=1-610050f0-64999b541447daeb156fb1fe;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 59d92388a3a66e5f245f384a437fa025.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: UXkj6LHkV1cp_Q8bAa3gMqtyKcCPUpnOg9S582Kf_DMaWAxqWKeq3g==

GET
H2 200 15-yr-old-daughter.jpg
thebirthdaybest.com/ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/03/ 5 KB
6 KB 117ms
116ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/03/15-yr-old-daughter.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 259276e953a3b9920c6417d287bae35182ed4c7180df53e11408fbbb2fb100a5

Request headers

:path: /ezoimgfmt/i1.wp.com/thebirthdaybest.com/wp-content/uploads/2021/03/15-yr-old-daughter.jpg?resize=300%2C160&ssl=1&ezimgfmt=rs:300x160/rscb8/ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _dlt=1; _ga=GA1.2.816691754.1629126962; _gid=GA1.2.1284201477.1629126962; _gat_gtag_UA_148153416_1=1; __qca=P0-1853437614-1629126961915; ezux_lpl_185419=1629126961938|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: 12c902e7-7cca-4b1b-b5af-22661266d9ab
x-ezoic-cdn: Hit ds;ds;1463fa4f1cf580a3460ac352775ea487;2-185419-22;c48227d2-4d00-48cd-7f89-f21c2fc94da1
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DJGVjGaXIAMF9ig=
response: 200
server: nginx
x-amzn-trace-id: Root=1-610050f0-4006671d7289f5841077d258;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA50-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: 0KYQ6HN998n8qqpjmuDGCJ5lgUPI0zxOWMx4YK7CogVRjmXl9Sy3pg==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 17ms
16ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 931 B
284 B 505ms
504ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=1151771623936669&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-box-2%2Cthebirthdaybest_com-box-3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=250x250%2C468x60&prev_scp=a%3D%257C2%257C%26iid1%3D4618258868879017%26eid%3D4618258868879017%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1120%26sap%3D1120%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dthebirthdaybest_com-box-2-4618258868879017%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D24%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D160%26br2%3D80%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C25%2C120%2C0%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%7Ca%3D%257C3%257C%26iid1%3D7579626416899312%26eid%3D7579626416899312%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1129%26sap%3D1129%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dthebirthdaybest_com-box-3-7579626416899312%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D0%26bvm%3D1%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D180%26br2%3D90%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C919%2C787%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629126962&dt=1629126962149&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=676%2C651&adys=247%2C782&adks=2091818616%2C2668505765&ucis=1%7C2&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=980x250%7C468x60&msz=250x250%7C468x60&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0%2C0&ohw=0%2C0&btvi=0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

04d9e75f2e1acc4662492bd60b68c4619bf9f442412bb170d034ff626562b2af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 254
x-xss-protection: 0
google-lineitem-id: -2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5916 6 KB
3 KB 48ms
14ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 16 Aug 2021 15:16:02 GMT
expires: Tue, 16 Aug 2022 15:16:02 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 474 B
277 B 397ms
395ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=942918955129076&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=a%3D%257C3%257C%26iid1%3D1922089260863041%26eid%3D1922089260863041%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-2-1922089260863041%26eb_br%3D90c3c48d0172916d27c102ea4aa9d49c%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D12%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26br1%3D300%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C36%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C917%2C918%2C919%2C787%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629126962&dt=1629126962154&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=2463953556&ucis=3&ifi=3&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

ad19e31b53c888cdbaa1b466e37e493b6a938c5d6084b70670ff8e911bb1868f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 247
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 greenoaks.gif Show response
thebirthdaybest.com/detroitchicago/ 0
104 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjU0In0seyJuYW1lIjoicGVyZl9jb25uZWN0X3RvX3Jlc3Bfc3RhcnQiLCJ2YWwiOiIyNDUifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjE5In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjQ5OCJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjYzOSJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiI4MDYifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiI2MjEifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjYyMSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifV19XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjU0In0seyJuYW1lIjoicGVyZl9jb25uZWN0X3RvX3Jlc3Bfc3RhcnQiLCJ2YWwiOiIyNDUifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjE5In0seyJuYW1lIjoicGVyZl9pbnRlcmFjdGl2ZSIsInZhbCI6IjQ5OCJ9LHsibmFtZSI6InBlcmZfY29udGVudGxvYWRlZCIsInZhbCI6IjYzOSJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiI4MDYifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiI2MjEifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjYyMSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifV19XQ==
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _dlt=1; _ga=GA1.2.816691754.1629126962; _gid=GA1.2.1284201477.1629126962; _gat_gtag_UA_148153416_1=1; __qca=P0-1853437614-1629126961915; ezux_lpl_185419=1629126961938|19d192e6-efad-4891-5c07-888cb2232f2c|false; __gads=ID=52207abd04a573a2-222c23dfa3c80037:T=1629126962:S=ALNI_MZGjLDqnDlWUgNm3qBAT_d680SfwA
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:02 UTC

GET
H2 200 greenoaks.gif Show response
thebirthdaybest.com/detroitchicago/ 0
42 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjkuNiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjE0NDEifV19XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjkuNiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjE0NDEifV19XQ==
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _dlt=1; _ga=GA1.2.816691754.1629126962; _gid=GA1.2.1284201477.1629126962; _gat_gtag_UA_148153416_1=1; __qca=P0-1853437614-1629126961915; ezux_lpl_185419=1629126961938|19d192e6-efad-4891-5c07-888cb2232f2c|false; __gads=ID=52207abd04a573a2-222c23dfa3c80037:T=1629126962:S=ALNI_MZGjLDqnDlWUgNm3qBAT_d680SfwA
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:01 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 39ms
21ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021081001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b754f43cc3386fd7cecac575b5ef6416f9662ea4c29be3e2b3587970c188859

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8532
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:02 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 29ms
16ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 30ms
16ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame D375 12 KB
5 KB 7ms
7ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Mon, 16 Aug 2021 15:12:19 GMT
expires: Tue, 16 Aug 2022 15:12:19 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 223
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 4B7B 783 B
761 B 16ms
16ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

11b7d24699c245dc34450409434b7d682b39024559f032560672018fd2c9b416

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-XowPGuZERT9uxGQZaENdZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

expires: Mon, 16 Aug 2021 15:16:02 GMT
date: Mon, 16 Aug 2021 15:16:02 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-XowPGuZERT9uxGQZaENdZQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 gNlTKBZ5R8AAOiwGb4ScEkJ-hJdRSD5i8Nb9VbYnj7U.js Show response
pagead2.googlesyndication.com/bg/ Frame D375 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gNlTKBZ5R8AAOiwGb4ScEkJ-hJdRSD5i8Nb9VbYnj7U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80d95328167947c0003a2c066f849c12427e849751483e62f0d6fd55b6278fb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 15 Aug 2021 20:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67573
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13306
x-xss-protection: 0
last-modified: Tue, 03 Aug 2021 09:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 15 Aug 2022 20:29:49 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 30ms
30ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021081001&jk=1928672915352834&bg=!3t2l3ZnNAAbOj6irzo87ACkAdvg8Wu4JESM5t-wY3fOcYeM9eJMCXishaEhKTI3QU8DVLc8nwCVY8AIAAABZUgAAAAxoAQcKALLEux2TVD62OR-xE_ullTRw-L-6fqeIDEqEAlkTxp12C1_Z1V8c_q_qIst_tKzwTaBEW0ockqjFogWl6UfTfW3EgmeVsF5L4huZEBGDmPs5VQp_C0UI--vSfMo5wCusDB2hopAcEbJqhPxJ8bEJI3ILKyNkEeQmK36sVHbD0uHQROzAM0QXbXPWygg_hGMzZX1EL2sBvy0ud9UXEomp-1Oara_Z6oaVLtNk5bkEyjbRfTNWmQKAv3HEJlyqAgPWjGdo2on2-Ps4BPVwTMHju_sMJS8lommdlhFAle5ahDQjI_OapHe8H75jP5kAxjG5YJqEf4leBQMS_UzEJLyqnnYHoLo3EhEq5MSK2UlmdmbdaiFSxngqbxKZHahKYbTBTtlJW280mLLqcg0JbXlhAnX2lCChDp9hPm14Jb2rJJxeufbA6yj9E14oUHQI1n7NfikdcygsF7K7V6gV2B_qQ7GlI6WcJJV2iSbul-jPdSt3zsqpthJwtpgXKptskMbQPOlgg5Ba0JGKv4xJk7h_lztIe_kUDjoGKw-jG9xKg95HfxU1BbFSZuV0kGNID1zO9bbu1XL83Z8cAdv8SsJwmP1OsST2r_EdYU_09XDQyCa_pdnJEQ65uN0UYKzPZWHbXEY0l2M2Ld4IQOEhi0IKB1gGNDzZHV_qGE1swMjPT8y_gqH9BC4SXppN295xE4x6msdJ2weJZYNb1zNpVGicHuChOT1rjwiLAjoVMLYH9obZ6zq153YswYpKnzMLF_iCPk1bI--9MUVVHA7j9ZDnsP3jZGzqXZBibOoddQ23Yg9tnCcxWK7DJDQdAsgWEIKFttBoA_Db1HSRsjKVsOzSdc2Ldnwe2n6tfq6Txtn2CyKi2THChmjIjYmEzXTjIHBagPv7IXB-v4B8qI_7U1Dj_E5DT7xWx4XlMsa9jfn7L5pTU_02rlldk9MWllckU7REb38lvnnM0zrwhM4Qv6CDbk6M6PsQEYGC1ZVoy7Z_z-z--zUnZoN56sZNUzUqO9Yvr-2Ot-1ALx3dM-DVeMomWf1Ke4WEba0qcBtkzyjsviO0HAvOoJ5WcuCR5r0mUJ7gn1Lg0OST-w

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2-1.png
thebirthdaybest.com/wp-content/uploads/2019/09/ 10 KB
11 KB 54ms
54ms Image
image/webp 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://thebirthdaybest.com/wp-content/uploads/2019/09/2-1.png?ezimgfmt=rs:253x119/rscb8/ng:webp/ngcb8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fc4ca8834002e12c86b0dd8d02c10ec5a09396f09877f730b5b9eedaa08e1a65

Request headers

:path: /wp-content/uploads/2019/09/2-1.png?ezimgfmt=rs:253x119/rscb8/ng:webp/ngcb8
pragma: no-cache
cookie: ezoadgid_185419=-1; ezoref_185419=; ezoab_185419=mod12; active_template::185419=pub_site.1629126960; ezopvc_185419=1; ezepvv=0; ezovid_185419=926060370; lp_185419=https://thebirthdaybest.com/; ezovuuidtime_185419=1629126961; ezovuuid_185419=f3b4a9b9-52de-491b-43ad-bd318c30ea03; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezosuigeneris=5bbfe5ac401baa4b80b47fcbbfa92322; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; _dlt=1; _ga=GA1.2.816691754.1629126962; _gid=GA1.2.1284201477.1629126962; _gat_gtag_UA_148153416_1=1; __qca=P0-1853437614-1629126961915; ezux_lpl_185419=1629126961938|19d192e6-efad-4891-5c07-888cb2232f2c|false; __gads=ID=168525852d6d4408-22cac1a1a3c800fb:T=1629126962:S=ALNI_MaebzGUTusxmJlk_cnXobaWPucwgQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:03 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-amzn-requestid: 42e90f03-c036-4dcc-8eac-d60760d861e2
x-ezoic-cdn: Hit ds;mm;f532e2acd491d0a482c575e92b4e6974;2-185419-22;5c51865b-85ee-488f-6565-1b53c2760456
x-cache: Miss from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: DHidOEOmoAMF2iQ=
response: 200
server: nginx
x-amzn-trace-id: Root=1-60ffb121-537d3e4570ab876c744ff28e;Sampled=0
vary: Accept-Encoding User-Agent,Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 c3b74c81fdcb7942211a6c721efa13fd.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA2-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: r3A3Y1XKCjyfUFegQo6wtPBYh_FlieXMTXSBGuPwRRB2KXAA6LmMsQ==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
781 B 315ms
314ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=2905947644250776&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid1%3D7579626416899312%26eid%3D7579626416899312%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1129%26sap%3D1129%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dthebirthdaybest_com-box-3-7579626416899312%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D0%26bvm%3D1%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D160%26br2%3D90%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C919%2C787%2C17%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D180%26reqt%3D1629126965363&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629126965&dt=1629126965368&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=651&adys=782&adks=2668505765&ucis=2&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=468x60&msz=468x60&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

b2f950e50fbe30ebae800be251297329e52454b3a1d7e9380285a855a4c3a85d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 238
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 466 B
409 B 371ms
371ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=4431140918194891&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ris=3&rcs=1&prev_scp=a%3D%257C2%257C%26iid1%3D4618258868879017%26eid%3D4618258868879017%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1120%26sap%3D1120%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dthebirthdaybest_com-box-2-4618258868879017%26eb_br%3Ddfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D24%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D80%26br2%3D80%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C25%2C120%2C0%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%2C17%2C19%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D160%26reqt%3D1629126965371&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629126965&dt=1629126965373&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=676&adys=247&adks=2091818616&ucis=1&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=980x250&msz=250x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

914c9a60d49cb7a8a4ad69289d5fa024624753bb31f3762cf3456e4b42e67dee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 232
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 474 B
426 B 387ms
387ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=2520832081700318&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid1%3D1922089260863041%26eid%3D1922089260863041%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-2-1922089260863041%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D12%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26br1%3D160%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C36%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C917%2C918%2C919%2C787%2C17%2C20%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D300%26reqt%3D1629126965377&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629126965&dt=1629126965382&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=2463953556&ucis=3&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

fea0268725ebc6cb05524948c1d104a022c45040834587f69c87d3cf3b95d500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:05 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 wp-emoji-release.min.js Show response
thebirthdaybest.com/wp-includes/js/ 13 KB
4 KB 32ms
32ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-includes/js/wp-emoji-release.min.js?ver=5.4.6
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0d41eb8b21bb9c81829462d6c101a45c58a2564cf4a02f1ec600b0a5c7c24697

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.4.6
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "363c-5c462acc90858-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;fdb79f30e5ddd8ce232d23e68e5d8298;2-185419-22;de6c9f9a-f442-4f9c-4bc6-ceda2edb948a
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 0.63% 13797 / 13884
x-middleton-response: 200

GET
H2 200 gtm.js Show response
thebirthdaybest.com/ezossp/https/www.googletagmanager.com/ 85 KB
32 KB 48ms
47ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/www.googletagmanager.com/gtm.js?screx=1&sxcb=2&id=GTM-MH578ST

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

c524ba10500efc16ad21cd3163bb1b2ba835d20d70bd0131f8b31cdb30bed977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

:path: /ezossp/https/www.googletagmanager.com/gtm.js?screx=1&sxcb=2&id=GTM-MH578ST
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;d19c413f2fd660505f421185530693bc;2-185419-22;5b2a3540-21a9-4f9e-5d13-2fa5fcd6becb
x-middleton-display: staticcontent_sol
cross-origin-resource-policy: cross-origin
x-middleton-response: 200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 27 Jul 2021 01:09:37 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control

GET
H2 200 photon.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/p/jetpack/9.1.1/_inc/build/photon/ 758 B
651 B 20ms
20ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/p/jetpack/9.1.1/_inc/build/photon/photon.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/p/jetpack/9.1.1/_inc/build/photon/photon.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;c02c2c07301e4a489e16a3a59c22edc2;2-185419-22;8aa54f0d-e43a-413f-52f9-5aa1c439cc93
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 370
x-nc: HIT hhn 1
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
strict-transport-security: max-age=15552000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
timing-allow-origin: *

GET
H3-29 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 72 KB
25 KB 31ms
31ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

sffe /

Resource Hash

7f64a8c080204649482c14a75ae0dc2cbbb3b1414967c1fc012cb6fdbcb12f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "960 / 792 of 1000 / last-modified: 1629112273"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25232
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:06 GMT

GET
H2 200 core.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/ 4 KB
2 KB 28ms
28ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/core.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

194ebae85ff853319e8668f23a4c5bf371a7d9f5d550a40980ab53026ddaaa17

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/core.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;a21e775132118fd367c43fd0b7070f69;2-185419-22;5e87220b-4900-4d98-42e2-704c275222de
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1659
x-nc: HIT hhn 2
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
strict-transport-security: max-age=15552000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
timing-allow-origin: *

GET
H2 200 widget.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/ 7 KB
3 KB 324ms
23ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/widget.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e876d19cab827dbd742973a70681f7b8b70425db6d56d679fd42b851ccd084c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/widget.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;cc69f78ffd272570656fe872a52f1777;2-185419-22;f651ca46-4e81-49ec-4813-049c6e13c5eb
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 2475
x-nc: HIT hhn 1
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
strict-transport-security: max-age=15552000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
timing-allow-origin: *

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 96 KB
31 KB 339ms
339ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=1232074068104671&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=2&rcs=2&prev_scp=a%3D%257C3%257C%26iid1%3D7579626416899312%26eid%3D7579626416899312%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1129%26sap%3D1129%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D3%26at%3Dbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Dthebirthdaybest_com-box-3-7579626416899312%26eb_br%3Dzero%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D0%26bvm%3D1%26bvr%3D1%26shp%3D1%26ftsn%3D3%26br1%3D0%26br2%3D90%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C760%2C815%2C817%2C899%2C919%2C787%2C17%2C17%2C18%2C19%2C1428%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D160%26reqt%3D1629126965872%26ss38%3D1%26ss9%3D1&eri=1&cookie=ID%3Dd0ac330df6d86dba-2226a973a3c80018%3AT%3D1629126965%3AS%3DALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ&bc=31&abxe=1&lmt=1629126966&dt=1629126966878&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=651&adys=782&adks=2668505765&ucis=2&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=468x60&msz=468x60&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

0176b7386f6b7afca46858a198de796d2e46977f269cf2df26d70179fcc07762

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI-7ofHqtfICFUgI4Aod9DIOrw&gqi=&layout=/sadbundle/%24csp%253Der3%24/18149678051191312142/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI-7ofHqtfICFUgI4Aod9DIOrw&gqi=&layout=/sadbundle/%24csp%253Der3%24/18149678051191312142/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31755
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Mon, 16 Aug 2021 15:16:07 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 99 KB
31 KB 381ms
381ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=4258806380233448&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=250x250&ris=2&rcs=2&prev_scp=a%3D%257C2%257C%26iid1%3D4618258868879017%26eid%3D4618258868879017%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1120%26sap%3D1120%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dthebirthdaybest_com-box-2-4618258868879017%26eb_br%3D2e8b8c60843e52e5aaa1e3a52287a2bb%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D24%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D8%26br2%3D80%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D83%2C25%2C120%2C0%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%2C17%2C19%2C17%2C18%2C19%2C1428%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D80%26reqt%3D1629126965878&eri=1&cookie=ID%3Dd0ac330df6d86dba-2226a973a3c80018%3AT%3D1629126965%3AS%3DALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ&bc=31&abxe=1&lmt=1629126966&dt=1629126966884&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=676&adys=247&adks=2091818616&ucis=1&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=980x250&msz=250x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

d6442ebe1948b7fdf0f75485cc8093a513bdee0fd4480332e91514aeddb4d787

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP_5ofHqtfICFdUW4AodPkIC8Q&gqi=&layout=/sadbundle/%24csp%253Der3%24/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CP_5ofHqtfICFdUW4AodPkIC8Q&gqi=&layout=/sadbundle/%24csp%253Der3%24/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32002
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Mon, 16 Aug 2021 15:16:07 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 17ms
17ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 457 B
265 B 355ms
354ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=4257598006302119&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=2&prev_scp=a%3D%257C3%257C%26iid1%3D1922089260863041%26eid%3D1922089260863041%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-2-1922089260863041%26eb_br%3De29f69dd468d31a5514dc9b5587ce757%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D12%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26br1%3D16%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C36%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C917%2C918%2C919%2C787%2C17%2C20%2C17%2C18%2C19%2C20%2C1428%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D160%26reqt%3D1629126965894&eri=1&cookie=ID%3Dd0ac330df6d86dba-2226a973a3c80018%3AT%3D1629126965%3AS%3DALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ&bc=31&abxe=1&lmt=1629126966&dt=1629126966898&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=2463953556&ucis=3&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

745b53bef83f3701a98495ac9e63eb7b3fec46b9d1ed2d9acbb4ba1b1c035995

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
65 B 315ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI0MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI1MTMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE5MjIwODkyNjA4NjMwNDEiLCJkb21haW5faWQiOiIxODU0MTkiLCJ1bml0IjoiZGl2LWdwdC1hZC10aGViaXJ0aGRheWJlc3RfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNjY4In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI0MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI1MTMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE5MjIwODkyNjA4NjMwNDEiLCJkb21haW5faWQiOiIxODU0MTkiLCJ1bml0IjoiZGl2LWdwdC1hZC10aGViaXJ0aGRheWJlc3RfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNjY4In1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:05 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
42 B 315ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY3NSJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMjQ3In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY1MCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNzgyIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjExMDQifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6InRydWUifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY3NSJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMjQ3In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY1MCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNzgyIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjExMDQifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6InRydWUifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:06 UTC

GET
H2 200 accordion.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/ 9 KB
3 KB 322ms
22ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/accordion.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

eeda6b3f73792218da2a6f90f1966c3f4c0f282216a68c55014e77bed518a1bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/jquery/ui/accordion.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba-2226a973a3c80018:T=1629126965:S=ALNI_MaYouN9oln66IPJqvaFd6cz7yUHqQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;c843e792d0e838250286ac9f1592ee41;2-185419-22;cf3fcc4d-aeab-4ff6-547c-37b6593feb06
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 2639
x-nc: HIT hhn 1
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
strict-transport-security: max-age=15552000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
timing-allow-origin: *

GET
H2 200 container.html Show response
8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D5B3 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 16 Aug 2021 15:16:02 GMT
expires: Tue, 16 Aug 2022 15:16:02 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 580ms
579ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7761979199bf20d25fe4726392f9e6c268295e5d179b2bb5a683cb10fb6ad0d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628854342869989"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27733
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:07 GMT

GET
H2 200 greenoaks.gif Show response
thebirthdaybest.com/detroitchicago/ 0
81 B 317ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYxMzIifV19XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYxMzIifV19XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=0; ezouspva=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:06 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
42 B 317ms
16ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NTc5NjI2NDE2ODk5MzEyIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEyOSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDE2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIzLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzgyMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjcxNjE0Mzk0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NTc5NjI2NDE2ODk5MzEyIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEyOSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDE2LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODIzLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzgyMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjcxNjE0Mzk0In1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=0; ezouspva=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:08 UTC

GET
H2 200 71614394 Show response
g.ezoic.net/dac/ 0
88 B 55ms
20ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/71614394
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/porpoiseant/banger.js?cb=195-0&bv=58&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 316ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=0; ezouspva=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:06 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 317ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NjcsImFkX3Bvc2l0aW9uIjoxMTI5LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjE4MCwiYmlkX2Zsb29yX3ByZXYiOjE2MCwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MzY1LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0fV0=
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NjcsImFkX3Bvc2l0aW9uIjoxMTI5LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjE4MCwiYmlkX2Zsb29yX3ByZXYiOjE2MCwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MzY1LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0fV0=
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=0; ezouspva=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:07 UTC

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/ Frame BA71 18 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

651497199c44fcce1be1e13da9264fcf88caa7cc8f85f546e32c0da6de1ece5b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/18149678051191312142/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Wed, 11 Aug 2021 17:55:08 GMT
expires: Thu, 11 Aug 2022 17:55:08 GMT
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 4212
age: 422459
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D5B3 0
0 43ms
43ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CLlxHNoEaYY_IOMiQgAf05bj4CqroxK9kxP7R0bIO__WQ49cCEAEg9PnGJWCV-vCBjAegAb6LkdADyAEJqQK_V44pWMSzPuACAKgDAcgDCKoE1wFP0M426qyULswhTwUsGvJpl8_Isko8lTTspQY9ER_R_8dJXvWDqT2y7ihI9uOk_31shmf-R04U0X93eowIBgQZ5PuyQq5qTZvxvjvXRFeWbiaE9xqnYEqbK-6Bq98oiQC58QsAT3fhUIVVMfetadd1XD_GXe9CR7eLWgtcKcUmq0Jz2QfWZMaxkcUZ7iNPzPSIxo8r_cKCjaPHxMzuklUUSJaVUAeMsoGU2-HRXvWKtoeVBqqMgi-c3R5yZpyXSo_60M4gU9ZRXUSoVYAsBOaQlCjMS_yZ0sAE3LOxs_QD4AQBkgUECAQYAZIFBAgFGASgBi6AB-rSlTCoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwMQ8C7SCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4MDI4NjkwNzY5MDI5ODiACgPICwHYEw2IFAHQFQGAFwGyFx4KHAgAEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQc&sigh=bIkV30s9DgM&template_id=419
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s46-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/ Frame D5B3 18 KB
8 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/abg_lite_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:14:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7614
x-xss-protection: 0
server: cafe
etag: 9899176843389144697
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:14:09 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame D5B3 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 181
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:13:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D5B3 124 KB
37 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628854326415524"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:07 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame D5B3 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:12:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:12:39 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame D5B3 0
0 14ms
14ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSNnzYN7pm5ZiBjz4OQxTzDUb6aD9ZKKUHYxVFmfnLaopamW8bEia5pFra0ayHoabvPxV2XuSO5aZMvYnQI95zHaN20qw
Requested by: Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html Show response
8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 21CA 6 KB
3 KB 6ms
5ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 16 Aug 2021 15:16:02 GMT
expires: Tue, 16 Aug 2022 15:16:02 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiIyZThiOGM2MDg0M2U1MmU1YWFhMWUzYTUyMjg3YTJiYiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA4LCJhZF9wb3NpdGlvbiI6MTEyMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDgsImJpZF9mbG9vcl9wcmV2IjowLjAwMDgsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjE4MjU4ODY4ODc5MDE3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDM0NTg4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjE4MjU4ODY4ODc5MDE3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiIyZThiOGM2MDg0M2U1MmU1YWFhMWUzYTUyMjg3YTJiYiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA4LCJhZF9wb3NpdGlvbiI6MTEyMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDgsImJpZF9mbG9vcl9wcmV2IjowLjAwMDgsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjE4MjU4ODY4ODc5MDE3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDM0NTg4In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjE4MjU4ODY4ODc5MDE3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:06 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 20ms
20ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/porpoiseant/banger.js?cb=195-0&bv=58&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
42 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:07 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NjcsImFkX3Bvc2l0aW9uIjoxMTIwLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjE2MCwiYmlkX2Zsb29yX3ByZXYiOjgwLCJiaWRfZmxvb3JfZmlsbGVkIjo4LCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MDgsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NjcsImFkX3Bvc2l0aW9uIjoxMTIwLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjE2MCwiYmlkX2Zsb29yX3ByZXYiOjgwLCJiaWRfZmxvb3JfZmlsbGVkIjo4LCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MDgsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:07 UTC

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame BA71 9 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 15 Aug 2021 19:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70817
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 16 Aug 2021 19:35:50 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame BA71 26 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9514
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Aug 2021 12:37:33 GMT

GET
H3-29 200 c6afb71c43a6f510a28d0c5a9b6e8216.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/ Frame BA71 77 KB
20 KB 8ms
7ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/c6afb71c43a6f510a28d0c5a9b6e8216.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d12411c852fcc11ebba43ff3acf0e5eb913439df6684cf56b4b85b0be15cef1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 436790
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20438
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 13:56:17 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 13:56:17 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 50F3 143 B
226 B 7ms
5ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 16 Aug 2021 14:16:33 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Stepstone_1b_DE_250x250.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 17 KB
4 KB 8ms
8ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3523634ca390de148c0e8f12e3820ac152d694f1f6f40641a24fb41d91d858ab

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Tue, 10 Aug 2021 07:16:24 GMT
expires: Wed, 10 Aug 2022 07:16:24 GMT
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 4143
age: 547183
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 21CA 0
0 42ms
42ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cg1SKNoEaYf-GOdWtgAe-hImID67V7dVj8P_K7cwK6ZHit9cJEAEg9PnGJWCV-vCBjAegAdWU_scDyAEJqQK_V44pWMSzPuACAKgDAcgDCKoE2wFP0MgTR3Z2EDYJvQJ5kjFNdxqxKJOGe9xTMgluey24p5DrxVR7Q-lriBW3Oy9roHhSSZ0enGDuHECIHrTRTLtwb0iHJ84Zs1AEGrko2RIubCp1_z8OEV2YV-nZylGVygy36-b-zOBartEFdgxckFKSb-qNsk7VzC6f64d2bX9S2QpprZ_QDzdIW1PpuC9HEiH8hYqhz06Q3YkBy-jmWa0Zlz7kmCElSORwCWSaD4JJvkYZ2CF8gf-ce6W4lB8dL1FFgvblo_xPXeDtBTNa85dhiPzuyfh2WPfzF0bABM_LwsmAAuAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAe8v6kuqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBDo-ATSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTg4MDI4NjkwNzY5MDI5ODiACgPICwHYEwvQFQGYFgGAFwGyFx4KHAgAEhRwdWItNjM5Njg0NDc0MjQ5NzIwOBi-yQc&sigh=3cqdOU0Xbyw&template_id=531
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s46-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/ Frame 21CA 18 KB
7 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/abg_lite_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:14:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 118
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7614
x-xss-protection: 0
server: cafe
etag: 9899176843389144697
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:14:09 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame 21CA 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:15:50 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 21CA 124 KB
37 KB 35ms
21ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628854326415524"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:07 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame 21CA 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:12:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:12:39 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 21CA 0
0 15ms
14ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQhqtxC4oOC1GqyKv3uSyIgZhwTqE6p7eVkqUZmMZZz0taXp2NuuNrFlAeXXJadkmgtW0gyyqzOulkKB6c2fhM1o3jLtg
Requested by: Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame D5B3 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48d46c01316fa254779eb442f442013b0ab60df21ce40b4afb452173475b71af

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame BA71 6 KB
732 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/c6afb71c43a6f510a28d0c5a9b6e8216.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1f2fa7e74884a4b14523d8d82178a964a20da8c45a9f38b9c30fd516eff418b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 14:28:42 GMT
server: ESF
date: Mon, 16 Aug 2021 15:16:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Aug 2021 15:16:07 GMT

GET
H3-29 200 a6bbc0bf7adcea5559699818d25507fb.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/ Frame BA71 2 KB
1 KB 8ms
7ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/a6bbc0bf7adcea5559699818d25507fb.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0021fcf6011bbb68d059ae5ebda2cc09c8bee217a8b65868072cd991b8e5e564

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 392204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1059
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Thu, 12 Aug 2021 02:19:23 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 02:19:23 GMT

GET
H3-29 200 73801be4bd97338227adf2692fbaa83e.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/ Frame BA71 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/73801be4bd97338227adf2692fbaa83e.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ef27da33e4aee066ae6b638396fc256a308268e8b66f7a8e4eb5aa9e706e5d2

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 392204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2070
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Thu, 12 Aug 2021 02:19:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 02:19:23 GMT

GET
H3-29 200 68205a7bba4eca78358f122322a6922b.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/ Frame BA71 2 KB
1 KB 10ms
8ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/68205a7bba4eca78358f122322a6922b.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b47a3ee3ee877ea3de7f07c5e523d503c4144599479d967ddb9a32ded8957f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 392204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1004
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Thu, 12 Aug 2021 02:19:23 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 02:19:23 GMT

GET
H3-29 200 53b89bebf50a6833e86f6f7763896c8f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/ Frame BA71 606 B
632 B 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/53b89bebf50a6833e86f6f7763896c8f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2254b2d5856d54d17967db74e4cec415f1b22e98c376efc1d6bb9e7ee3ff0bc

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 392204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 606
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Thu, 12 Aug 2021 02:19:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 02:19:23 GMT

GET
H3-29 200 6bbebddb806b22ce252d4b0f016d40fa.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/ Frame BA71 766 B
793 B 12ms
11ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/6bbebddb806b22ce252d4b0f016d40fa.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

116e09ac0e6bd4cb7239309dc53e2139a7bdbaa4bafe596ffea29cc97fc58741

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 392203
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 766
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Thu, 12 Aug 2021 02:19:24 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 02:19:24 GMT

GET
H3-29 200 2df82382ecaf0d25067d539f0d7eefcc.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/ Frame BA71 3 KB
3 KB 11ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/media/2df82382ecaf0d25067d539f0d7eefcc.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18149678051191312142/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9903282c31b5b0d7e6dab4e43220b778cac6d6f7241aaf1775bdcd7b51e52cb7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 392204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3295
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Thu, 12 Aug 2021 02:19:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 02:19:23 GMT

GET
H2 200 frontend.js Show response
thebirthdaybest.com/wp-content/plugins/faq-schema-for-pages-and-posts//js/ 111 B
272 B 34ms
34ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/faq-schema-for-pages-and-posts//js/frontend.js?screx=1&sxcb=8a&ver=2.0.0
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 12b6742262933edb939e8114acaa11f2d100a1da507b1fd56ea3fca9fb3a5f10

Request headers

:path: /wp-content/plugins/faq-schema-for-pages-and-posts//js/frontend.js?screx=1&sxcb=8a&ver=2.0.0
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "bc-5c462a98fd857-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;b0135ba8c4dfff24a2e79396b907bf6e;2-185419-22;45a6854e-a026-4e9e-7f8f-e6589149f67d
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 40.96% 111 / 188
x-middleton-response: 200
content-length: 84

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4ECA 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 16 Aug 2021 14:16:33 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3574
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 21CA 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45800e1e3005695efb5fde7bda05ff4fb2e05c30e27b12752724c4dcef8c6a1c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 common.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 1 KB
475 B 13ms
6ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/common.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44c6b8b0c5615b535786fdf7915306c6d3736a09f007bc9e983685d654e564cb

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 442
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdpage_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 55 B
105 B 14ms
7ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdpage_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9925dc8fdc741305ffba07d91a1ea84c3e56187e55fa30b4063f7bddaaef318

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdpagedeck_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 731 B
267 B 16ms
8ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdpagedeck_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdgesture_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 57 B
106 B 23ms
15ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgesture_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f058ecc947d0bc01e2855afaff0be17a2e30ae1e067ad3a5389b986a62225e26

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdimage_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 281 B
191 B 23ms
15ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdimage_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdgallerynavigation_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 1 KB
495 B 27ms
19ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgallerynavigation_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86ee0e760c043b495df32283b44ba844e416df4ac5189fe6a0d801c781e35125

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 585125
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 462
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 09 Aug 2021 20:44:02 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 20:44:02 GMT

GET
H3-29 200 gwdswipegallery_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 593 B
295 B 31ms
23ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdswipegallery_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8901fa0327db3662c3a45390b4e1bb8751f5432b4f743f0f9a17afabfd4011e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 372357
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 260
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Thu, 12 Aug 2021 07:50:10 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 Aug 2022 07:50:10 GMT

GET
H3-29 200 gwdattached_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 25 B
79 B 31ms
23ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdattached_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d86a1f085058e7a82920bb9001286c7033b95dc0f7e1555e4fce2ffa6230748d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 custom.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 2 KB
614 B 29ms
21ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/custom.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

631b76365e8fbf76325d172baf3241e56367f11b6d45a24b4b56ab342349abc3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 592614
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 580
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 09 Aug 2021 18:39:13 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 18:39:13 GMT

GET
H3-29 200 gwdtaparea_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 157 B
149 B 30ms
22ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdtaparea_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdgooglead_style.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 44 B
88 B 26ms
18ms Stylesheet
text/css 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgooglead_style.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3225f378c00d8870e6d73c3b99cd541d2a9e0ce2d04b24fd41afee29d8c84da9

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 googbase_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 316 B
240 B 34ms
26ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/googbase_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0b3328fc07a63c6c8b7dbcbb8cba062c5c1d196f2d3652b398e55269f769812

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 204
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwd_webcomponents_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 17 KB
6 KB 33ms
25ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwd_webcomponents_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e425279564d1f913ed187261d7699686b35eb72ec272e356e008d8487983806

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5671
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 utils.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 4 KB
1 KB 31ms
24ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/utils.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

266e55302306eef74f3c891c0476b8eab81ca01a4ad485ef25f25c68b0ed9a20

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 585125
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1434
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 09 Aug 2021 20:44:02 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 20:44:02 GMT

GET
H3-29 200 common.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 16 KB
4 KB 31ms
23ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/common.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6c27bbe9d67cc35943d29ad4940c3ec766d5eadaeb82faa9fe87c951fa283b3

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4146
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 custom.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 3 KB
1 KB 33ms
25ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/custom.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7d005b3fb3c0c127e4fbe94d746f86a4a2b3c3468a2c8e8b1aa37abd29a65ed

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1029
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 86C0 16 KB
6 KB 38ms
31ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 15 Aug 2021 18:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75740
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 16 Aug 2021 18:13:47 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 86C0 26 KB
10 KB 21ms
14ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9514
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Aug 2021 12:37:33 GMT

GET
H3-29 200 gwdid.min.1.0.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 3 KB
1 KB 38ms
31ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdid.min.1.0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9f89d3a48cda8f6eb27fba7e495b987c0f64dda095b12a0ac23fa97ba4396d86

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1032
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwd-events-support.1.0.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 3 KB
905 B 31ms
24ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwd-events-support.1.0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7e8a53262055fda93674c96c131549f2fa95b91d5abcd40f8068451dcc4be18

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 869
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdpage_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 3 KB
996 B 34ms
27ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdpage_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b8e40848793a7e3892874fda515fea4d32452d42f3bc823c55dce4e870eb01e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 593292
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 960
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 09 Aug 2021 18:27:55 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 18:27:55 GMT

GET
H3-29 200 gwdpagedeck_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 6 KB
2 KB 37ms
30ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdpagedeck_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86ad3392d0eb2bd83ac4db174b9b5ab8fd46906befa113bb0c2f907c89dd080c

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2236
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdgesture_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 6 KB
2 KB 35ms
29ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgesture_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e39d454539ee75b0abd32949ed1b98a26372b372835ad22c3e907a2d30b7021b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2010
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdimage_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 4 KB
1 KB 37ms
30ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdimage_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7e1233f57820817f87ddae403f20ab752314e5aa8fa2b8d72c8087531d2ecdd

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 66706
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1206
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Sun, 15 Aug 2021 20:44:21 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 15 Aug 2022 20:44:21 GMT

GET
H3-29 200 gwdgallerynavigation_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 3 KB
1 KB 35ms
30ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgallerynavigation_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d95c6a62ba32eb57c6e1165a98d89c61b462a52479917ebb811ca71a35fce0f1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1171
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdswipegallery_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 16 KB
5 KB 34ms
28ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdswipegallery_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90dadd2bc9dcf8e5b7945b959ebc596b978e250c47e0284bf9f3bfb2dfa92539

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5438
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdgpadataprovider_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 2 KB
1000 B 35ms
29ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgpadataprovider_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f04964e2b1599980730940d8f0ea03ed715e37df6a0de083351e01587869faf

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 5316
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 963
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 13:47:31 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 13:47:31 GMT

GET
H3-29 200 gwdattached_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 420 B
276 B 33ms
27ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdattached_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e653267eac8b860b7132c5f4c5555e4410ec0c88700172a06fd681b3abf1525

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 240
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdtexthelper_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 6 KB
2 KB 33ms
28ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdtexthelper_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

859b11e80036f5df2fab398feaa8af4d72c9450064a43fd23e074aca564d3e45

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2340
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwddatabinder_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 5 KB
2 KB 31ms
26ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwddatabinder_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7df5b2df2fb7330805d12f6d72fc277f7144d6706e484114c8086163d28833bf

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2051
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdtaparea_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 2 KB
839 B 32ms
28ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdtaparea_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e17a0af89c14dd4f2e776d60d6f5bc81b1765c5c75357c1cd1e09a25baeab520

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 803
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H3-29 200 gwdgooglead_min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 11 KB
3 KB 31ms
26ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/gwdgooglead_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1b_DE_250x250.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea597dacc66cab54b3c1d9863555b52f0bd53adb81e168b79798a8ce1ef63112

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 17764
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3334
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Mon, 16 Aug 2021 10:20:03 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 10:20:03 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame BA71 15 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 03:00:34 GMT
x-content-type-options: nosniff
age: 562533
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 03:00:34 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame BA71 16 KB
16 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 01:12:52 GMT
x-content-type-options: nosniff
age: 568995
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 01:12:52 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame BA71 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 02:33:08 GMT
x-content-type-options: nosniff
age: 564179
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15724
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 02:33:08 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 50F3
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
38ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 16 Aug 2021 15:16:07 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 16-Aug-2021 16:16:07 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 16 Aug 2021 15:16:07 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 320ms
320ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=3482133034955723&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=1&rcs=3&prev_scp=a%3D%257C3%257C%26iid1%3D1922089260863041%26eid%3D1922089260863041%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D4%26at%3Dbf%26adr%3D399%26ezosn%3D0%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-2-1922089260863041%26eb_br%3Dzero%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D12%26bvm%3D0%26bvr%3D2%26shp%3D1%26ftsn%3D3%26br1%3D0%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C36%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C917%2C918%2C919%2C787%2C17%2C20%2C17%2C18%2C19%2C20%2C1428%2C17%2C18%2C19%2C20%2C1428%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D16%26reqt%3D1629126967449%26ss38%3D1%26ss9%3D1&eri=1&cookie=ID%3Dd0ac330df6d86dba%3AT%3D1629126965%3AS%3DALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q&bc=31&abxe=1&lmt=1629126967&dt=1629126967467&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=2463953556&ucis=3&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

99b86f56dfbd9e779753a1fd5713a81f8e97b06009a037ab26fb2661e92b365b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10394
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 links.js Show response
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/localization/links/resources/ 748 B
489 B 26ms
25ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/localization/links/resources/links.js?screx=1&sxcb=8a&ver=4.0.13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1b7ff70878481c6f9206506efc41c937db091d1dc789791cbc9034769c61e583

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/components/localization/links/resources/links.js?screx=1&sxcb=8a&ver=4.0.13
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "305-5c462a80a46c8-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;14d12e5a2e0b0912b3de069921298e27;2-185419-22;042bf338-122d-4df8-705e-359945f07de7
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 16.42% 748 / 895
x-middleton-response: 200
content-length: 328

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4ECA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
39ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 16 Aug 2021 15:16:07 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 16-Aug-2021 16:16:07 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 16 Aug 2021 15:16:07 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bootstrap.min.js Show response
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/vendor/ 10 KB
3 KB 32ms
32ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/vendor/bootstrap.min.js?screx=1&sxcb=8a&ver=3.3.2
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a2cda6266b679fadce326a8f4bf7b4b42099b431f4300d2c1c168c58e70e538a

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/vendor/bootstrap.min.js?screx=1&sxcb=8a&ver=3.3.2
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "2838-5c462a82cea3e-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;e7603984de026fc71ccc3375c8d47af3;2-185419-22;6d21e76e-6e0d-47c2-74b9-d1ec37b6daa8
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 0.15% 10484 / 10500
x-middleton-response: 200
content-length: 3207

GET
H3-29 200 stepstone_logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 18 KB
18 KB 8ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/stepstone_logo.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ca1c8e3b0ad9fa21aa7415d964584db567311edeeaf2ce889d14cf61529b1ea

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 525299
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18802
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Tue, 10 Aug 2021 13:21:08 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 13:21:08 GMT

GET
H2 200 11678069764059861340_10614671200080963018.png
static.doubleclick.net/dynamic/5/50115700/ Frame 86C0 384 B
860 B 30ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/50115700/11678069764059861340_10614671200080963018.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efe5b6d12c0b9d78012391db481d5d6037aef98b7288d1d5c730f6c1872a3a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 19:53:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 08 Aug 2021 13:36:25 GMT
server: sffe
age: 588144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 384
x-xss-protection: 0
expires: Tue, 09 Aug 2022 19:53:43 GMT

GET
H2 200 13777920212432762347_6051213864746974179.gif
static.doubleclick.net/dynamic/5/50115700/ Frame 86C0 7 KB
7 KB 32ms
9ms Image
image/gif 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/50115700/13777920212432762347_6051213864746974179.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9bde835f4362e985222d49d502896a974881b1796148be58821c3ceab87d84e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 06:34:06 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Jul 2021 13:37:51 GMT
server: sffe
age: 376921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6818
x-xss-protection: 0
expires: Fri, 12 Aug 2022 06:34:06 GMT

GET
H2 200 126368036623885979_18395126894481314663.png
static.doubleclick.net/dynamic/5/50115700/ Frame 86C0 4 KB
4 KB 30ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/50115700/126368036623885979_18395126894481314663.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f525fbcd94cdc71ba3399836356b39d0df8f535a8dbb698fc178bab6941285

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 05:30:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 18 Jul 2021 13:37:52 GMT
server: sffe
age: 553543
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4210
x-xss-protection: 0
expires: Wed, 10 Aug 2022 05:30:24 GMT

GET
H3-29 200 Stepstone_1a_squareBG.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 11 KB
12 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1a_squareBG.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61427155c3baa2ff394dbf4e9d5106922f4b648dd7243253685c0d942f51b576

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 550048
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11764
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Tue, 10 Aug 2021 06:28:39 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 06:28:39 GMT

GET
DATA 200
OK truncated
/ Frame 86C0 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 200 Stepstone_1a_squareBG.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 11 KB
12 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/Stepstone_1a_squareBG.jpg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61427155c3baa2ff394dbf4e9d5106922f4b648dd7243253685c0d942f51b576

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 550048
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11764
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Tue, 10 Aug 2021 06:28:39 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 06:28:39 GMT

GET
H3-29 200 stepstone_logo.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/ Frame 86C0 18 KB
18 KB 8ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/5106163329903099904/Stepstone_1b_DE-Part_1/stepstone_logo.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ca1c8e3b0ad9fa21aa7415d964584db567311edeeaf2ce889d14cf61529b1ea

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 525299
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18802
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 09:03:22 GMT
server: sffe
date: Tue, 10 Aug 2021 13:21:08 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 13:21:08 GMT

GET
H2 200 popovers.js Show response
thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/ 2 KB
847 B 23ms
23ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/popovers.js?screx=1&sxcb=8a&ver=4.0.13
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bb719cc044503dc3380932e75ff69982cdcca326a1c5889ca65e66fec997c271

Request headers

:path: /wp-content/plugins/easyazon-pro-4.0.13/components/popovers/resources/popovers.js?screx=1&sxcb=8a&ver=4.0.13
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "99a-5c462a82b6504-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;59ff3e55ac9e797b08fc438a6ef6f408;2-185419-22;e46f5d16-9d15-48cc-4aad-115d3571062c
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 18.91% 2092 / 2580
x-middleton-response: 200
content-length: 677

GET
H3-29 200 126368036623885979_18395126894481314663.png
static.doubleclick.net/dynamic/5/50115700/ Frame 86C0 4 KB
4 KB 21ms
8ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/50115700/126368036623885979_18395126894481314663.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4f525fbcd94cdc71ba3399836356b39d0df8f535a8dbb698fc178bab6941285

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 05:30:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 18 Jul 2021 13:37:52 GMT
server: sffe
age: 553543
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4210
x-xss-protection: 0
expires: Wed, 10 Aug 2022 05:30:24 GMT

GET
H3-29 200 13777920212432762347_6051213864746974179.gif
static.doubleclick.net/dynamic/5/50115700/ Frame 86C0 7 KB
7 KB 21ms
8ms Image
image/gif 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/50115700/13777920212432762347_6051213864746974179.gif

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9bde835f4362e985222d49d502896a974881b1796148be58821c3ceab87d84e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 12 Aug 2021 06:34:06 GMT
x-content-type-options: nosniff
last-modified: Wed, 28 Jul 2021 13:37:51 GMT
server: sffe
age: 376921
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6818
x-xss-protection: 0
expires: Fri, 12 Aug 2022 06:34:06 GMT

GET
H3-29 200 11678069764059861340_10614671200080963018.png
static.doubleclick.net/dynamic/5/50115700/ Frame 86C0 384 B
407 B 20ms
7ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/50115700/11678069764059861340_10614671200080963018.png

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efe5b6d12c0b9d78012391db481d5d6037aef98b7288d1d5c730f6c1872a3a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 19:53:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 08 Aug 2021 13:36:25 GMT
server: sffe
age: 588144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 384
x-xss-protection: 0
expires: Tue, 09 Aug 2022 19:53:43 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 350 B
178 B 446ms
445ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=2765846439262639&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C970x90%7C300x250%7C250x250%7C468x60%7C320x100%7C200x200%7C180x150%7C125x125%7C234x60%7C728x90%7C320x50&fluid=height&prev_scp=a%3D%257C124%257C%26iid1%3D8203161228871487%26eid%3D8203161228871487%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-1-8203161228871487%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D260%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2&eri=1&cookie=ID%3Dd0ac330df6d86dba%3AT%3D1629126965%3AS%3DALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q&bc=31&abxe=1&lmt=1629126967&dt=1629126967654&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=310&adys=1991&adks=1854148200&ucis=4&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=981x264&msz=981x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

f36208176fcc39db1577d9ccca9dc171215a06965d40886e093e8bfad122c8ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 72ms
24ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthebirthdaybest.com%2F&domain=thebirthdaybest.com&cw=1

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://thebirthdaybest.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://thebirthdaybest.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1523
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthebirthdaybest.com%2F&domain=thebirthdaybest.com&cw=1
https://mug.criteo.com/sid?cpp=QJgLEHx3MjZrRndiTUJNMUU3Sm5kWWRpOXVFR1U3NlJLWUhUQ3pwZk5NVkNpQXd3WjVkWHU4Q2VjWXM0b3QvTUYwbE9jNEYrR0tITlNTU21TWHkvQ3duamVpQUwrMGlGbit4aElOSk9LVWM2dTVGT2dYZmh1dm5BL0FkVV...

352 B
607 B

58ms
20ms

XHR
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=QJgLEHx3MjZrRndiTUJNMUU3Sm5kWWRpOXVFR1U3NlJLWUhUQ3pwZk5NVkNpQXd3WjVkWHU4Q2VjWXM0b3QvTUYwbE9jNEYrR0tITlNTU21TWHkvQ3duamVpQUwrMGlGbit4aElOSk9LVWM2dTVGT2dYZmh1dm5BL0FkVVEzSytBcE5KakFsSnpleDMxM2hEQ05hNWZmbDhMR2IrYUVzU2JyaVY2a2JDa1ljZXRJN3pkUFc1SlVkM3RiTGx6Q1Uvd21DWWJIWlJ1bEx6UUNRQ3YwWXBTbHZIbWROUENmVzJYbkRJYTRETVBVelYwOWNzPXw&cppv=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

5f5ff619ccfeffd7977c31bacda457d8dc10d166168841e28f04cf509b431077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 16 Aug 2021 15:16:07 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3095
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Aug 2021 15:16:07 GMT
location: https://mug.criteo.com/sid?cpp=QJgLEHx3MjZrRndiTUJNMUU3Sm5kWWRpOXVFR1U3NlJLWUhUQ3pwZk5NVkNpQXd3WjVkWHU4Q2VjWXM0b3QvTUYwbE9jNEYrR0tITlNTU21TWHkvQ3duamVpQUwrMGlGbit4aElOSk9LVWM2dTVGT2dYZmh1dm5BL0FkVVEzSytBcE5KakFsSnpleDMxM2hEQ05hNWZmbDhMR2IrYUVzU2JyaVY2a2JDa1ljZXRJN3pkUFc1SlVkM3RiTGx6Q1Uvd21DWWJIWlJ1bEx6UUNRQ3YwWXBTbHZIbWROUENmVzJYbkRJYTRETVBVelYwOWNzPXw&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2071
content-length: 482
expires: 0

POST
H/1.1 200
OK cookie_sync Show response
pb-server.ezoic.com/ 269 B
642 B 313ms
102ms XHR
application/json 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-server.ezoic.com/cookie_sync
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 14375082f18c8501a36b803a80a3489476d037a97867ffa2a1aae1b65df4fa57

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:07 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://thebirthdaybest.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 269
Expires: 0

POST
H/1.1 200
OK auction Show response
pb-server.ezoic.com/openrtb2/ 152 B
510 B 329ms
118ms XHR
application/json 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pb-server.ezoic.com/openrtb2/auction
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 7919f4fde13d727f94f345387ca96bca80fcd67d546b711a9dcb78c51f30cc91

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:07 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://thebirthdaybest.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 152
Expires: 0

POST
H2 204 mvo Show response
tag.1rx.io/rmp/215626/0/ 0
175 B 135ms
107ms XHR
text/plain 213.19.147.42
LEVEL3

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=5.5,2.1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://thebirthdaybest.com
pragma: no-cache
date: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: Tengine

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
288 B 80ms
40ms XHR
application/json 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=34&wv=5.5.0&cb=69283716972
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://thebirthdaybest.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
118 B 158ms
126ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://thebirthdaybest.com
date: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
701 B 55ms
25ms XHR
application/json 185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:07 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3dc511ea-24c8-4bcd-9fb6-2dc6054f521a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://thebirthdaybest.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
701 B 59ms
30ms XHR
application/json 185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:07 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 78ef3075-8f9a-414e-9fe7-0b934087558f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://thebirthdaybest.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 lazy-images.min.js Show response
thebirthdaybest.com/wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/src/js/ 9 KB
3 KB 32ms
32ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/src/js/lazy-images.min.js?screx=1&sxcb=8a&ver=1.0.0
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 245e542efded75af621b3a93818490cd57df8a41da0333184f643e2071c9ea0e

Request headers

:path: /wp-content/plugins/jetpack/vendor/automattic/jetpack-lazy-images/src/js/lazy-images.min.js?screx=1&sxcb=8a&ver=1.0.0
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "23dc-5c462a91d8cd9-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;78463377e8632ce623088eaf8e03245b;2-185419-22;029a7228-2f2e-4ec3-5d39-4029bd1343eb
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 0.00% 9180 / 9180
x-middleton-response: 200
content-length: 3013

GET
H2 200 sweetalert2.all.min.js Show response
thebirthdaybest.com/wp-content/plugins/highlight-and-share/js/ 71 KB
18 KB 35ms
35ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/highlight-and-share/js/sweetalert2.all.min.js?screx=1&sxcb=8a&ver=7.28.4
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 18f9caf1c080d25a5fcc3b5aafdd1831fd50c74f920e4e1334e7ee99bd73529c

Request headers

:path: /wp-content/plugins/highlight-and-share/js/sweetalert2.all.min.js?screx=1&sxcb=8a&ver=7.28.4
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "11c3c-5c52d80f19174-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;c6f2a630b23aa0b17fe32d9569b3e11e;2-185419-22;e32afd64-ea2a-413e-435e-e10fb1fccddd
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 0.00% 72763 / 72764
x-middleton-response: 200

GET
H2 200 wp-polyfill.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/dist/vendor/ 97 KB
32 KB 77ms
76ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/dist/vendor/wp-polyfill.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

7107d3b3a6eb6196ff452a002a58a6221a5471626550f610ceb5fe4ba01a0aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/dist/vendor/wp-polyfill.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspva=1; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
x-ezoic-cdn: Hit ds;mm;ff4ff9fafde27cbaf0c2452e35c52a78;2-185419-22;ff7f4727-51e4-402b-4287-dac4b76467ed
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
x-middleton-display: staticcontent_sol
cache-control: public, max-age=2592000
strict-transport-security: max-age=15552000
timing-allow-origin: *
x-middleton-response: 200

GET
H3-29 200 container.html Show response
8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E46C 6 KB
3 KB 22ms
8ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 16 Aug 2021 15:16:02 GMT
expires: Tue, 16 Aug 2022 15:16:02 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxOTIyMDg5MjYwODYzMDQxIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDAxNiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE5MjIwODkyNjA4NjMwNDEiLCJkb21haW5faWQiOiIxODU0MTkiLCJ1bml0IjoiZGl2LWdwdC1hZC10aGViaXJ0aGRheWJlc3RfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM4MTQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE5MjIwODkyNjA4NjMwNDEiLCJkb21haW5faWQiOiIxODU0MTkiLCJ1bml0IjoiZGl2LWdwdC1hZC10aGViaXJ0aGRheWJlc3RfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI3MTYxNDM5NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiJ6ZXJvIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxOTIyMDg5MjYwODYzMDQxIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAuMDAwMDAyLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDAyLCJiaWRfZmxvb3JfcHJldiI6MC4wMDAxNiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE5MjIwODkyNjA4NjMwNDEiLCJkb21haW5faWQiOiIxODU0MTkiLCJ1bml0IjoiZGl2LWdwdC1hZC10aGViaXJ0aGRheWJlc3RfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM4MTQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE5MjIwODkyNjA4NjMwNDEiLCJkb21haW5faWQiOiIxODU0MTkiLCJ1bml0IjoiZGl2LWdwdC1hZC10aGViaXJ0aGRheWJlc3RfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjcxNjE0Mzk0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzODE0LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI3MTYxNDM5NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:05 UTC

GET
H2 200 71614394 Show response
g.ezoic.net/dac/ 0
17 B 18ms
17ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/71614394
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/porpoiseant/banger.js?cb=195-0&bv=58&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
42 B 17ms
16ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:09 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NjgsImFkX3Bvc2l0aW9uIjoxMTAwLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjMwMCwiYmlkX2Zsb29yX3ByZXYiOjE2LCJiaWRfZmxvb3JfZmlsbGVkIjowLCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozNDEsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NzE2MTQzOTR9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NjgsImFkX3Bvc2l0aW9uIjoxMTAwLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjMwMCwiYmlkX2Zsb29yX3ByZXYiOjE2LCJiaWRfZmxvb3JfZmlsbGVkIjowLCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozNDEsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NzE2MTQzOTR9XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:07 UTC

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 64ms
19ms Preflight
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 999
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame E46C 0
0 43ms
43ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C5j5eN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5AFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl1oRuhD2ogypp83_jfbMkeZq5DgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OIAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4GL7JBw&sigh=aJwqSRu2KzE
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s46-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 204 winResponse
prod-rtb.ad4mat.net/ Frame E46C 0
0 32ms
17ms Fetch
image/gif 2600:1901:0:76b9::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prod-rtb.ad4mat.net/winResponse?a=1k8dv22zpnwwyet27naq0e4qvqta91931xhv88qmahm6pj4t2sv46gppxn3p3vycr1ct6rxhcz4wh915ejcyd764kqan1ycw2d5cvqpc3aqg1jp2114a8tqxck2816t59dr4j8q5wpevk4wvewkvv1e6qe587d65fzeafghk9c5v7mzkbffd2raasn2aeegp2qgs3t7hmkazjydyfg8aanpqg9yjjdx233ap0emcepgax15rbx6qn4vhdkjbnfh9fanyxw7j3cj7y5yx68g4faap93gajp0226mnc6mq66j6e1tv68e3zn8bxnrpb4ywg97ehv51ykjaxwj2p6dgj882mdepana834y75nc659g5143vn9yn0nz057b92xzgntk4zdey0py4we38&b=YRqBNwAH870Ke5YPAA_EJSs67oZEf03ArAHcqQ
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Aug 2021 15:16:07 GMT
via: 1.1 google
alt-svc: clear
content-type: image/gif

GET
H2 200 dr Show response
ad4m.at/ad/ Frame 5374 2 KB
2 KB 57ms
42ms Document
text/html 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de5c6a54557523ce453b6d7a69b82083d77366e635eced1d8526010f9ee1850a

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

:method: GET
:authority: ad4m.at
:scheme: https
:path: /ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires: 0
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
content-security-policy: block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy: same-origin
pragma: no-cache
surrogate-control: no-store
x-fastcgi-cache: BYPASS
x-backend-server: adsrv-7b12
via: 1.1 google
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 67fb9f3d4d6f05f1-FRA
content-encoding: br

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame E46C 2 KB
1 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:15:50 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1CE8 1 KB
864 B 6ms
5ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 16 Aug 2021 11:56:19 GMT
expires: Tue, 17 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 11988
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E46C 124 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628854326415524"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:07 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame E46C 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:12:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:12:39 GMT

GET
H3-29 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame E46C 22 KB
7 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 13 Aug 2021 20:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 240018
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 13 Aug 2022 20:35:49 GMT

GET
H2 200 i18n.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/dist/ 9 KB
3 KB 24ms
24ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/dist/i18n.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

af8d80b7b208e83bdfd8218f77b18317b5e5f50b251b5b180aece1e8490a79a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/dist/i18n.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;8907f008537f9e268504ce3c7d429efc;2-185419-22;da082e8e-af59-4a6e-6ff3-dc947d7e9cf8
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 3426
x-nc: HIT hhn 2
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
strict-transport-security: max-age=15552000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
timing-allow-origin: *

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 1CE8
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESED2_GWW3H3oCmN5fQgfx4pc&google_cver=1&google_push=AYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts&r...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESED2_GWW3H3oCmN5fQgfx4pc&google_cver=1&google_push=AYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts...

43 B
417 B

165ms
163ms

Image
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESED2_GWW3H3oCmN5fQgfx4pc&google_cver=1&google_push=AYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 67fb9f3e9a9fd6fd-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 447
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 67fb9f3d8895d6fd-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESED2_GWW3H3oCmN5fQgfx4pc&google_cver=1&google_push=AYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPLxc6hxFSpC_7VGH-9JNEq1qTlpq3o5PIqjsdpTWaWgzgXgBDGx7URFXYJiFnciwXUS5T1EttbXe87v_ExR9Vr9uTh46ts%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1CE8
Redirect Chain

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEFB5YuqvxTXzWYocOjTAJDg&google_cver=1&google_push=AYg5qPL5oBL1HyJxxL3rCOPOs4V7k3OewVujAMyLaC0wVuJfAi4uHn-E52htT3Racy3DB...
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL5oBL1HyJxxL3rCOPOs4V7k3OewVujAMyLaC0wVuJfAi4uHn-E52htT3Racy3DBqvb6W7wr-hGtG5XQkLUtChC4dBh0GG7&google_hm=QWsyRUZsSEF5alp2dW9BY1pl...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL5oBL1HyJxxL3rCOPOs4V7k3OewVujAMyLaC0wVuJfAi4uHn-E52htT3Racy3DBqvb6W7wr-hGtG5XQkLUtChC4dBh0GG7&google_hm=QWsyRUZsSEF5alp2dW9BY1plQ0xXTnc=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL5oBL1HyJxxL3rCOPOs4V7k3OewVujAMyLaC0wVuJfAi4uHn-E52htT3Racy3DBqvb6W7wr-hGtG5XQkLUtChC4dBh0GG7&google_hm=QWsyRUZsSEF5alp2dW9BY1plQ0xXTnc=
Date: Mon, 16 Aug 2021 15:16:08 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1CE8
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=t_PTb09wTx2def_VaFJiLA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

32ms
17ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=t_PTb09wTx2def_VaFJiLA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKejzgdYHBwFgTW8r5mmVbIQxNFrwAgD4yuav6rBTVJptBpte39UeMQlMk3jiG_Q-h11tXW0O-jIYBePJbi9LRKNyUikpN3

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=t_PTb09wTx2def_VaFJiLA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKejzgdYHBwFgTW8r5mmVbIQxNFrwAgD4yuav6rBTVJptBpte39UeMQlMk3jiG_Q-h11tXW0O-jIYBePJbi9LRKNyUikpN3
date: Mon, 16 Aug 2021 15:16:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1CE8
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEMimzrruJIE53RcwdVIvWpU&google_cver=1&google_push=AYg5qPJfIWbM9tQwJlPSO2bdfX_5p6WLvmWqTcyDzOHGGWjZI6bqS-SsroCqdKYlWYtyN_jcIQFBTt2bof5Gf4_P...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJfIWbM9tQwJlPSO2bdfX_5p6WLvmWqTcyDzOHGGWjZI6bqS-SsroCqdKYlWYtyN_jcIQFBTt2bof5Gf4_PO9zw5fc5EUlH

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJfIWbM9tQwJlPSO2bdfX_5p6WLvmWqTcyDzOHGGWjZI6bqS-SsroCqdKYlWYtyN_jcIQFBTt2bof5Gf4_PO9zw5fc5EUlH

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 16 Aug 2021 15:16:07 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPJfIWbM9tQwJlPSO2bdfX_5p6WLvmWqTcyDzOHGGWjZI6bqS-SsroCqdKYlWYtyN_jcIQFBTt2bof5Gf4_PO9zw5fc5EUlH
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: UDVczdnk93Jjq-QbSlzbMc34ugM8R9ESNe2BzcATLlbdzjERYvdnRQ==

GET
H2 204 exptsync
ads.yieldmo.com/ Frame 1CE8 0
35 B 97ms
32ms Image
text/plain 54.77.232.22
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/exptsync?google_gid=CAESEEViVWZmNJQhUJcUsZk4SzA&google_cver=1&google_push=AYg5qPLbx2qeUBNMW7yotT86cpCbOCA-D3ZzcyQgYuKkoEzKUGMBH6l4Uvp0IGC4mLVYis1OMnI5300A0IuX2A-0Jta1zYNOWloa
Requested by: Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.232.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-232-22.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 1CE8 0
44 B 877ms
243ms Image
text/plain 54.250.62.115
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEHCVCKavc3NxsKv0lbFNx9A&google_cver=1&google_push=AYg5qPKCnOnl0tHYfkovGgledwW1ljo5lGmXLqY6A64Jhnm_avgKutE7bCTw1hH5v7V6YEUuRkrcDKquth2jdx9pq-WtQ2RCiSM
Requested by: Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.250.62.115 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-250-62-115.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
server: awselb/2.0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 1CE8
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQE...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQE...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pz...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEBbQFH5R4k_e3bui13LSymA&google_cver=1&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pz...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlMWFmZjlmZS1mZWE0LTExZWItOTAwZS0wMjg0MjU5YTg1MmE%3D&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-...

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlMWFmZjlmZS1mZWE0LTExZWItOTAwZS0wMjg0MjU5YTg1MmE%3D&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 16 Aug 2021 15:16:08 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBlMWFmZjlmZS1mZWE0LTExZWItOTAwZS0wMjg0MjU5YTg1MmE%3D&google_push=AYg5qPJJzWd_5jreMYwYr3zNNdo53zvCyb-bMgfafS576Kls06-_pzQEgZz1V1Cly-RJxcKPqEm28K1PqTsHanFc39gwulkwZBEH
Connection: keep-alive
Content-Length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 1CE8 0
253 B 41ms
14ms Image
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JLBdm6EaZC1yXklPRyK1GuXXQ8h6FALZU3Ew25_ZcD_R2c741JZLvA0S3tBU4172oigj_iKQ

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E46C 0
0 27ms
27ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=eos&id=eos-base&v=20210813&bin=7&avms=ns&bs=0,0&if=1&app=0&itpl=20&adk=2463953556&rs=4&cr=0&vs=0&eosm=2&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame E46C 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc29f13fb94cae8a4c37c09492574b3f35ad607cb0da8a65005ba15c73dc1f4f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 highlight-and-share.js Show response
thebirthdaybest.com/wp-content/plugins/highlight-and-share/js/ 19 KB
3 KB 35ms
34ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/wp-content/plugins/highlight-and-share/js/highlight-and-share.js?screx=1&sxcb=8a&ver=3.5.5
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d167ba406bee58c34a8698ba5157f4e6ebba4a5fd7353f11cc7d2d304c882238

Request headers

:path: /wp-content/plugins/highlight-and-share/js/highlight-and-share.js?screx=1&sxcb=8a&ver=3.5.5
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
display: staticcontent_sol, staticcontent_sol
etag: "5941-5c52d80f1454b-gzip-gzip"
x-ezoic-cdn: Hit ds;mm;ab6cd8d642205255ec302ccd43973e80;2-185419-22;5e2ae9a9-fa8d-400f-627a-3989ce931ee8
content-type: application/javascript
x-middleton-display: staticcontent_sol, staticcontent_sol
cache-control: public, max-age=31536000
x-ez-minify-js: 16.14% 19262 / 22970
x-middleton-response: 200
content-length: 2916

GET
H3-29 200 default.css
ad4m.at/0.1.124-320/style/one-ad/ Frame 5374 58 KB
59 KB 37ms
25ms Stylesheet
text/css 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/0.1.124-320/style/one-ad/default.css
Requested by: Host: ad4m.at
URL: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 494627acb3c86254c238efaf66afcaf30d4293c7512a37a72b51a380d55e3880

Request headers

Referer: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=/Fheiw==, md5=iazLgrLD9V76ltPySV8jTQ==
date: Mon, 16 Aug 2021 15:16:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4250629
cf-polished: origSize=59196
x-guploader-uploadid: ADPycdtkioITd9kON3MDPr-nVhtDYZvM5BcWwBJS7eF-ZszN4EdBaLdVcBmWoP0vGtgvogL9Lz8Tib9QpKYbbvav9lA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 58969
last-modified: Mon, 28 Jun 2021 10:31:59 GMT
server: cloudflare
etag: "89accb82b2c3f55efa96d3f2495f234d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n4Lwsq0g9VuAB6OSc17PfDG7hOL%2F%2FpbQOtZG5536Fecgp5z5uGNBvRT3%2BLH2nQNCYBj99yJuxD7vichlMird3kkv%2BkjZbyluXzH1oyyIaZfPdJY9gWCTTiC7v93E1g4d%2BHgSmYw%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1624876319573767
content-type: text/css
expires: Tue, 28 Jun 2022 10:32:18 GMT
cache-control: public, max-age=31536000, no-transform
x-goog-stored-content-length: 6688
accept-ranges: bytes
cf-ray: 67fb9f3db96b4303-FRA
cf-bgj: minify

GET
H3-29 200 r62eglto.js Show response
ad4m.at/ Frame 5374 36 KB
13 KB 29ms
19ms Script
application/javascript 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: ad4m.at
URL: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e7dd4c381646efaad474d11deab4dd03f41d843427b2089e3fadfa8fbe2af7e

Request headers

Referer: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=jcf8Ug==, md5=qd/mwb1lyCwybbA2JKos5w==
date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 18480
x-guploader-uploadid: ADPycdtMXFu2325pthKcNMuZ1qbNrHqs-JI7S2aXHNNHyxKsQrBowXmY2D-bKpDvcHW6CRcSa4WTqE9QmZkF5G2-bOE
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
last-modified: Tue, 10 Aug 2021 10:07:45 GMT
server: cloudflare
etag: W/"a9dfe6c1bd65c82c326db03624aa2ce7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Lj9ep05CVz7ez1G88EOVzrsj6k6MLUoTCbLXBG2w5ne2Rx1ij8x72Ta9%2FP48zZUHppJtjGa%2Fu1Z09rSw4UVVBo7bdIUeaZyapLtrRyUhIJrycDE7UivnDVi5TmSQuYh70jNGnCk%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1628590065783018
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length: 11929
cf-ray: 67fb9f3db9674303-FRA
expires: Mon, 16 Aug 2021 10:08:07 GMT

GET
H2 200 wp-embed.min.js Show response
thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/ 2 KB
819 B 22ms
21ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://thebirthdaybest.com/ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/wp-embed.min.js?screx=1&sxcb=8a

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

5827adb70b8322616b409c3230bd1a69a203870fe0e77b2d19c74d36053c3a81

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:path: /ezossp/https/c0.wp.com/c/5.4.6/wp-includes/js/wp-embed.min.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:07 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;283a19721c4815df5c39da8bf0fe590b;2-185419-22;c66ebc48-11d8-453e-73c4-5c041a3a44ff
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 712
x-nc: HIT hhn 2
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
strict-transport-security: max-age=15552000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000
timing-allow-origin: *

GET
H2 200 adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame 5374 3 KB
4 KB 35ms
15ms Image
image/png 2606:4700:3032::6815:57ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by: Host: ad4m.at
URL: https://ad4m.at/0.1.124-320/style/one-ad/default.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:57ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Referer: https://ad4m.at/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5884586
x-guploader-uploadid: ABg5-UzzLZaEcDbjdbhukLGh7tDKAZOMFJOiU4iHwOPl8QLDCjazkiciYkkK8qFWGCtZPjDfwbZeIl1PxPDK-jxIb2s
x-goog-storage-class: STANDARD
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 3262
x-goog-meta-
last-modified: Wed, 09 Jun 2021 12:35:14 GMT
server: cloudflare
etag: "794c84d30e213ec6a144d64215f07551"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=27UHVyDAu49g0ZBxc7cm2TaQ29kZcNnxbnuEP02C6Bbcu8W5NPXyZRUPylIBYU0cXceGErgX6TgJEWBpHStUe9tpjPD0UdWTg%2BpA1I1W%2FVsgDxlxwWE4SEGXgbO4zq4Ulss%2BMbUTDRp01RfZO6XzOChn9A%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1623242114099744
content-type: image/png
cache-control: public, max-age=31536000, immutable
x-goog-stored-content-length: 3262
accept-ranges: bytes
cf-ray: 67fb9f3e299642f1-FRA
expires: Thu, 09 Jun 2022 12:39:42 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3954 2 KB
872 B 26ms
8ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

ee22f683394ec9d609b8c7b90e446dc4fde1cdcf0895322f7004078b5d3ed549

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 780
strict-transport-security: max-age=15552000

GET
H3-29 200 frame.html Show response
ad4m.at/ Frame 33CE 2 KB
2 KB 15ms
14ms Document
text/html 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

:method: GET
:authority: ad4m.at
:scheme: https
:path: /frame.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
content-type: text/html
x-guploader-uploadid: ABg5-UyHG4nMyrBK5WNqT49HT3fkOWy09Qi7AMHmefEGKv6EedjpZshPX4m1mr0_df4AnWlv4nSV1j8tT1-PHgSflkckYhyoGQ
expires: Mon, 16 Aug 2021 16:16:08 GMT
last-modified: Wed, 06 May 2020 15:09:30 GMT
x-goog-generation: 1588777770164783
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1681
content-language: en
x-goog-hash: crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-storage-class: MULTI_REGIONAL
age: 126546
cache-control: public, max-age=3600
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-cache-status: HIT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hxsLVNGPiPRfmKIoy5VwAD%2B6mgPj5%2B7lSYNW2nBGdae39Qp4vNZhkNl4EyF7L3zjIV8aRopOZ6%2FlwHGvPRGL48lLuHrz%2FRfSRA4NPqkx%2FzJBr4xr%2Bw97JqHgwEUwtVi%2BFKSvMiI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 67fb9f3e1a7a4303-FRA
content-encoding: br

GET
H2 200 e-202130.js Show response
thebirthdaybest.com/ezossp/https/stats.wp.com/ 9 KB
3 KB 48ms
48ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/ezossp/https/stats.wp.com/e-202130.js?screx=1&sxcb=8a
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

:path: /ezossp/https/stats.wp.com/e-202130.js?screx=1&sxcb=8a
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn
date: Mon, 16 Aug 2021 15:16:08 GMT
content-encoding: br
etag: W/"5c6340e3-350a-gzip"
server: nginx
x-origin-cache-control: max-age=31536000
x-ezoic-cdn: Miss
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
x-middleton-display: staticcontent_sol
cache-control: public, max-age=2592000
x-middleton-response: 200
vary: Accept-Encoding Accept-Encoding,User-Agent,Origin
content-length: 2816

GET
H/1.1 200
OK setuid
pb-server.ezoic.com/ Frame 3954 0
465 B 102ms
102ms Image
text/plain 52.205.247.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pb-server.ezoic.com/setuid?bidder=onetag&gdpr=0&gdpr_consent=&uid=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?redir=https%3A%2F%2Fpb-server.ezoic.com%2Fsetuid%3Fbidder%3Donetag%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7BUSER_TOKEN%7D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.205.247.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-247-225.compute-1.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:08 GMT
Server: nginx/1.14.0 (Ubuntu)
Vary: Origin
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

POST
H3-29 200 rs Show response
ad4m.at/ Frame 5374 1 KB
2 KB 34ms
33ms XHR
text/plain 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ceb0c4a7c517e56215c8bed93d88e391028dd3adabe0193a8f7a282b2370ee33

Request headers

Referer: https://ad4m.at/ad/dr?ed=1gvhag25aktybwjnk3ztcfvvg2dzrqf7s1ratthkyw0n18qhf9teq082jzjkjvm1pkgvfawd2cqh50dc7zv55cyv44xfxfkwtkzfyj8wr3be3h2cqg7rjyqfsz23k8fjt5q6hhpxmxg7yrfg3cn1d7jq8467apqa21d5zb27bqjb13tctdeh3w84ynwtrkp4n0sqw42a6hrfka8211x6mr2gs043atwed4gnyftv5v0f8s87kbpbwnz7sjrna8zt0m27gx08j49zezgq5w6tqd8grwqrhg7bpybcntw90hg6n7c0szqj3y32c3emwg82g8f8wfwqtg57k9t0t8ty3fxfd0asa1dnyh4j37h6b0f9x5dv1j1bgrqgc8zmaw4s7gema17zdas2gf82&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%26client%3Dca-pub-6396844742497208%26adurl%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

cf-ray: 67fb9f3e4b1a4303-FRA
date: Mon, 16 Aug 2021 15:16:08 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hOpZDpWVl3RBCs7tcQ%2FE1Jq7PRQOFE0iqtrQxvoaFB5o1YupChWPbNgl6UKEIR1ovvgb2Jnu%2BhcKKzuiUq15FzhaR6Wx9FleQmWQeJQsDpjJlqsbDgpby3UeKwOESwg6Iavi%2FME%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://ad4m.at
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
access-control-allow-credentials: true
content-encoding: br
x-backend-server: rs-rvz5

GET
H2 200 g.gif
pixel.wp.com/ 50 B
123 B 22ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A9.1.1&blog=166788029&post=0&tz=0&srv=thebirthdaybest.com&host=thebirthdaybest.com&ref=&fcp=621&rand=0.7709401212736007
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 rar Show response
as.ad4m.at/ad/ Frame 3AB5 10 KB
4 KB 43ms
42ms Document
text/html 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c2ad09a37894ce143c8b9040a1f851b2263d1e4a583499a0de30daa9d5fd31f

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: as.ad4m.at
:scheme: https
:path: /ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
content-type: text/html; charset=utf-8
strict-transport-security: max-age=86400; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
x-download-options: noopen
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
x-xss-protection: 1; mode=block
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
referrer-policy: same-origin
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
expires: 0
surrogate-control: no-store
pragma: no-cache
via: 1.1 google
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 67fb9f3e885105f1-FRA
content-encoding: br

GET
H3-29 200 default.css
as.ad4m.at/ad/style/0.1.7/one-ad/ Frame 3AB5 64 KB
8 KB 33ms
33ms Stylesheet
text/css 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.7/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c35529095f6b1a1b2f9345e8d7e86532048ffbfdd082f03ed114be88865388df

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 16
cf-polished: origSize=65497
surrogate-control: no-store
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
expires: Mon, 16 Aug 2021 16:16:08 GMT
last-modified: Mon, 09 Aug 2021 09:04:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-download-options: noopen
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=3600
cf-ray: 67fb9f3eccf64303-FRA
cf-bgj: minify

GET
H2 200 4A5549650408967BD5DF9A196BD4C01CAF985DFA9DCF12326966D7539D4A572C5D4CC78E9EDF3400AA9433BBD4523C204B259962511F29492E1402A283970906
assets.ad4m.at/logo/ Frame 3AB5 10 KB
10 KB 42ms
34ms Image
image/webp 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/4A5549650408967BD5DF9A196BD4C01CAF985DFA9DCF12326966D7539D4A572C5D4CC78E9EDF3400AA9433BBD4523C204B259962511F29492E1402A283970906
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f33061bee42031c568f051b2780bf79ebad5fd3d22d5f86bc2f7b885b5ab4c20

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=Ep0KOA==, md5=ySGRFLV5Yc2+qK6vJpqQVA==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 359102
cf-polished: origFmt=png, origSize=31661
x-guploader-uploadid: ADPycds35xIUV4bnJKk2BarqhdXHHBlnX44lFFfh1jGY9SipsFs6_sWer2xJiIHxOMaq0vg1I-8B4vdwXAiu5R95VQ-rRKYMVA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 9746
last-modified: Wed, 17 Mar 2021 12:30:03 GMT
server: cloudflare
etag: "c9219114b57961cdbea8aeaf269a9054"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rn1ZmjJfb4YWvArsZUjrjhnS2OyHG9DTci0rrTWryf%2BkeVWaeLSYpu9QhfGipDiO4wVsNR6%2BTZTyukXpao6f2X2GD0UYGFe5e3k4m%2FJbWl1EEBHxrnaOnA%2BG3rEzUq9l4tIDtUsSTuGNKxC7"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1615984202963124
content-type: image/webp
expires: Tue, 17 Aug 2021 15:16:08 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 31661
accept-ranges: bytes
cf-ray: 67fb9f3ed90c05f1-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 9AFE78C7A67F08046BEA26EA7CCA0E524C012852A5B15EEA08AE8D61D736B58A88D02AFB55972041B93852CD741DC7B35BCD0E870012E77E2A86230960D2E34C
assets.ad4m.at/product_image/ Frame 3AB5 145 KB
146 KB 33ms
26ms Image
image/webp 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/9AFE78C7A67F08046BEA26EA7CCA0E524C012852A5B15EEA08AE8D61D736B58A88D02AFB55972041B93852CD741DC7B35BCD0E870012E77E2A86230960D2E34C
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca9e35504318e860fd9ad0ed48f1e313d5c232391cd258cced001d2c36f2a805

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=GQpHpg==, md5=wVvpthF+crZQXHBVA/Ujrw==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 406169
cf-polished: origFmt=png, origSize=241955
x-guploader-uploadid: ADPycdvw0reh8fRKWRY8R_tSpY4AH5K7mASQgCqFxbFbI53n69LVkNR7aSCSXfhpivoD1pl6upU0PfXwvAghhFi8P67Ury1wyQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 148480
last-modified: Thu, 18 Mar 2021 11:14:45 GMT
server: cloudflare
etag: "c15be9b6117e72b6505c705503f523af"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TqP2V6cl5BwvJZ3fbFAbNRqvVJlB%2FPQMtHhzJDrKBt4gdfoil6084ELci%2FjuyIRsmvHWuGJPN6rXASdKB2WjtcdAOHtKFnGJjh%2BBBIuvVuHFx924Gr2%2F5w1224oFmyWqhN6dpK7QZ3S76kii"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1616066085540159
content-type: image/webp
expires: Tue, 17 Aug 2021 15:16:08 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 241955
accept-ranges: bytes
cf-ray: 67fb9f3ed90505f1-FRA
cf-bgj: imgq:85,h2pri

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 3AB5 43 B
703 B 28ms
12ms Image
image/gif 2.19.44.80
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2833757&v=19122&q=408608&r=412871&pv=1&pref3=oneidGK9hBfYps6MAWaKHeHGtPt797aJtYTEroneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2.19.44.80 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-19-44-80.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:08 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H2 200 C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
assets.ad4m.at/logo/ Frame 3AB5 12 KB
13 KB 41ms
34ms Image
image/webp 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/C35143419725FFAB72E7F85B0896E2CE1CF38E8530EF6A0FABB9A59404159EF275766FB79658D3B5D6644C20EACFACC3D3AEC4962CC34DBF676104F9A9E97E4B
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47ec02e18941bc1fe215e0bf1b47eaef6dd674b8adfb18d17e980203a94b9ff4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=L9xAnQ==, md5=7eHZFVWQuqeYNRiE/JSb0A==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 339779
cf-polished: qual=85, origFmt=jpeg, origSize=42488
x-guploader-uploadid: ADPycds_ff39cNYks-HrQTvg8tTbxlVlNaFqDbBWoAQj0fZTdiydSlpKENIxqP8nrPbVSiHIVkYkY8vH22ZJRaFyfbnpvmqOyg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 12110
last-modified: Thu, 25 Jun 2020 11:29:58 GMT
server: cloudflare
etag: "ede1d9155590baa798351884fc949bd0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w9EjNpKExX24OdKaLpPn9MiXtxu8Ftq8gAAecXUx5Pyul8muBCsT0qfO2e52U%2FGGR5rtP6g%2Fcw%2B1jkmUqkC7A33NBOVv2CrafpksncUWB20tZyi07qRKNk9UwZOqbRgeigT9aaafckKxC0VJ"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1593084598972955
content-type: image/webp
expires: Tue, 17 Aug 2021 15:16:08 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 42488
accept-ranges: bytes
cf-ray: 67fb9f3ed90305f1-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 923D00671464A79AB8F5A4D24C6EC1A73106E56CEC9EDBA6FEF5B85C7B989BE16BF3D56DE07928CA9478BB4C2FED672AA5830E4C9B7151DF5F61E460DF9EF305
assets.ad4m.at/product_image/ Frame 3AB5 10 KB
11 KB 40ms
34ms Image
image/webp 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/923D00671464A79AB8F5A4D24C6EC1A73106E56CEC9EDBA6FEF5B85C7B989BE16BF3D56DE07928CA9478BB4C2FED672AA5830E4C9B7151DF5F61E460DF9EF305
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48cf094bb5fdbb58ada2fe3c5241c7ebde724561c670eb2d84c18aa8a4768f9c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=15VnvA==, md5=DWn9kTb7sWn6Y1aNbHZabA==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 576909
cf-polished: qual=85, origFmt=jpeg, origSize=12438
x-guploader-uploadid: ADPycduD1UmZGL09Ys08otAloZ-u456xBx2L6WpTw0Dlf99MWHfOknjXgSs74SLcnHB6zB69B9ukkhLa5iZGLJvXHv0
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 10372
last-modified: Fri, 18 Sep 2020 09:05:40 GMT
server: cloudflare
etag: "0d69fd9136fbb169fa63568d6c765a6c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=byVCBrRkKHDKuj4c0ODxUzMhP50sVSGtCp7PvrPWHEndwc6zblDFqTjJ80itCI2yqyuaMXwEjKq%2BK4ilbK8Rg9GjNWt5w3431nZzBM9wEBnzONvGVQF5u0GzFZ83zFOXBxcHB5uxCvpR1We0"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1600419940053465
content-type: image/webp
expires: Tue, 17 Aug 2021 15:16:08 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 12438
accept-ranges: bytes
cf-ray: 67fb9f3ed90d05f1-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 188CB8AAD064EA4A8191591B373E95EFBB15091EC45B736DE282B2519499BCCBCAB6FDEDC5113C2A7BE7DE03216809B9DDF8A0A0594CFE95168D455C315D4410
assets.ad4m.at/logo/ Frame 3AB5 8 KB
9 KB 40ms
33ms Image
image/webp 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/188CB8AAD064EA4A8191591B373E95EFBB15091EC45B736DE282B2519499BCCBCAB6FDEDC5113C2A7BE7DE03216809B9DDF8A0A0594CFE95168D455C315D4410
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e49b984d20b3e7cb3f2c4a08805dc3f66bb8a58ec08c365d0cf955dd57c77c7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=tG7Jcw==, md5=BMt+wgXOo1EVeu/7mY86hQ==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 177375
cf-polished: qual=85, origFmt=jpeg, origSize=16723
x-guploader-uploadid: ADPycdtxzSVIJa5wj3PhN0y8BU0kW3aZvFumakmQJSXhWlpBfaVvoT0Dj1OBDv_OZQFr8a89Gelq79MufLskX2eTfA
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 8354
last-modified: Wed, 22 Jan 2020 13:13:07 GMT
server: cloudflare
etag: "04cb7ec205cea351157aeffb998f3a85"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0bXqkt%2BHCUQkc9mE5iCiaTfWG2aAirQQyMcSSDjRv5Q4r4TEv0%2FNczwIuZq97N1Bhj1f%2Bl4by%2Bg6LHB%2FUmHZ8NQ3jAgkNv2kJkoF7t%2FD5svaGKxARw1V3rfsTHcxIAP1PKrCXZqI6xd8n6CI"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1579698787150900
content-type: image/webp
expires: Tue, 17 Aug 2021 15:16:08 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 16723
accept-ranges: bytes
cf-ray: 67fb9f3ed90905f1-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 F49C2EAC44796C3CC36B7EB8176E57DD4979BB6953D52AE3EC354AC4722C65BE111766AA7B1FD623B46255E02B9A1FD3C70187E6A3B399F7EA1DA8FBFD78D485
assets.ad4m.at/ Frame 3AB5 35 KB
35 KB 40ms
33ms Image
image/webp 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/F49C2EAC44796C3CC36B7EB8176E57DD4979BB6953D52AE3EC354AC4722C65BE111766AA7B1FD623B46255E02B9A1FD3C70187E6A3B399F7EA1DA8FBFD78D485
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffbf2d2525e0baabd5fdf5289510e03e86ccb28dc9767ef58bf483077f3bfc75

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=DWwdxw==, md5=nrQF3oFd2dnh8eRzIt323A==
date: Mon, 16 Aug 2021 15:16:08 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 400351
cf-polished: qual=85, origFmt=jpeg, origSize=40264
x-guploader-uploadid: ADPycdvvB6uzlBf85gejyOnLrDvuwZhKKXK1VpRUY0xBynHYzO5RBpdKXBT98Jm2FqkCYGe3d9ZkzSmbZtG7j1wbF8ydhTdT7A
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 35504
last-modified: Wed, 19 Feb 2020 17:37:15 GMT
server: cloudflare
etag: "9eb405de815dd9d9e1f1e47322ddf6dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSS6Jesm02w0wn%2FT%2BWCm%2B9HcrPbXEmrbCKRx5wJMBHC2G%2BKsRGt61CLsOxkYJoXozgbB3%2BFp9dNqBeC0OzrsDcLKoZwAu7SPUHDhSvKXMLXHIM91UK%2FahVsPWoQQ0xmtEZEEvsmSxE%2BTZJh%2F"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1582133835673152
content-type: image/webp
expires: Tue, 17 Aug 2021 15:16:08 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 40264
accept-ranges: bytes
cf-ray: 67fb9f3ed90e05f1-FRA
cf-bgj: imgq:85,h2pri

GET
H/1.1

200

/
banner.congstar.de/cookie/ Frame 3AB5
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N38306.140903ZANOX.COMDE/B22845801.273544483;dc_trk_aid=467891017;dc_trk_cid=64219029;ord=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?https%3A%...
https://ad.doubleclick.net/ddm/trackimp/N38306.140903ZANOX.COMDE/B22845801.273544483;dc_pre=CPLb7PHqtfICFQYHiwodjp4MJw;dc_trk_aid=467891017;dc_trk_cid=64219029;ord=;dc_lat=;dc_rdid=;tag_for_child_d...
https://www.awin1.com/cawshow.php?v=11938&s=2542680&q=367022&r=412871&pv=1&pref3=oneid4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1Eoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0
https://banner.congstar.de/cookie/?sp=awin&spfr=412871&awc=11938_412871_1629126968_e1d9efa0-fea4-11eb-9a09-692d00d40ca2

0
518 B

35ms
11ms

Image
text/plain

148.251.139.77
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://banner.congstar.de/cookie/?sp=awin&spfr=412871&awc=11938_412871_1629126968_e1d9efa0-fea4-11eb-9a09-692d00d40ca2
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 148.251.139.77 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.77.139.251.148.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:07 GMT
Server: Apache
P3P: CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 0

Redirect headers

Date: Mon, 16 Aug 2021 15:16:08 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://banner.congstar.de/cookie/?sp=awin&spfr=412871&awc=11938_412871_1629126968_e1d9efa0-fea4-11eb-9a09-692d00d40ca2
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 3AB5 12 KB
12 KB 182ms
106ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneidX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRMoneid__suite_Netmix_Reach43_Monat&viewref=oneid64rFefw3feAxfeHmHYtktxVmsmt1Tjgoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: a90918a2ae487990634db4f5af82f0e0242cd6f69f3507497a9188232d273c05

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:08 GMT
Last-Modified: Mon, 16 Aug 2021 15:16:08 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D5B3 42 B
64 B 34ms
34ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuVTmes5xiuuvXEvz3kPhhJQf1dOYma85NmWKitZJM7SVwQEEADN2qonlwtl69-W6j0nj8DBj8YiAjAOBT_I2WYHyjm3cGD57u4ucHvSac0EJAuBbKNXlwCS9xj3w&sai=AMfl-YR3jP9INPMSK9u0MfKWlQLqst0g1XyGPLeVd4OrpZpxyQ7pXRO85LbCWxxGqbna7TqTNrmL1BrRr5IT5V_HR-5CuD8W20IPYTKj4vZVfZmQcLMGeECZ5U161xn4&sig=Cg0ArKJSzKRMcMAsOAsaEAE&cid=CAASF-RoEEoIxb2LtfrrxUZBaL8GKSzrXDs7&id=lidar2&mcvt=1000&p=782,651,842,1119&asp=782,651,842,1119&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210813&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=2668505765&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629126967243&rpt=104&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 3AB5 60 KB
61 KB 191ms
18ms Script
application/javascript 65.9.73.121
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneidX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRMoneid__suite_Netmix_Reach43_Monat&viewref=oneid64rFefw3feAxfeHmHYtktxVmsmt1Tjgoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.73.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 056581eb31e79e98718114a4bd8c104cb64eec86bc5a996a28e61220f3aad189

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: zmpZOOhCPWgwSGI0KhEOhezEiMOIyjV9
via: 1.1 3108b3c3c306768051fa0658c0445308.cloudfront.net (CloudFront)
last-modified: Wed, 28 Jul 2021 09:15:25 GMT
server: AmazonS3
age: 19450
etag: "a36c650003d82cecddad8f5c37f2cc75"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Mon, 16 Aug 2021 09:51:59 GMT
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
content-length: 61522
x-amz-cf-id: snIhNE96NHoY2W1XqqyPaGGmjoJeqLEvBA6yeGQCQSoD37u7AsxYsw==

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame 3AB5 79 B
374 B 95ms
33ms Script
text/javascript 81.29.72.47
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=78a44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6STpjB9TjQDKMhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt.gEngMQEjZr_WhXTA2s.XTVV26y8GGEDd5ihORoVyFGh8cmvSuCKzIlnY6xljQlpRDuxfTNJxTqRejPm8LKfAaZ4ySy.aPjftcktBttIVugwcAuyPBDjaY2ftckuyPBB2SCX0iakJ1ilK.v.ua1LtQVD_DJhCizgzH_y3EjNpmVWN9dPBSmmWjV.lV9dYeRJ0mcK4rTOyJ2y6fvqCSFQ_01kKJA237lY5BSmVjMk.7.C&wgcookie=%7B%22wgifp280795%22%3A%5B%221384975%22%2C%22280795%22%2C%223247721%22%2C%22%22%2C%221629126968%22%2C%22%22%2C%22%22%2C%22%22%2C%221636902968%22%2C%22oneid64rFefw3feAxfeHmHYtktxVmsmt1Tjgoneid__suite_Netmix_Reach43_Monat%22%5D%7D&wgchecksum=4eef9a3ff9b496ab575a49208e100a4f&userIP=89.249.64.203&doAffectv=1&wgtime=1629126968
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=3247721&wgcampaignid=1384975&js=1&nw=1&clickref=oneidX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRMoneid__suite_Netmix_Reach43_Monat&viewref=oneid64rFefw3feAxfeHmHYtktxVmsmt1Tjgoneid__suite_Netmix_Reach43_Monat&gdpr_consent=&gdpr=0&gdpr_pd=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 81.29.72.47 Epsom, United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 81-29-72-47.servers.dedipower.net
Software: Apache /
Resource Hash: 17b47a1ed2cd2e1ec86f4735497e2956eb34be0a66fc20b427148f65c6ebaca5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 16 Aug 2021 15:16:08 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 3AB5 25 KB
26 KB 61ms
24ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1384975&viewref=oneidKkMsRfZf8wXu5HMHktPtYdehKtATwYoneid__reach_adf02netmixdc&wglinkid=3247721
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=115792%2C43784%2C15255&b=GK9hBfYps6MAWaKHeHGtPt797aJtYTEr%2C64rFefw3feAxfeHmHYtktxVmsmt1Tjg%2C4PGSEfX5CwQRSGH9HdtAtjWrtdtpT1E&f=VPrSwf6mFr4gWHVHbHAtXC6p6c5tzTKG%2CX4dFzfPrHQ8ds6H4Het1CY8ph8tkTRM%2CrJmHQfD9cDbdcAH7HjtJC2zrCwt8T36&c=728&d=90&e=&g=ec4054efb13cba7270def028e95cd2af%2F9665486770535345063&i=29622%2C27720%2C25174&j=16%2C21%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_Monat&h=https%3A%2F%2Fad4m.at%2Fdct%3Fed%3D22zqdh0wtdghr3kqzqwd485y3x8wcr0bk8gcms3n3898fp48vy5rc73bx6w6p66y0tc03gz7xskmag9qapcc289a7q72v70e1dx0p0d4mtg3qwkxteaj7v698kgbk39ds2wynxps69psdyq5cd3ke0tg2xr7qp9nka73rw3bmt7xqp0yghnmpnc864kks5atht35pgdgh4bxssykrbw5xdqjsx4knghs3gsdx474bq98dr6s946yv2mnykvkzscwpxqwj%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DCk00uN4EaYb3nH4-s7gOliL-wBpDhgYRctqjCivACwI23ARABIABglfrwgYwHggEXY2EtcHViLTYzOTY4NDQ3NDI0OTcyMDigAcKu6N0DyAEJqQJ4bn74usazPuACAKgDAaoE5wFP0Lteg_P7Ph0qbHbOm6VtqE2NJalTi2nM4Q5o1Gv39nn4BIZzpUY7wVbQhqSHAbJ0eAb5u6K9g2JSg8JxpHdEDRix4NAvI5XwZnlnUgjzrHsmAPBkeHormRqyz43UKiuQvgrcDL5aAm1HpCMPrKnVrRgM-50qG5oLF5each-DpJ6rUPpu1J4ZOJXk4emYeA_kniWg2jc_YZoCGabgWu1clgn2iswqXe9-XZbUgSyXSLv_XR6P7VlfmzCW2UgrP_XEih6OcnQR4E4O7KcRxVlhGl0qROXRDV215lewtqEBe9VrkoSvG6bgBAGABqPh6Ov57OTX9wGgBiGoB6a-G6gH8NkbqAfy2RuoB-zVG6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_2fWQA7OUBSkwuwDicQb6ZmH9oJFg%2526client%253Dca-pub-6396844742497208%2526adurl%253D&y=0&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 4bcba6ca13d0bf1606176d2408363d0370505b999089d312da533a86406ba2e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:08 GMT
Last-Modified: Mon, 16 Aug 2021 15:16:08 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 21CA 42 B
64 B 36ms
35ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuV1lN_cAl7fCEakijJjk_z4Dk2VxIqMhE7W_IDha06ZuM8zBbNVSvvSWHNDrfCUuKOYdvCZKs-YmOy8Fmh0-aH6WshKn2DLzYzfoZiXW3gTEo7EQS7lDSq14YnnA&sai=AMfl-YSRfw3ti9G4n-yCx2P0QS7fdg4_PVi-VvLGry_KLOuAO3yvOMlUC9gnYCb6EuuPM1V4VeYjZIxmaZbfKO_hu60dC3kSRPIxaLTP5xCpshvpLI9E69t678qt7Hmr&sig=Cg0ArKJSzOnebZyKF6U5EAE&cid=CAASF-RoxjCPWUkp2_AQFKB9Cx72rsd3GJp7&id=lidar2&mcvt=1142&p=247,676,497,926&asp=247,676,497,926&mtos=1142,1142,1142,1142,1142&tos=1142,0,0,0,0&v=20210813&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=2091818616&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1629126967292&rpt=98&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK fp_decode.html Show response
track.webgains.com/ Frame 3AB5 63 B
270 B 108ms
36ms Fetch
application/json 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/fp_decode.html?wgpayload=k0a44iFBBNlY5Du4UXuKrnZ2CI9XkPrwVL6tqAhbrmQmkqlE4Ww.GEFF0Yz3ccbbJYMLgiPFU77qZoOSix5ezdstlYysrhsui6STpjB9TjQDKMhO3f9p_nH1u_eH3BhxUC550ialT0iakiEocEcEJ1w.CxUC541jlS7spjt.gEngMQEjZr_WhXTA2s.XTVV26y8GGEDd5ihORoVyFGh8cmvSuCKzIlnY6xljQlpRDuxfTNJxTqRejPm8LKfAaZ4ySy.aPjftcktBttIVugwcAuyPBDjaY2ftckuyPBB2SCX0iakJ1ilK.v.uaug4i.uJtHoqvynx9MsFyxYM914Ve_clr2U.0Y.KI6Jsc2_FeAiwnwc6wEMrgPuVr914VecL57GY5BNv_0TjV.D1O
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 84f8704bdc07ab2809b5a9dd028ef0c9e0001bd0b21c32fc06c18231069a581e

Request headers

Accept: application/json
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 16 Aug 2021 15:16:08 GMT
Server: Apache
Connection: close
Keep-Alive: timeout=1, max=100
Content-Length: 63
Content-Type: application/json

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
16ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:08 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyOSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyOSwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:08 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
42 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils0NjgsNjBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NTc5NjI2NDE2ODk5MzEyIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NTc5NjI2NDE2ODk5MzEyIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzU3OTYyNjQxNjg5OTMxMiIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTMtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTI5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils0NjgsNjBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NTc5NjI2NDE2ODk5MzEyIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NTc5NjI2NDE2ODk5MzEyIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMjksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:07 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlsyNTAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlsyNTAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDYxODI1ODg2ODg3OTAxNyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tYm94LTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTIwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:08 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:07 UTC

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E46C 42 B
64 B 28ms
28ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssYHcJh5MIiIFJp4zC7fAOhrkYzvF61skhSi6yOkdJB7Hkwa1gWRP9gz9Kh94TTCcKqDuTp2DEBFmUefpVA5lQZzI3lF7F-Aw&sig=Cg0ArKJSzCzOxwe_9rB3EAE&cid=CAASF-RomOHgguH8ghNqiMCxTuJj3-qxATVK&id=lidar2&mcvt=1001&p=1110,436,1200,1164&asp=1110,436,1200,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20210813&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2463953556&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=2&rst=1629126967808&dlt=25&rpt=114&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
47 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:08 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 350 B
176 B 249ms
249ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=3983683625906706&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C970x90%7C300x250%7C250x250%7C468x60%7C320x100%7C200x200%7C180x150%7C125x125%7C234x60%7C728x90%7C320x50&fluid=height&ris=2&rcs=1&prev_scp=a%3D%257C124%257C%26iid1%3D8203161228871487%26eid%3D8203161228871487%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-1-8203161228871487%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D140%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%2C17%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D260%26reqt%3D1629126968161&eri=1&cookie=ID%3Dd0ac330df6d86dba%3AT%3D1629126965%3AS%3DALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q&bc=31&abxe=1&lmt=1629126969&dt=1629126969269&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=310&adys=1991&adks=1854148200&ucis=4&ifi=12&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=981x264&msz=981x250&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

9a1962449977f367370822c2dcf4b72817838fb25975eb9f14e25abfdf425a23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 147
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils3MjgsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxOTIyMDg5MjYwODYzMDQxIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxOTIyMDg5MjYwODYzMDQxIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIzNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTkyMjA4OTI2MDg2MzA0MSIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NzE2MTQzOTQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM4MTQsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils3MjgsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxOTIyMDg5MjYwODYzMDQxIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxOTIyMDg5MjYwODYzMDQxIiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo3MTYxNDM5NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzgxNCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIzNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:08 UTC

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 3AB5 16 B
232 B 90ms
90ms Fetch
application/json 54.77.236.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.77.236.168 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-77-236-168.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.21

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.21
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 102ms
29ms Preflight 54.77.236.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Server: 54.77.236.168 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-236-168.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://as.ad4m.at
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS

GET
H2 200 greenoaks.gif Show response
thebirthdaybest.com/detroitchicago/ 0
19 B 17ms
17ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibGNwX3ZhbHVlIiwidmFsIjoiNjY2Ljc5OSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiOTA1ODAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMyJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiI0MDEzNTAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjQifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjQwNTc2MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMjUzNiJ9XX1d
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIxOWQxOTJlNi1lZmFkLTQ4OTEtNWMwNy04ODhjYjIyMzJmMmMiLCJkb21haW5faWQiOiIxODU0MTkiLCJ0X2Vwb2NoIjoxNjI5MTI2OTYwLCJkYXRhIjpbeyJuYW1lIjoibGNwX3ZhbHVlIiwidmFsIjoiNjY2Ljc5OSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInRfZXBvY2giOjE2MjkxMjY5NjAsImRhdGEiOlt7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiOTA1ODAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX3ZpZXdwb3J0X2NvdW50IiwidmFsIjoiMyJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjAifSx7Im5hbWUiOiJuYXRpdmVfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoiZGlzcGxheV9hZF9kb2NfcHgiLCJ2YWwiOiI0MDEzNTAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19jb3VudCIsInZhbCI6IjQifSx7Im5hbWUiOiJuYXRpdmVfYWRfZG9jX3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfY291bnQiLCJ2YWwiOiIwIn0seyJuYW1lIjoidmlld3BvcnRfc2l6ZSIsInZhbCI6IjE2MDB4MTIwMCJ9LHsibmFtZSI6InZpZXdwb3J0X3B4IiwidmFsIjoiMTkyMDAwMCJ9LHsibmFtZSI6ImRvY19weCIsInZhbCI6IjQwNTc2MDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiMjUzNiJ9XX1d
pragma: no-cache
cookie: __gads=ID=d0ac330df6d86dba:T=1629126965:S=ALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q; ezouspvv=8; ezouspvh=8; _pbjs_userid_consent_data=3524755945110770; ezouspva=2; cto_bidid=LyFkkV9iOXo1OWFQUUt0b2RFN01oVUxSWk9ERW1nWFMxY0o3aTJhMW1IWlB0bEtQVW9nUnJUSVdVeW91ZFV3TVBNaUt0Rjg3Qm5BSWhEZnZZemlPbyUyRm5YUHFRJTNEJTNE; cto_bundle=_EeQb19HZUNrUGUlMkZTamxMcjMzaWozVFkzTmo5Tnl5JTJGd3c1SEE2byUyRlIlMkZtTFZhT0x1ZU5GWE05TzRURmN4OGNYb2JzTFc2VkRDbWhOTGFkRUV0OSUyQjJjUiUyQlJicEklMkJBT2piQk1lUFl0TzJQaFo4MmFacDN3WmFkaHpjMVZ3Y28xZVJrSk52; ezux_lpl_185419=1629126968072|19d192e6-efad-4891-5c07-888cb2232f2c|false
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:09 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 350 B
177 B 216ms
215ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=2028917862573853&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C970x90%7C300x250%7C250x250%7C468x60%7C320x100%7C200x200%7C180x150%7C125x125%7C234x60%7C728x90%7C320x50&fluid=height&ris=1&rcs=2&prev_scp=a%3D%257C124%257C%26iid1%3D8203161228871487%26eid%3D8203161228871487%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-1-8203161228871487%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D50%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%2C17%2C17%2C19%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D140%26reqt%3D1629126969777&eri=1&cookie=ID%3Dd0ac330df6d86dba%3AT%3D1629126965%3AS%3DALNI_MZyzF9f1R4ic_6VjLpdc6jw7JGq-Q&bc=31&abxe=1&lmt=1629126969&dt=1629126969783&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=310&adys=1991&adks=1854148200&ucis=4&ifi=13&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=981x264&msz=981x250&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=3&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

1752475d54bf961f717c1390d573ab245b0704550af83522afd99f532694e5dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 148
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.105.js Show response
static.criteo.net/js/ld/ 80 KB
26 KB 69ms
24ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.105.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 83bcdfa5df8e5f84aa8715b0aefb06e9909b30290843475a0ecc6887650f811f

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:10 GMT
content-encoding: gzip
last-modified: Tue, 23 Feb 2021 11:00:30 GMT
server: nginx
etag: W/"6034e04e-14008"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 17 Aug 2021 15:16:10 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 6BBE 11 KB
5 KB 23ms
23ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=thebirthdaybest.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.105.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

58da6480fc50a14bd6f73842552e9bfbd623d883c9a81d68b7d27b52d0afe71c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: gum.criteo.com
:scheme: https
:path: /syncframe?topUrl=thebirthdaybest.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 2189
set-cookie: uid=2fa61aff-e147-435d-a1a7-60bf460ac79c; expires=Sat, 10 Sep 2022 15:16:10 GMT; domain=.criteo.com; path=/; secure; samesite=none
date: Mon, 16 Aug 2021 15:16:09 GMT
content-length: 4666

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 83 KB
27 KB 91ms
45ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.105.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 0b5cf6934f9f632cff3aeca60e21d4b38c28a74570df484abeaf0b643784283c

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:10 GMT
content-encoding: gzip
last-modified: Mon, 02 Aug 2021 10:15:53 GMT
server: nginx
etag: W/"6107c5d9-14abb"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 17 Aug 2021 15:16:10 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 6BBE
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=thebirthdaybest.com&sn=ChromeSyncframe&so=0&topUrl=thebirthdaybest.com&cw=1
https://mug.criteo.com/sid?cpp=yDx4lXxXRTl6QjBZQjBGOW5oSmwyQ0lWUURZTlZNci93RHBLVUNNWGNVUWR0ZWJsVTFHM3h0a2IweTNXTU9SeW12a29ienBMSVczS1RGa0JuZFR2T2kxc2UyY3RBUnlldktvTUJqT0JrTkhnQ25Ud3lyZ05md0hNNGdiNW...

465 B
641 B

22ms
22ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=yDx4lXxXRTl6QjBZQjBGOW5oSmwyQ0lWUURZTlZNci93RHBLVUNNWGNVUWR0ZWJsVTFHM3h0a2IweTNXTU9SeW12a29ienBMSVczS1RGa0JuZFR2T2kxc2UyY3RBUnlldktvTUJqT0JrTkhnQ25Ud3lyZ05md0hNNGdiNW5tODVyR2grUlZWRXhwZ1JvZEtGVGFudUExZGlDbmZIK213dGtlZ3Ewb2ZUZGM0WUVHU2lIRDFSa0ZHQTE1dHF4cW1TbHpxNHlCNkpvQjJBY3UxMU5EWnJDYmcrb0ZPa2E3Si9qZDVPYnlQNW1JSk5PTmFKclhjZVh6czlrdG5wR0x1UmtXVHVJVEtVL2tlUHF3bUJDaDRuVGx0MkQ0UT09fA&cppv=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

0f2d2f45f088919a22f4916e0c671072d8139931a3c6bce0e85be1948c114ba4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 16 Aug 2021 15:16:10 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4353
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Mon, 16 Aug 2021 15:16:10 GMT
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=yDx4lXxXRTl6QjBZQjBGOW5oSmwyQ0lWUURZTlZNci93RHBLVUNNWGNVUWR0ZWJsVTFHM3h0a2IweTNXTU9SeW12a29ienBMSVczS1RGa0JuZFR2T2kxc2UyY3RBUnlldktvTUJqT0JrTkhnQ25Ud3lyZ05md0hNNGdiNW5tODVyR2grUlZWRXhwZ1JvZEtGVGFudUExZGlDbmZIK213dGtlZ3Ewb2ZUZGM0WUVHU2lIRDFSa0ZHQTE1dHF4cW1TbHpxNHlCNkpvQjJBY3UxMU5EWnJDYmcrb0ZPa2E3Si9qZDVPYnlQNW1JSk5PTmFKclhjZVh6czlrdG5wR0x1UmtXVHVJVEtVL2tlUHF3bUJDaDRuVGx0MkQ0UT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1707
content-length: 541
expires: 0

POST
H/1.1 200 457.json Show response
id5-sync.com/g/v2/ 213 B
537 B 55ms
13ms XHR
application/json 51.89.20.87
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/457.json

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

51.89.20.87 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

p19.id5-sync.com

Software

Resource Hash

c15772210ea6cd29deb48acc82407f99bf9e5e2a465dac9ed4ed0cb7d4900de9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://thebirthdaybest.com
Date: Mon, 16 Aug 2021 15:17:15 GMT
Access-Control-Allow-Credentials: true
Vary: Origin
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame CBFB 14 KB
5 KB 85ms
26ms Document
text/html 2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba

Request headers

:method: GET
:authority: ads.pubmatic.com
:scheme: https
:path: /AdServer/js/user_sync.html?kdntuid=1&p=156983
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

last-modified: Tue, 15 Jun 2021 06:08:03 GMT
etag: "1300708-3945-5c4c7cc02bd56"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5054
content-type: text/html; charset=UTF-8
cache-control: max-age=110311
expires: Tue, 17 Aug 2021 21:54:42 GMT
date: Mon, 16 Aug 2021 15:16:11 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 8D8B 52 KB
17 KB 44ms
6ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://thebirthdaybest.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Fri, 30 Jul 2021 04:43:13 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Mon, 16 Aug 2021 15:16:11 GMT
Age: 37943
X-Served-By: cache-lga21963-LGA, cache-fra19181-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 344202
X-Timer: S1629126971.064547,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 77E0 2 KB
823 B 23ms
17ms Document
text/html 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1629126968021

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?cb=1629126968021
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 427D 52 KB
17 KB 37ms
7ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=appnexus,criteo,oftmedia,onemobile,onetag,pubmatic,pubmatic,rhythmone&cb=195-0-26
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://thebirthdaybest.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Fri, 30 Jul 2021 04:43:13 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Mon, 16 Aug 2021 15:16:11 GMT
Age: 37942
X-Served-By: cache-lga21963-LGA, cache-fra19157-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 1, 343385
X-Timer: S1629126971.064645,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame 8D8B
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
803 B

44ms
44ms

Script
text/html

185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:11 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5d1a4c87-6915-433d-ac06-6694cb81fbc2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:11 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: fb8f4056-3a51-4fda-8be9-17ddbee15779
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

bounce Show response
ib.adnxs.com/ Frame 427D
Redirect Chain

https://ib.adnxs.com/async_usersync?cbfn=queuePixels
https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

0
803 B

44ms
43ms

Script
text/html

185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:11 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 05c9f1e2-81f0-4fd5-b2c7-cb09704342bd
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:11 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ea95eb5b-bfb7-4ed3-941e-254a1c7a188c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fasync_usersync%3Fcbfn%3DqueuePixels
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame CBFB 5 KB
6 KB 19ms
18ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=71232274&p=156983&s=0&a=0&ptask=ALL&np=0&fp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 88aafe970f36ef5353741e6e11e3faa7b2f01fed13e562e63795ecc50f67a303

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:09 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 836B
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73

35 B
467 B

52ms
52ms

Document
image/gif

37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: c1.adform.net
:scheme: https
:path: /serving/cookie/match?CC=1&party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: C=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: uid=4382504918052637665; expires=Fri, 15 Oct 2021 15:16:11 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=32AB9ED9-0367-4047-B10B-B8C37C524D73
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
set-cookie: C=1; expires=Thu, 16 Sep 2021 15:16:11 GMT; domain=adform.net; path=/; secure; samesite=none
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame B1D8
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1161241209470756643

42 B
209 B

35ms
15ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1161241209470756643
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: image2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1161241209470756643
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=32AB9ED9-0367-4047-B10B-B8C37C524D73; chkChromeAb67Sec=1; DPSync3=1630281600%3A197_219_201%7C1629158400%3A174; SyncRTB3=1631664000%3A203%7C1629936000%3A63%7C1630281600%3A166_88_189_56_71_81_55_176_161_22_234_230_165_21_54_99_220_7_222_8_204_13_3%7C1629676800%3A15_2_223_67%7C1630368000%3A35; KRTBCOOKIE_409=22966-nvDMi3Vzq0XxomMrR7K6XUm0; PugT=1629126971; PUBMDCID=3; KRTBCOOKIE_80=22987-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&16514-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&23025-CAESEO7qhtYija0XAqyA9GIKkD0; KRTBCOOKIE_57=22776-7604873109588400523
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_336=5844-1161241209470756643; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:11 GMT; path=/ PugT=1629126971; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:11 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:11 GMT; path=/
x-lat: lhrpug017:0:319
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=1161241209470756643
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E545
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
110 B

117ms
16ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=32AB9ED9-0367-4047-B10B-B8C37C524D73; chkChromeAb67Sec=1; DPSync3=1630281600%3A197_219_201%7C1629158400%3A174; SyncRTB3=1631664000%3A203%7C1629936000%3A63%7C1630281600%3A166_88_189_56_71_81_55_176_161_22_234_230_165_21_54_99_220_7_222_8_204_13_3%7C1629676800%3A15_2_223_67%7C1630368000%3A35
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:11 GMT; path=/
x-lat: lhrpug018:0:531
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

cache-control: no-cache
pragma: no-cache
content-type: text/html; charset=utf-8
expires: Mon, 16 Aug 2021 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
server: Microsoft-IIS/10.0
x-errorlevel: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 4200
date: Mon, 16 Aug 2021 15:16:10 GMT
content-length: 234

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7D2B
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6997047065782450315

42 B
290 B

22ms
22ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6997047065782450315
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6997047065782450315
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=32AB9ED9-0367-4047-B10B-B8C37C524D73; chkChromeAb67Sec=1; DPSync3=1630281600%3A197_219_201%7C1629158400%3A174; SyncRTB3=1631664000%3A203%7C1629936000%3A63%7C1630281600%3A166_88_189_56_71_81_55_176_161_22_234_230_165_21_54_99_220_7_222_8_204_13_3%7C1629676800%3A15_2_223_67%7C1630368000%3A35; KRTBCOOKIE_409=22966-nvDMi3Vzq0XxomMrR7K6XUm0; PugT=1629126971; PUBMDCID=3; KRTBCOOKIE_80=22987-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&16514-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&23025-CAESEO7qhtYija0XAqyA9GIKkD0; KRTBCOOKIE_57=22776-7604873109588400523; KRTBCOOKIE_391=22924-4382504918052637665&KRTB&23263-4382504918052637665; KRTBCOOKIE_336=5844-1161241209470756643; KRTBCOOKIE_27=16735-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&16736-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&23019-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&23114-uid:e26a611a-813b-4900-8eff-a53732e214f0; KRTBCOOKIE_153=19420-yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI&KRTB&22979-yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI; KRTBCOOKIE_22=14911-3736374374794588885; KRTBCOOKIE_377=6810-026de713-7954-4bf6-932d-4c169e7c9b16&KRTB&22918-026de713-7954-4bf6-932d-4c169e7c9b16&KRTB&23031-026de713-7954-4bf6-932d-4c169e7c9b16; KRTBCOOKIE_188=3189-no-consent; KRTBCOOKIE_594=17105-RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003&KRTB&17107-RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:12 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_1101=23040-6997047065782450315; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:12 GMT; path=/ PugT=1629126972; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:12 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:12 GMT; path=/
x-lat: lhrpug004:0:2838
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

Server: nginx
Date: Mon, 16 Aug 2021 15:16:12 GMT
Transfer-Encoding: chunked
Connection: keep-alive
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Set-Cookie: UserID1=6997047065782450315; Max-Age=7776000; domain=.adfarm1.adition.com; Path=/; SameSite=None; Secure
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA=&piggybackCookie=6997047065782450315

GET
H/1.1

200
OK

adx Show response
match.prod.bidr.io/cookie-sync/ Frame 43DB
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=?_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCTWRFN0NOUUlBQUNFYUpMbDVmZw&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sy...
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

43 B
430 B

29ms
29ms

Document
image/gif

52.30.92.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.92.119 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-92-119.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Host: match.prod.bidr.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: bito=AABMdE7CNQIAACEaJLl5fg; bitoIsSecure=ok
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, must-revalidate
content-type: image/gif
Date: Mon, 16 Aug 2021 15:16:11 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
Content-Length: 43
Connection: keep-alive

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
date: Mon, 16 Aug 2021 15:16:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 355
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 503 / Show response
csync.loopme.me/ Frame 7E91 85 B
152 B 99ms
12ms Document
text/plain 162.55.6.211
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://csync.loopme.me/?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.55.6.211 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.211.6.55.162.clients.your-server.de
Software: _ /
Resource Hash: e482a48fef03d183029fa2edf995fc8e9ce023f18649fd1d9149958e977068a1

Request headers

:method: GET
:authority: csync.loopme.me
:scheme: https
:path: /?redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={device_id}&gdpr=0&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 85
content-type: text/plain
date: Mon, 16 Aug 2021 15:16:10 GMT
server: _

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1EDC
Redirect Chain

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5050582433
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5050582433
https://sync.1rx.io/usersync/tradedesk/026de713-7954-4bf6-932d-4c169e7c9b16
https://sync.targeting.unrulymedia.com/csync/RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003

42 B
270 B

23ms
18ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=32AB9ED9-0367-4047-B10B-B8C37C524D73; chkChromeAb67Sec=1; DPSync3=1630281600%3A197_219_201%7C1629158400%3A174; SyncRTB3=1631664000%3A203%7C1629936000%3A63%7C1630281600%3A166_88_189_56_71_81_55_176_161_22_234_230_165_21_54_99_220_7_222_8_204_13_3%7C1629676800%3A15_2_223_67%7C1630368000%3A35; KRTBCOOKIE_409=22966-nvDMi3Vzq0XxomMrR7K6XUm0; PugT=1629126971; PUBMDCID=3; KRTBCOOKIE_80=22987-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&16514-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&23025-CAESEO7qhtYija0XAqyA9GIKkD0; KRTBCOOKIE_57=22776-7604873109588400523; KRTBCOOKIE_391=22924-4382504918052637665&KRTB&23263-4382504918052637665; KRTBCOOKIE_336=5844-1161241209470756643; KRTBCOOKIE_27=16735-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&16736-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&23019-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&23114-uid:e26a611a-813b-4900-8eff-a53732e214f0; KRTBCOOKIE_153=19420-yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI&KRTB&22979-yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI; KRTBCOOKIE_22=14911-3736374374794588885; KRTBCOOKIE_377=6810-026de713-7954-4bf6-932d-4c169e7c9b16&KRTB&22918-026de713-7954-4bf6-932d-4c169e7c9b16&KRTB&23031-026de713-7954-4bf6-932d-4c169e7c9b16
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_594=17105-RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003&KRTB&17107-RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:11 GMT; path=/ PugT=1629126971; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:11 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:11 GMT; path=/
x-lat: lhrpug012:0:879
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Tengine
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: text/html
set-cookie: _rxuuid=%7B%22rx_uuid%22%3A%22RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003%22%7D; path=/; expires=Tue, 16 Aug 2022 15:16:11 GMT; domain=.targeting.unrulymedia.com; samesite=none; secure; httponly
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-ef717a7b-85ef-45f1-b6e7-7c65fe96718a-003
etag: RXef717a7b85ef45f1b6e77c65fe96718a003

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6302
Redirect Chain

https://green.erne.co/pubmatic/cm?
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=nvDMi3Vzq0XxomMrR7K6XUm0

42 B
526 B

38ms
22ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=nvDMi3Vzq0XxomMrR7K6XUm0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

:method: GET
:authority: image2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=nvDMi3Vzq0XxomMrR7K6XUm0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=32AB9ED9-0367-4047-B10B-B8C37C524D73; chkChromeAb67Sec=1; DPSync3=1630281600%3A197_219_201%7C1629158400%3A174; SyncRTB3=1631664000%3A203%7C1629936000%3A63%7C1630281600%3A166_88_189_56_71_81_55_176_161_22_234_230_165_21_54_99_220_7_222_8_204_13_3%7C1629676800%3A15_2_223_67%7C1630368000%3A35
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif; charset=utf-8
content-length: 42
set-cookie: KRTBCOOKIE_409=22966-nvDMi3Vzq0XxomMrR7K6XUm0; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:11 GMT; path=/ PugT=1629126971; domain=pubmatic.com; SameSite=None; secure; expires=Wed, 15-Sep-2021 15:16:11 GMT; path=/ PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:11 GMT; path=/
x-lat: lhrpug004:0:412
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: openresty
date: Mon, 16 Aug 2021 15:16:11 GMT
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
set-cookie: u=nvDMi3Vzq0XxomMrR7K6XUm0; Max-Age=31536000; Domain=.erne.co; Path=/; Secure; SameSite=None
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4ODQmdGw9MTI5NjAw&piggybackCookie=nvDMi3Vzq0XxomMrR7K6XUm0
strict-transport-security: max-age=0; includeSubDomains;

GET
H2 200 dpe Show response
ad4m.at/ad/ Frame 9E1B 42 B
796 B 93ms
23ms Document
image/gif 2606:4700:3039::6815:c03a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ad4m.at/ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3039::6815:c03a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox

Request headers

:method: GET
:authority: ad4m.at
:scheme: https
:path: /ad/dpe?b=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjkmdGw9MTI5NjAw&piggybackCookie=$UID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif
content-length: 42
report-to: {"endpoints":[{"url":"https://as.ad4m.at/ad/vre"}],"group":"report-endpoint","max_age":86400}
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0"}
expires: 0
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
content-security-policy: block-all-mixed-content; report-to report-endpoint; report-uri https://as.ad4m.at/ad/rcv; upgrade-insecure-requests; sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
referrer-policy: same-origin
pragma: no-cache
surrogate-control: no-store
x-fastcgi-cache: BYPASS
x-backend-server: adsrv-7b12
via: 1.1 google
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 67fb9f527bc005f1-FRA

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 3E6E
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
385 B

178ms
174ms

Document
image/gif

2606:4700::6812:d05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

:method: GET
:authority: s.tribalfusion.com
:scheme: https
:path: /z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: ANON_ID=aBnoeUqZbaOT6iPqceTlDp4od7MRWMSyHbZbrQcsR3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: image/gif; charset=utf-8
content-length: 43
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 302
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: ANON_ID=acns6Er2PKcFuYnRYanXyjLo6FRInvS8UEKWY3SbHIEssB4iZb0SnyPHeGWosFe8cDejqvqtWvm9pUyac2tm7; path=/; domain=.tribalfusion.com; expires=Sun, 14-Nov-2021 15:16:11 GMT; SameSite=None; Secure; ANON_ID_old=acns6Er2PKcFuYnRYanXyjLo6FRInvS8UEKWY3SbHIEssB4iZb0SnyPHeGWosFe8cDejqvqtWvm9pUyac2tm7; path=/; domain=.tribalfusion.com; expires=Sun, 14-Nov-2021 15:16:11 GMT;
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 67fb9f53b9ebd6fd-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: text/html
p3p: CP="NOI DEVo TAIa OUR BUS"
x-function: 206
x-reuse-index: 5833
cache-control: no-cache private
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: ANON_ID=aBnoeUqZbaOT6iPqceTlDp4od7MRWMSyHbZbrQcsR3; path=/; domain=.tribalfusion.com; expires=Sun, 14-Nov-2021 15:16:11 GMT; SameSite=None; Secure; ANON_ID_old=aBnoeUqZbaOT6iPqceTlDp4od7MRWMSyHbZbrQcsR3; path=/; domain=.tribalfusion.com; expires=Sun, 14-Nov-2021 15:16:11 GMT;
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 67fb9f527fefd6fd-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2394
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=557219&ev=1&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&piggybackCookie=%%VGUID%%
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=pszfTlNH7dka&pid=557219

1 B
69 B

24ms
24ms

Document
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=pszfTlNH7dka&pid=557219
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

:method: GET
:authority: simage2.pubmatic.com
:scheme: https
:path: /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=pszfTlNH7dka&pid=557219
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: KADUSERCOOKIE=32AB9ED9-0367-4047-B10B-B8C37C524D73; chkChromeAb67Sec=1; DPSync3=1630281600%3A197_219_201%7C1629158400%3A174; SyncRTB3=1631664000%3A203%7C1629936000%3A63%7C1630281600%3A166_88_189_56_71_81_55_176_161_22_234_230_165_21_54_99_220_7_222_8_204_13_3%7C1629676800%3A15_2_223_67%7C1630368000%3A35; KRTBCOOKIE_409=22966-nvDMi3Vzq0XxomMrR7K6XUm0; PugT=1629126971; PUBMDCID=3; KRTBCOOKIE_80=22987-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&16514-CAESEO7qhtYija0XAqyA9GIKkD0&KRTB&23025-CAESEO7qhtYija0XAqyA9GIKkD0; KRTBCOOKIE_57=22776-7604873109588400523; KRTBCOOKIE_391=22924-4382504918052637665&KRTB&23263-4382504918052637665; KRTBCOOKIE_336=5844-1161241209470756643; KRTBCOOKIE_27=16735-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&16736-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&23019-uid:e26a611a-813b-4900-8eff-a53732e214f0&KRTB&23114-uid:e26a611a-813b-4900-8eff-a53732e214f0; KRTBCOOKIE_153=19420-yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI&KRTB&22979-yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI; KRTBCOOKIE_22=14911-3736374374794588885; KRTBCOOKIE_377=6810-026de713-7954-4bf6-932d-4c169e7c9b16&KRTB&22918-026de713-7954-4bf6-932d-4c169e7c9b16&KRTB&23031-026de713-7954-4bf6-932d-4c169e7c9b16
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: text/html; charset=utf-8
content-length: 1
set-cookie: PUBMDCID=3; domain=pubmatic.com; SameSite=None; secure; expires=Sun, 14-Nov-2021 15:16:11 GMT; path=/
x-lat: lhrpug013:0:357
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cw-server: bh-deployment-84459f4bbf-l7jjn
cache-control: private, max-age=0, no-cache, no-store
expires: -1
content-language: en-US
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMxOSZ0bD0xMjk2MDA=&ev=1&ev=1&piggybackCookie=pszfTlNH7dka&pid=557219
server: Jetty(9.4.14.v20181114)
strict-transport-security: max-age=15768000
set-cookie: INGRESSCOOKIE=1d01ebe985e62b6b; path=/; HttpOnly; Secure; SameSite=None

GET
H/1.1 200
OK bridge Show response
cm.adgrx.com/ Frame 1283 43 B
408 B 98ms
47ms Document
image/gif 63.251.232.170
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.251.232.170 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS: ams-mon-1.sys.adgear.com
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Host: cm.adgrx.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ads.pubmatic.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Date: Mon, 16 Aug 2021 15:16:11 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
server: Cowboy
X-RealServer-NX: ams-delivery-2
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate
Pragma: no-cache
Expires: Thu, 23 Sep 2004 17:42:04 GMT
P3P: CP="NOI OTC OTP OUR NOR"
Access-Control-Allow-Origin: *

GET
H2

200

rtb-h Show response
match.taboola.com/sg/pubmatic-ssp-network/1/ Frame 9246
Redirect Chain

https://trc.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=uid:$UID
https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdSe...

0
147 B

86ms
22ms

Document
text/plain

151.101.13.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method: GET
:authority: match.taboola.com
:scheme: https
:path: /sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ads.pubmatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: t_gid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
accept-ranges: bytes
date: Mon, 16 Aug 2021 15:16:11 GMT
via: 1.1 varnish
x-served-by: cache-fra19153-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1629126971.373907,VS0,VE9
content-length: 0

Redirect headers

server: nginx
set-cookie: t_gid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb;Version=1;Path=/;Domain=.taboola.com;Expires=Tue, 16-Aug-2022 15:16:11 GMT;Max-Age=31536000;Secure;SameSite=None
location: https://match.taboola.com/sg/pubmatic-ssp-network/1/rtb-h?taboola_hm=1&tbid=ae9f95c5-8f03-4092-ac78-81c79846fbcf-tuct81406bb&query=taboola_hm%3D1%26redir%3Dhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw%26piggybackCookie%3Duid%3A%24UID&isDirect=0
accept-ranges: bytes
date: Mon, 16 Aug 2021 15:16:11 GMT
via: 1.1 varnish
x-served-by: cache-fra19151-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1629126971.291527,VS0,VE9
x-vcl-time-ms: 9
content-length: 0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame CBFB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Mque2QNnQEexC7jDfFJNcw%3D%3D
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Mque2QNnQEexC7jDfFJNcw%3D%3D&google_tc=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

14 KB
14 KB

33ms
29ms

Image
text/html

2.18.233.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.180 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
content-encoding: gzip
last-modified: Tue, 15 Jun 2021 06:08:03 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3945-5c4c7cc02bd56"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=110311
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5054
expires: Tue, 17 Aug 2021 21:54:42 GMT

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1b2a611a-813a-4200-9588-01eb38e8db69

0
92 B

1076ms
16ms

Image
text/plain

185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1b2a611a-813a-4200-9588-01eb38e8db69
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-cnection: close
date: Mon, 16 Aug 2021 15:16:11 GMT
content-encoding: gzip
server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache
content-type: text/plain; charset=utf-8

Redirect headers

Date: Mon, 16 Aug 2021 15:16:11 GMT
Server: MT3 3831 a91c15f master zrh-pixel-x31
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=1b2a611a-813a-4200-9588-01eb38e8db69
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 16 Aug 2021 15:16:10 GMT

GET
H/1.1

200
OK

/
pixel.onaudience.com/ Frame CBFB
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=32AB9ED9-0367-4047-B10B-B8C37C524D73
https://sync.crwdcntrl.net/map/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D
https://sync.crwdcntrl.net/map/ct=y/c=8587/tp=CLOD?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D
https://pixel.onaudience.com/?partner=104&icm&cver&mapped=a882b54667c3aee6a83dd19981a7fd41
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1
https://pixel.onaudience.com/?partner=147&mapped=026de713-7954-4bf6-932d-4c169e7c9b16&icm
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25
https://loada.exelator.com/load/?p=1164&g=1&j=r&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=36719a81cc31a89526d0c209f2fedd75

35 B
248 B

96ms
95ms

Image
image/gif

51.222.80.231
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.onaudience.com/?partner=161&icm&cver&mapped=36719a81cc31a89526d0c209f2fedd75
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 51.222.80.231 , Canada, ASN16276 (OVH, FR),
Reverse DNS: ns574734.ip-51-222-80.net
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-length: 35
content-type: image/gif

Redirect headers

date: Mon, 16 Aug 2021 15:16:12 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://pixel.onaudience.com/?partner=161&icm&cver&mapped=36719a81cc31a89526d0c209f2fedd75
cache-control: no-cache
access-control-allow-credentials: true
content-type: text/html
content-length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzJBQjlFRDktMDM2Ny00MDQ3LUIxMEItQjhDMzdDNTI0RDcz&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzJBQjlFRDktMDM2Ny00MDQ3LUIxMEItQjhDMzdDNTI0RDcz&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
110 B

36ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug011:0:480
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO7qhtYija0XAqyA9GIKkD0&google_cver=1

42 B
282 B

37ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO7qhtYija0XAqyA9GIKkD0&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug001:0:482
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEO7qhtYija0XAqyA9GIKkD0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame CBFB 43 B
611 B 119ms
24ms Image
image/gif 159.253.128.183
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

159.253.128.183 Amsterdam, Netherlands, ASN36351 (SOFTLAYER, US),

Reverse DNS

b7.80.fd9f.ip4.static.sl-reverse.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Sun, 15 Aug 2021 15:16:11 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4382504918052637665

42 B
234 B

76ms
15ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4382504918052637665
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:399
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
server: nginx
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=4382504918052637665
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA%3D%3D%26piggybackCookie%3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e26a611a-813b-4900-8eff-a53732e214f0&gdpr=0&gdpr_consent=

42 B
339 B

38ms
17ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e26a611a-813b-4900-8eff-a53732e214f0&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug014:0:539
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 16 Aug 2021 15:16:11 GMT
Server: MT3 3831 a91c15f master zrh-pixel-x9
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD00MzIwMA==&piggybackCookie=uid:e26a611a-813b-4900-8eff-a53732e214f0&gdpr=0&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 16 Aug 2021 15:16:10 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=026de713-7954-4bf6-932d-4c169e7c9b16

42 B
294 B

26ms
26ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=026de713-7954-4bf6-932d-4c169e7c9b16
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug013:0:420
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=026de713-7954-4bf6-932d-4c169e7c9b16
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://ib.adnxs.com/getuid?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7604873109588400523&gdpr=0&gdpr_consent=

42 B
210 B

102ms
24ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7604873109588400523&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug002:0:593
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:11 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c464dc90-c902-4d5b-8bd6-d0e164c681c3
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7604873109588400523&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 32AB9ED9-0367-4047-B10B-B8C37C524D73
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame CBFB 43 B
838 B 174ms
62ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/32AB9ED9-0367-4047-B10B-B8C37C524D73?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=32AB9ED9-0367-4047-B10B-B8C37C524D73&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=32AB9ED9-0367-4047-B10B-B8C37C524D73&redir=true&gdpr=0&gdpr_consent=&verify=true
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5WML.8RE2uU7p5SLb1qrOOfa6oXLklM-~A&gdpr=0&gdpr_consent=

0
375 B

976ms
15ms

Image
text/plain

185.64.189.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5WML.8RE2uU7p5SLb1qrOOfa6oXLklM-~A&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.114 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-cnection: close
date: Mon, 16 Aug 2021 15:16:11 GMT
content-encoding: gzip
server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-cache
content-type: text/plain; charset=utf-8

Redirect headers

Date: Mon, 16 Aug 2021 15:16:11 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-5WML.8RE2uU7p5SLb1qrOOfa6oXLklM-~A&gdpr=0&gdpr_consent=
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://pixel.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI

42 B
272 B

30ms
18ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug016:0:601
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=yLUOjsa1DI3TsgrWnLUSismxDd3TvVrWxuEBUWnI
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dpubmatic
https://x.bidswitch.net/sync?dsp_id=59&user_id=e463f93f-ce6c-436d-ac31-b2bda777518e&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c429e33f-a79a-460e-a3a6-e6f7ba962817&gdpr=&gdpr_consent=&gdpr_pd=

1 B
180 B

21ms
20ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c429e33f-a79a-460e-a3a6-e6f7ba962817&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:992
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=c429e33f-a79a-460e-a3a6-e6f7ba962817&gdpr=&gdpr_consent=&gdpr_pd=
date: Mon, 16 Aug 2021 15:16:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YRqBPAADoL250gAC&gdpr=0&gdpr_consent=&_test=YRqBPAADoL250gAC

1 B
236 B

19ms
18ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YRqBPAADoL250gAC&gdpr=0&gdpr_consent=&_test=YRqBPAADoL250gAC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug003:0:683
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:12 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1629126973.582423,VS0,VE0
x-served-by: cache-hhn4054-HHN
x-cache: HIT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YRqBPAADoL250gAC&gdpr=0&gdpr_consent=&_test=YRqBPAADoL250gAC
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3736374374794588885&gdpr=0&gdpr_consent=&us_privacy=

1 B
188 B

39ms
39ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3736374374794588885&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug016:0:354
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3736374374794588885&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 16 Aug 2021 15:16:10 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame CBFB 0
104 B 135ms
67ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=32AB9ED9-0367-4047-B10B-B8C37C524D73&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:756bcf45-8bfb-4051-8e41-0d0362ceaf4d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
111 B

19ms
18ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:756bcf45-8bfb-4051-8e41-0d0362ceaf4d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug006:0:383
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?piggybackCookie=uid:756bcf45-8bfb-4051-8e41-0d0362ceaf4d&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Mon, 16 Aug 2021 15:16:12 GMT
Server: Apache/2.4.41 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=

42 B
203 B

19ms
17ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug009:0:458
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 16 Aug 2021 15:16:11 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MjU5MjAw=&piggybackCookie=no-consent&gdpr=1&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7604873109588400523

42 B
188 B

63ms
62ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7604873109588400523
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug003:0:355
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:12 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 51a11dcf-7a84-420b-a0fa-9a4d28466da6
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=7604873109588400523
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame CBFB
Redirect Chain

https://rtb.gumgum.com/getuid/d1ba4609?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw%26piggybackCookie%3D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4f9fbf2b-e6d7-4f33-83fb-06db7938f223

42 B
249 B

27ms
23ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4f9fbf2b-e6d7-4f33-83fb-06db7938f223
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:12 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug004:0:443
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDImdGw9MTI5NjAw&piggybackCookie=e_4f9fbf2b-e6d7-4f33-83fb-06db7938f223
date: Mon, 16 Aug 2021 15:16:12 GMT
p3p: CP="This is not a P3P policy"
server: nginx
timing-allow-origin: *
content-length: 0
content-language: en-US

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 59ms
50ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 56ms
49ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=thebirthdaybest.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 16 Aug 2021 15:16:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 94 KB
31 KB 429ms
429ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1928672915352834&correlator=3266160570326855&output=ldjh&impl=fifs&eid=31062246%2C31062282%2C31061180%2C44741899%2C31062228%2C20211866%2C31062297&vrg=2021081001&ptt=17&sc=1&sfv=1-0-38&ecs=20210816&iu_parts=1254144%3A21972349194%2Cthebirthdaybest_com-medrectangle-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C120x240%7C970x90%7C300x250%7C250x250%7C468x60%7C320x100%7C200x200%7C180x150%7C125x125%7C234x60%7C728x90%7C320x50&fluid=height&ris=2&rcs=3&prev_scp=a%3D%257C124%257C%26iid1%3D8203161228871487%26eid%3D8203161228871487%26t%3D134%26d%3D185419%26t1%3D134%26pvc%3D0%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod12%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D4%26al%3D1004%26compid%3D0%26tap%3Dthebirthdaybest_com-medrectangle-1-8203161228871487%26eb_br%3D9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D1%26ebss%3D10017%2C10061%2C11304%2C11307%26asau%3D8414969736%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D4%26br2%3D140%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C919%2C787%2C17%2C17%2C19%2C17%2C18%2C19%2C1428%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D50%26reqt%3D1629126970294&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1629126971&dt=1629126971304&dlt=1629126961115&idt=759&frm=20&biw=1600&bih=1200&oid=3&adxs=310&adys=1991&adks=1854148200&ucis=4&ifi=14&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthebirthdaybest.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=981x264&msz=981x250&ga_vid=816691754.1629126962&ga_sid=1629126962&ga_hid=1850156580&ga_fc=false&fws=0&ohw=0&btvi=4&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

3b357e987bda84805d82e92e511ded1fe9fe6d96ba49aa82d56e9d9441100da1

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNOcsPPqtfICFeO8ewodSLEFVg&gqi=&layout=/sadbundle/%24csp%253Der3%24/17482830078537030830/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNOcsPPqtfICFeO8ewodSLEFVg&gqi=&layout=/sadbundle/%24csp%253Der3%24/17482830078537030830/index.html
content-encoding: br
x-content-type-options: nosniff
google-creative-id: -1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31102
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
date: Mon, 16 Aug 2021 15:16:11 GMT
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://thebirthdaybest.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F60F 6 KB
3 KB 8ms
6ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021081001.js?31062246

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://thebirthdaybest.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://thebirthdaybest.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 16 Aug 2021 15:16:02 GMT
expires: Tue, 16 Aug 2022 15:16:02 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 9
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
65 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI5YzNlNGVlOGVhZTdmMTQzM2NiMmZlNjliMTMyNjYwNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA0LCJhZF9wb3NpdGlvbiI6MTEwNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDQsImJpZF9mbG9vcl9wcmV2IjowLjAwMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDQzNTIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI5YzNlNGVlOGVhZTdmMTQzM2NiMmZlNjliMTMyNjYwNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDA0LCJhZF9wb3NpdGlvbiI6MTEwNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMDQsImJpZF9mbG9vcl9wcmV2IjowLjAwMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDQzNTIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: cto_bundle=S96NbF9XcUVrcGslMkJDJTJCMTd5UTNHOU1NJTJGNEl3cllWWG94JTJGYVNXU3hTQ0pGOFNTdVNEZUs1d2JPSEpEYU1YUldJQ1NpajlJT3JDRmRJNDJMakJSRlRuUDd6bWs5Q2hHTjkzRW5tQWFjRjRuMHIybVp2M09Zd2Q1ZHFsYU9icldMQW1UVyUyRnFDSnZRUndjSSUyRnYlMkZQQ3h0RFlmT3NzY2tGSURHZzJGZXJMOVdZcnBrZ2E2YyUzRA; id5id.1st=%7B%22created_at%22%3A%222021-08-16T15%3A17%3A15.640222Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Mon%2C%2016%20Aug%202021%2015%3A16%3A11%20GMT; __gads=ID=69e1f451e6f7b7cc:T=1629126971:S=ALNI_MYiPxzZYn7Xq-BE9eTSTBNvJd2PKg; ezouspvv=4; ezouspva=1; ezouspvh=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:11 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
40 B 17ms
17ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/porpoiseant/banger.js?cb=195-0&bv=58&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6Ijk0MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjMxMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTk5MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTE2In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6Ijk0MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjMxMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTk5MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: cto_bundle=S96NbF9XcUVrcGslMkJDJTJCMTd5UTNHOU1NJTJGNEl3cllWWG94JTJGYVNXU3hTQ0pGOFNTdVNEZUs1d2JPSEpEYU1YUldJQ1NpajlJT3JDRmRJNDJMakJSRlRuUDd6bWs5Q2hHTjkzRW5tQWFjRjRuMHIybVp2M09Zd2Q1ZHFsYU9icldMQW1UVyUyRnFDSnZRUndjSSUyRnYlMkZQQ3h0RFlmT3NzY2tGSURHZzJGZXJMOVdZcnBrZ2E2YyUzRA; id5id.1st=%7B%22created_at%22%3A%222021-08-16T15%3A17%3A15.640222Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Mon%2C%2016%20Aug%202021%2015%3A16%3A11%20GMT; __gads=ID=69e1f451e6f7b7cc:T=1629126971:S=ALNI_MYiPxzZYn7Xq-BE9eTSTBNvJd2PKg; ezouspvv=4; ezouspva=1; ezouspvh=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:11 UTC

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
19 B 16ms
16ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NzIsImFkX3Bvc2l0aW9uIjoxMTA2LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjI2MCwiYmlkX2Zsb29yX3ByZXYiOjUwLCJiaWRfZmxvb3JfZmlsbGVkIjo0LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0NTMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImF1Y3Rpb25fZXBvY2giOjE2MjkxMjY5NzIsImFkX3Bvc2l0aW9uIjoxMTA2LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiYmlkX2Zsb29yX2luaXRpYWwiOjI2MCwiYmlkX2Zsb29yX3ByZXYiOjUwLCJiaWRfZmxvb3JfZmlsbGVkIjo0LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0NTMsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
pragma: no-cache
cookie: cto_bundle=S96NbF9XcUVrcGslMkJDJTJCMTd5UTNHOU1NJTJGNEl3cllWWG94JTJGYVNXU3hTQ0pGOFNTdVNEZUs1d2JPSEpEYU1YUldJQ1NpajlJT3JDRmRJNDJMakJSRlRuUDd6bWs5Q2hHTjkzRW5tQWFjRjRuMHIybVp2M09Zd2Q1ZHFsYU9icldMQW1UVyUyRnFDSnZRUndjSSUyRnYlMkZQQ3h0RFlmT3NzY2tGSURHZzJGZXJMOVdZcnBrZ2E2YyUzRA; id5id.1st=%7B%22created_at%22%3A%222021-08-16T15%3A17%3A15.640222Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Mon%2C%2016%20Aug%202021%2015%3A16%3A11%20GMT; __gads=ID=69e1f451e6f7b7cc:T=1629126971:S=ALNI_MYiPxzZYn7Xq-BE9eTSTBNvJd2PKg; ezouspvv=4; ezouspva=1; ezouspvh=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:08 UTC

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/ Frame 542A 18 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Requested by

Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d643a5bfb1ea3db5f1781bf93afd45476c9a711cd78be36a4a28da05710f720

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/17482830078537030830/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Wed, 11 Aug 2021 16:09:52 GMT
expires: Thu, 11 Aug 2022 16:09:52 GMT
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 4247
age: 428779
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame F60F 0
0 72ms
72ms Fetch
text/html 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CsWXRO4EaYZOTFuP57gPI4pawBaroxK9k7P7R0bIO__WQ49cCEAEg9PnGJWCV-vCBjAegAb6LkdADyAEJqQK_V44pWMSzPuACAKgDAcgDCKoE2AFP0JGZ41-mqxrTLSptwXh9Unyx3q1B8BZq0j6VcGKiqAaCpFXr5UaNTyqLC7RWOV0FOffpPTo1ZYmUVGh7fwEjTMhitQrlehvPI5MXH4r_4HboeoEMEjGTPaOZy0Ryo3tXHaXEu9snZCu3BEDuIPQCfAJy2kR5Cb2fRjrrbsc0rvOEuTrB55nz3uGqrvgtOQ-fGG2nogb4cwdMfobY1Cot-2w8roV3yA52Q_0dCtZ5py-FnC7pb9v0t3UhrOXXfUFwIxb00EVwHVBdzddKZHoaXdl0fuUHutnABNyzsbP0A-AEAZIFBAgEGAGSBQQIBRgEoAYugAfq0pUwqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEKfAAtIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tODgwMjg2OTA3NjkwMjk4OIAKA8gLAdgTDYgUAdAVAYAXAbIXHgocCAASFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4GL7JBw&sigh=03mIMrAClKg&template_id=419
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s46-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/ Frame F60F 18 KB
7 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/abg_lite_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:14:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 122
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7614
x-xss-protection: 0
server: cafe
etag: 9899176843389144697
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:14:09 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame F60F 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:13:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F60F 124 KB
37 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628854326415524"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38195
x-xss-protection: 0
expires: Mon, 16 Aug 2021 15:16:11 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/ Frame F60F 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210809/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:12:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 212
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 30 Aug 2021 15:12:39 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8B15 143 B
202 B 42ms
40ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlSNlCnObU2OTBsImAdFlxDtkvIrh1UI1BMDhq6zdx-bUUKq9m-0WB2puAHMTQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 16 Aug 2021 14:16:33 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3578
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 542A 9 KB
3 KB 11ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 15 Aug 2021 19:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70821
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 16 Aug 2021 19:35:50 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 542A 26 KB
10 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9518
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 17 Aug 2021 12:37:33 GMT

GET
H3-29 200 c6afb71c43a6f510a28d0c5a9b6e8216.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/ Frame 542A 77 KB
20 KB 10ms
8ms Script
application/x-javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/c6afb71c43a6f510a28d0c5a9b6e8216.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d12411c852fcc11ebba43ff3acf0e5eb913439df6684cf56b4b85b0be15cef1

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 428779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20438
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 16:09:52 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 16:09:52 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8B15
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

61ms
61ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: 8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
URL: https://8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlSNlCnObU2OTBsImAdFlxDtkvIrh1UI1BMDhq6zdx-bUUKq9m-0WB2puAHMTQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 16 Aug 2021 15:16:11 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Mon, 16-Aug-2021 16:16:11 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 16 Aug 2021 15:16:11 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F60F 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee6151a20ee9d58e3d61bdd21bdf5bf9be1f3087db2bc80e4b4350b19e5f60b6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 css
fonts.googleapis.com/ Frame 542A 6 KB
636 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/c6afb71c43a6f510a28d0c5a9b6e8216.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1f2fa7e74884a4b14523d8d82178a964a20da8c45a9f38b9c30fd516eff418b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 16 Aug 2021 14:39:39 GMT
server: ESF
date: Mon, 16 Aug 2021 15:16:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 16 Aug 2021 15:16:11 GMT

GET
H3-29 200 a6bbc0bf7adcea5559699818d25507fb.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame 542A 2 KB
1 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/a6bbc0bf7adcea5559699818d25507fb.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0021fcf6011bbb68d059ae5ebda2cc09c8bee217a8b65868072cd991b8e5e564

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 428779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1059
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 16:09:52 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 16:09:52 GMT

GET
H3-29 200 0c7344eb51817eb88e50c1f5a818189c.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame 542A 3 KB
3 KB 12ms
11ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/0c7344eb51817eb88e50c1f5a818189c.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04977b423ffd765d6bab517ddf7e595bf5cc5ca43754f0f3ff0885c7292fd9df

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 428779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3034
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 16:09:52 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 16:09:52 GMT

GET
H3-29 200 68205a7bba4eca78358f122322a6922b.svg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame 542A 2 KB
1 KB 12ms
11ms Image
image/svg+xml 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/68205a7bba4eca78358f122322a6922b.svg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b47a3ee3ee877ea3de7f07c5e523d503c4144599479d967ddb9a32ded8957f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 43466
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1004
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Mon, 16 Aug 2021 03:11:45 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 16 Aug 2022 03:11:45 GMT

GET
H3-29 200 aa145009e51cbd97688805fc6853e759.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame 542A 1 KB
1 KB 11ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/aa145009e51cbd97688805fc6853e759.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb0a9e1893bc36c2e40e4f9be137b9b6da63b6cd76df7b024199963d19f214e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 428779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1087
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 16:09:52 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 16:09:52 GMT

GET
H3-29 200 c1241c6ef542ccc3a135381379b799d3.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame 542A 1 KB
1 KB 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/c1241c6ef542ccc3a135381379b799d3.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

549c549bf7c34a36255bb3da74d572eb72700285b8a337877f720719e8c02c03

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 428779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1241
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 16:09:52 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 16:09:52 GMT

GET
H3-29 200 e2fdc71e1ed3c1fec3bedf48f31f676d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/ Frame 542A 6 KB
6 KB 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/media/e2fdc71e1ed3c1fec3bedf48f31f676d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/17482830078537030830/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0dbe0e33fa54bef4741e319d6aaf8e2075f7be15324e5975e6e412a08f5878c7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 428779
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6012
x-xss-protection: 0
last-modified: Wed, 11 Aug 2021 08:41:02 GMT
server: sffe
date: Wed, 11 Aug 2021 16:09:52 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 11 Aug 2022 16:09:52 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 542A 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 03:00:34 GMT
x-content-type-options: nosniff
age: 562538
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 03:00:34 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 542A 16 KB
16 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 01:12:52 GMT
x-content-type-options: nosniff
age: 569000
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 01:12:52 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 542A 15 KB
15 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:700|Roboto:500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 10 Aug 2021 02:33:08 GMT
x-content-type-options: nosniff
age: 564184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15724
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Aug 2022 02:33:08 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 8D8B 0
731 B 76ms
76ms Script
text/html 185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:12 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e05cb245-5004-48f2-ab84-5b996c529993
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 427D 0
731 B 22ms
18ms Script
text/html 185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 16 Aug 2021 15:16:12 GMT
X-Proxy-Origin: 89.249.64.203; 89.249.64.203; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ac6ab71a-c0fe-4a7d-a1e2-56b7ab559164
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame CBFB 0
260 B 59ms
19ms Script
text/plain 185.64.190.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156983&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156983
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.81 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:11 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 army.gif Show response
thebirthdaybest.com/porpoiseant/ 0
65 B 15ms
15ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://thebirthdaybest.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils3MjgsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: thebirthdaybest.com
URL: https://thebirthdaybest.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-4y06-12y07-1y19-5y0b-5y0d-10y13-3y17-3y1a-2y1b-1y1f-2y1e-4y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1ax1bx1fx1ex20x33x52x56&abt=PositionCalculator
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODIwMzE2MTIyODg3MTQ4NyIsImRvbWFpbl9pZCI6IjE4NTQxOSIsInVuaXQiOiJkaXYtZ3B0LWFkLXRoZWJpcnRoZGF5YmVzdF9jb20tbWVkcmVjdGFuZ2xlLTEtMCIsInRfZXBvY2giOjE2MjkxMjY5NjAsImFkX3Bvc2l0aW9uIjoxMTA2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjE5ZDE5MmU2LWVmYWQtNDg5MS01YzA3LTg4OGNiMjIzMmYyYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1MjMsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils3MjgsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MjAzMTYxMjI4ODcxNDg3IiwiZG9tYWluX2lkIjoiMTg1NDE5IiwidW5pdCI6ImRpdi1ncHQtYWQtdGhlYmlydGhkYXliZXN0X2NvbS1tZWRyZWN0YW5nbGUtMS0wIiwidF9lcG9jaCI6MTYyOTEyNjk2MCwiYWRfcG9zaXRpb24iOjExMDYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMTlkMTkyZTYtZWZhZC00ODkxLTVjMDctODg4Y2IyMjMyZjJjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzUyMywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: cto_bundle=S96NbF9XcUVrcGslMkJDJTJCMTd5UTNHOU1NJTJGNEl3cllWWG94JTJGYVNXU3hTQ0pGOFNTdVNEZUs1d2JPSEpEYU1YUldJQ1NpajlJT3JDRmRJNDJMakJSRlRuUDd6bWs5Q2hHTjkzRW5tQWFjRjRuMHIybVp2M09Zd2Q1ZHFsYU9icldMQW1UVyUyRnFDSnZRUndjSSUyRnYlMkZQQ3h0RFlmT3NzY2tGSURHZzJGZXJMOVdZcnBrZ2E2YyUzRA; id5id.1st=%7B%22created_at%22%3A%222021-08-16T15%3A17%3A15.640222Z%22%2C%22id5_consent%22%3Afalse%2C%22original_uid%22%3A%220%22%2C%22universal_uid%22%3A%220%22%2C%22link_type%22%3A0%2C%22cascade_needed%22%3Afalse%2C%22privacy%22%3A%7B%22jurisdiction%22%3A%22gdpr%22%2C%22id5_consent%22%3Afalse%7D%7D; id5id.1st_last=Mon%2C%2016%20Aug%202021%2015%3A16%3A11%20GMT; __gads=ID=69e1f451e6f7b7cc:T=1629126971:S=ALNI_MYiPxzZYn7Xq-BE9eTSTBNvJd2PKg; ezouspvv=4; ezouspva=1; ezouspvh=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: thebirthdaybest.com
referer: https://thebirthdaybest.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://thebirthdaybest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 16 Aug 2021 15:16:13 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 15 Aug 2021 15:16:12 UTC

Verdicts & Comments Add Verdict or Comment

377 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.thebirthdaybest.com/	1970-01-20 05:56:35	Name: __qca Value: P0-1853437614-1629126961915
.thebirthdaybest.com/	1969-12-31 23:59:59	Name: _dlt Value: 1
thebirthdaybest.com/	1970-01-22 09:51:18	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
thebirthdaybest.com/	1970-01-22 09:51:18	Name: ezohw Value: w%3D1600%2Ch%3D1200
.thebirthdaybest.com/	1970-01-20 05:17:42	Name: ezCMPCCS Value: true
.thebirthdaybest.com/	1970-01-19 20:32:08	Name: ezovuuid_185419 Value: f3b4a9b9-52de-491b-43ad-bd318c30ea03
thebirthdaybest.com/	1969-12-31 23:59:59	Name: ezouspva Value: 0
.thebirthdaybest.com/	1970-01-19 20:32:08	Name: ezoadgid_185419 Value: -1
.thebirthdaybest.com/	1970-01-19 20:34:59	Name: ezovuuidtime_185419 Value: 1629126961
.thebirthdaybest.com/	1970-01-20 14:03:18	Name: _ga Value: GA1.2.816691754.1629126962
.thebirthdaybest.com/	1970-01-20 14:03:18	Name: ezosuigeneris Value: 5bbfe5ac401baa4b80b47fcbbfa92322
thebirthdaybest.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 0
.thebirthdaybest.com/	1970-01-19 20:32:08	Name: lp_185419 Value: https://thebirthdaybest.com/
.thebirthdaybest.com/	1970-01-19 20:33:33	Name: ezepvv Value: 0
.thebirthdaybest.com/	1970-01-19 20:32:08	Name: ezopvc_185419 Value: 1
.thebirthdaybest.com/	1970-01-19 20:32:07	Name: _gat_gtag_UA_148153416_1 Value: 1
.thebirthdaybest.com/	1970-01-19 20:33:33	Name: _gid Value: GA1.2.1284201477.1629126962
.thebirthdaybest.com/	1970-01-19 20:34:59	Name: active_template::185419 Value: pub_site.1629126960
.thebirthdaybest.com/	1970-01-19 20:32:08	Name: ezovid_185419 Value: 926060370
thebirthdaybest.com/	1970-01-20 05:17:42	Name: ezux_lpl_185419 Value: 1629126961938\|19d192e6-efad-4891-5c07-888cb2232f2c\|false
.thebirthdaybest.com/	1970-01-19 20:32:14	Name: ezoab_185419 Value: mod12
.thebirthdaybest.com/	1970-01-19 20:32:14	Name: ezoref_185419 Value:

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://c0.wp.com/c/5.4.6/wp-includes/js/jquery/jquery-migrate.min.js(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1
console-api	log	URL: https://analytics.webgains.io/pvClk.min.js(Line 1) Message: Webgains [object Object]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8d7ef948f192b727976907e39816e492.safeframe.googlesyndication.com
a.tribalfusion.com
acdn.adnxs.com
ad.doubleclick.net
ad.turn.com
ad4m.at
ads.avct.cloud
ads.playground.xyz
ads.pubmatic.com
ads.yieldmo.com
adservice.google.com
adservice.google.de
ajax.googleapis.com
analytics.webgains.io
api.webgains.io
as.ad4m.at
assets.ad4m.at
banner.congstar.de
bh.contextweb.com
bidder.criteo.com
c.amazon-adsystem.com
c0.wp.com
c1.adform.net
cc.adingo.jp
cdn-0.thebirthdaybest.com
cm.adgrx.com
cm.g.doubleclick.net
csync.loopme.me
d5p.de17a.com
diapi.webgains.com
dibsemey.com
dis.criteo.com
dsp.adfarm1.adition.com
fonts.googleapis.com
fonts.gstatic.com
g.ezoic.net
go.ezodn.com
go.ezoic.net
googleads.g.doubleclick.net
green.erne.co
gum.criteo.com
hbopenbid.pubmatic.com
ib.adnxs.com
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
loada.exelator.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.prod.bidr.io
match.taboola.com
mug.criteo.com
onetag-sys.com
pagead2.googlesyndication.com
pb-server.ezoic.com
pixel-sync.sitescout.com
pixel.advertising.com
pixel.onaudience.com
pixel.quantserve.com
pixel.wp.com
pr-bh.ybp.yahoo.com
prod-rtb.ad4mat.net
pubmatic-match.dotomi.com
rtb.gumgum.com
rules.quantcount.com
s.ad.smaato.net
s.tribalfusion.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssp.adriver.ru
static-de.ad4mat.net
static.criteo.net
static.doubleclick.net
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.crwdcntrl.net
sync.mathtag.com
sync.targeting.unrulymedia.com
tag.1rx.io
thebirthdaybest.com
tpc.googlesyndication.com
track.webgains.com
trc.taboola.com
um.simpli.fi
ups.analytics.yahoo.com
www.awin1.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
x.bidswitch.net
13.225.78.30
139.45.197.250
142.250.184.230
142.250.186.130
148.251.139.77
151.101.13.108
151.101.13.44
151.101.194.49
159.253.128.183
162.55.6.211
172.217.16.130
178.250.0.163
178.250.2.131
178.250.2.146
178.62.202.251
18.158.98.109
185.29.132.245
185.33.220.241
185.33.220.243
185.64.189.112
185.64.189.114
185.64.190.78
185.64.190.80
185.64.190.81
192.0.76.3
192.0.77.37
198.148.27.140
2.18.233.180
2.19.44.80
2001:678:cb4:bbbb::11
213.155.156.167
213.19.147.42
213.19.147.44
213.19.147.45
2600:1901:0:76b9::
2600:9000:2104:8000:6:44e3:f8c0:93a1
2600:9000:2190:4c00:2:cb38:840:93a1
2606:4700:3031::6815:160b
2606:4700:3032::6815:57ae
2606:4700:3036::ac43:a1d1
2606:4700:3039::6815:c03a
2606:4700::6812:d05
2620:116:800d:21:51e4:db4b:4436:b305
2a00:1288:110:c305::8000
2a00:1450:4001:800::2002
2a00:1450:4001:802::200e
2a00:1450:4001:809::2001
2a00:1450:4001:810::2002
2a00:1450:4001:811::2004
2a00:1450:4001:813::2002
2a00:1450:4001:827::2008
2a00:1450:4001:828::2006
2a00:1450:4001:829::200a
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2001
2a00:1450:4001:830::2003
2a00:1450:4001:830::200a
2a00:1450:400c:c04::9d
2a02:2638::1c
2a02:2638::3
2a02:fa8:8806:16::1400
2a04:4e42:3::300
3.126.56.137
3.66.136.156
34.253.109.165
34.98.107.212
35.157.197.70
37.157.6.245
46.236.13.147
51.222.80.231
51.89.20.87
51.89.9.252
52.205.247.225
52.208.41.69
52.30.92.119
52.59.77.57
54.194.211.3
54.250.62.115
54.77.232.22
54.77.236.168
54.78.254.47
63.251.232.170
65.9.73.121
65.9.79.193
66.155.71.149
76.223.111.131
81.222.128.216
81.29.72.47
85.114.159.93
87.98.252.5
0021fcf6011bbb68d059ae5ebda2cc09c8bee217a8b65868072cd991b8e5e564
00c8824ecd4185f6acd8847bcc1fdd8d860e57f4ad34e6fb1ad064ec892c85be
0176b7386f6b7afca46858a198de796d2e46977f269cf2df26d70179fcc07762
038bcd3b9fed84d18d5f9c979e559af298921f6cac0d6c826b95aa7bd7c048b5
04977b423ffd765d6bab517ddf7e595bf5cc5ca43754f0f3ff0885c7292fd9df
04a315ffd43347fe61b369379c000169016ebfcde5f10fc661bbea51906f7306
04d9e75f2e1acc4662492bd60b68c4619bf9f442412bb170d034ff626562b2af
056581eb31e79e98718114a4bd8c104cb64eec86bc5a996a28e61220f3aad189
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0b5cf6934f9f632cff3aeca60e21d4b38c28a74570df484abeaf0b643784283c
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0d41eb8b21bb9c81829462d6c101a45c58a2564cf4a02f1ec600b0a5c7c24697
0dbe0e33fa54bef4741e319d6aaf8e2075f7be15324e5975e6e412a08f5878c7
0e08306377162779d5e840b5ba35b232e2e4a76d0ef2b0f0c0625590300452fd
0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0f2d2f45f088919a22f4916e0c671072d8139931a3c6bce0e85be1948c114ba4
116e09ac0e6bd4cb7239309dc53e2139a7bdbaa4bafe596ffea29cc97fc58741
11b7d24699c245dc34450409434b7d682b39024559f032560672018fd2c9b416
12b6742262933edb939e8114acaa11f2d100a1da507b1fd56ea3fca9fb3a5f10
14375082f18c8501a36b803a80a3489476d037a97867ffa2a1aae1b65df4fa57
1455dde8a2d3f55eed00eeded1966ba0b4e9b3fcacb1324f4f2d1b5788b4c441
14be73a59c95cc79fed0860a4327330b458e3d49598f78960140a8959ea4fbc6
1752475d54bf961f717c1390d573ab245b0704550af83522afd99f532694e5dc
17b47a1ed2cd2e1ec86f4735497e2956eb34be0a66fc20b427148f65c6ebaca5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
18f9caf1c080d25a5fcc3b5aafdd1831fd50c74f920e4e1334e7ee99bd73529c
194ebae85ff853319e8668f23a4c5bf371a7d9f5d550a40980ab53026ddaaa17
1b7ff70878481c6f9206506efc41c937db091d1dc789791cbc9034769c61e583
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1f2fa7e74884a4b14523d8d82178a964a20da8c45a9f38b9c30fd516eff418b1
20160b923de864cdf44fa26bfd6281a9e0aba7eb800fac86804d9a41a93c2394
2295c7a89c8ac4a19e2641283109be472d8f58bd78e42a38a0d16e34203e4bba
245e542efded75af621b3a93818490cd57df8a41da0333184f643e2071c9ea0e
259276e953a3b9920c6417d287bae35182ed4c7180df53e11408fbbb2fb100a5
266e55302306eef74f3c891c0476b8eab81ca01a4ad485ef25f25c68b0ed9a20
2d723f58b0fb857b7d0ecb2679a1f5a015a63f61b6e1aeb585538da8e91e8f4f
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e
3225f378c00d8870e6d73c3b99cd541d2a9e0ce2d04b24fd41afee29d8c84da9
32b47a3ee3ee877ea3de7f07c5e523d503c4144599479d967ddb9a32ded8957f
3523634ca390de148c0e8f12e3820ac152d694f1f6f40641a24fb41d91d858ab
35751fd45cc96fc57e090b12cb1e4be8c29c99c930cc679874c6a9009c64b2f1
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
37fbc56848d8a6f47f63521ede0688ab5769b28faecbd34e9fecbfc9e1dcd029
3974624ff80521dbd81d3ed32f8ec10c7baef11c272f46626a6284538e90e44b
3b357e987bda84805d82e92e511ded1fe9fe6d96ba49aa82d56e9d9441100da1
3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7
3d3251d937d209def48e958bfeec683ca39dc0f15eb22f99bc3e7035995cd552
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3e47a87d677cee8a33f85a2936354180f9a8e1998617620fb451f1b193d99e34
3ef27da33e4aee066ae6b638396fc256a308268e8b66f7a8e4eb5aa9e706e5d2
44c6b8b0c5615b535786fdf7915306c6d3736a09f007bc9e983685d654e564cb
45800e1e3005695efb5fde7bda05ff4fb2e05c30e27b12752724c4dcef8c6a1c
4728d31a22bf0eb55d9bf50914ffc77f1c7faa27bcb509ec145a02e1d3a815d7
47ec02e18941bc1fe215e0bf1b47eaef6dd674b8adfb18d17e980203a94b9ff4
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48cf094bb5fdbb58ada2fe3c5241c7ebde724561c670eb2d84c18aa8a4768f9c
48d46c01316fa254779eb442f442013b0ab60df21ce40b4afb452173475b71af
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
494627acb3c86254c238efaf66afcaf30d4293c7512a37a72b51a380d55e3880
4bcba6ca13d0bf1606176d2408363d0370505b999089d312da533a86406ba2e3
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
51cd13239548a01c1be4d1fcd258e4f5b37714116e41f4f31360bc8dd75552b3
549c549bf7c34a36255bb3da74d572eb72700285b8a337877f720719e8c02c03
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
56ce1789c91a6c4dcb67e7eee6ba0e935c416307a9ca43f1fdc43eadd3f73318
5827adb70b8322616b409c3230bd1a69a203870fe0e77b2d19c74d36053c3a81
58da6480fc50a14bd6f73842552e9bfbd623d883c9a81d68b7d27b52d0afe71c
5b26ee86153154b851ce4b3cd06aad16600d75dad7df3e8fd346a07c22bffc0d
5b8e40848793a7e3892874fda515fea4d32452d42f3bc823c55dce4e870eb01e
5ca1c8e3b0ad9fa21aa7415d964584db567311edeeaf2ce889d14cf61529b1ea
5d12411c852fcc11ebba43ff3acf0e5eb913439df6684cf56b4b85b0be15cef1
5d643a5bfb1ea3db5f1781bf93afd45476c9a711cd78be36a4a28da05710f720
5e425279564d1f913ed187261d7699686b35eb72ec272e356e008d8487983806
5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f
5f5ff619ccfeffd7977c31bacda457d8dc10d166168841e28f04cf509b431077
61427155c3baa2ff394dbf4e9d5106922f4b648dd7243253685c0d942f51b576
631b76365e8fbf76325d172baf3241e56367f11b6d45a24b4b56ab342349abc3
651497199c44fcce1be1e13da9264fcf88caa7cc8f85f546e32c0da6de1ece5b
671855b8fadca442d443112b8ccc8c5f97081ca7f9395f711987d8fd38e71bf6
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b754f43cc3386fd7cecac575b5ef6416f9662ea4c29be3e2b3587970c188859
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f04964e2b1599980730940d8f0ea03ed715e37df6a0de083351e01587869faf
7107d3b3a6eb6196ff452a002a58a6221a5471626550f610ceb5fe4ba01a0aa4
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
745b53bef83f3701a98495ac9e63eb7b3fec46b9d1ed2d9acbb4ba1b1c035995
7761979199bf20d25fe4726392f9e6c268295e5d179b2bb5a683cb10fb6ad0d2
7772a9cc35fc902c0cccb8871670ec3e45e4695e1bc6941aee1c24db3de8c544
7919f4fde13d727f94f345387ca96bca80fcd67d546b711a9dcb78c51f30cc91
794d3584db7884efb83cbbf8c103a17ca4651c00c0277c4b8587fe2e953b65f5
79cc39ab51de99510d98e22dfc56bd456b3ffbb29671e3d2e61719ee50792565
7df5b2df2fb7330805d12f6d72fc277f7144d6706e484114c8086163d28833bf
7e653267eac8b860b7132c5f4c5555e4410ec0c88700172a06fd681b3abf1525
7f64a8c080204649482c14a75ae0dc2cbbb3b1414967c1fc012cb6fdbcb12f55
80d95328167947c0003a2c066f849c12427e849751483e62f0d6fd55b6278fb5
80e06a90757503a0f1f6c5ae3082f17b00bdb1f4bff5d92a65f0bb40afc5be53
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83bcdfa5df8e5f84aa8715b0aefb06e9909b30290843475a0ecc6887650f811f
83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a
84f8704bdc07ab2809b5a9dd028ef0c9e0001bd0b21c32fc06c18231069a581e
859b11e80036f5df2fab398feaa8af4d72c9450064a43fd23e074aca564d3e45
86ad3392d0eb2bd83ac4db174b9b5ab8fd46906befa113bb0c2f907c89dd080c
86ee0e760c043b495df32283b44ba844e416df4ac5189fe6a0d801c781e35125
88aafe970f36ef5353741e6e11e3faa7b2f01fed13e562e63795ecc50f67a303
8b081f7838da97c5394ca9e269c192f5c82c420769eac547917d4ff739032abf
8c2ad09a37894ce143c8b9040a1f851b2263d1e4a583499a0de30daa9d5fd31f
8e49b984d20b3e7cb3f2c4a08805dc3f66bb8a58ec08c365d0cf955dd57c77c7
90dadd2bc9dcf8e5b7945b959ebc596b978e250c47e0284bf9f3bfb2dfa92539
914c9a60d49cb7a8a4ad69289d5fa024624753bb31f3762cf3456e4b42e67dee
91d52d83e6b7f1ef97ac9d040e3144b5401e3c8af59b4e5209ec671343c9498f
95b17ad661699c049d42195b8ccd1d855045a1fcfbd20d8609a6d87fa5703810
9903282c31b5b0d7e6dab4e43220b778cac6d6f7241aaf1775bdcd7b51e52cb7
99b86f56dfbd9e779753a1fd5713a81f8e97b06009a037ab26fb2661e92b365b
9a1962449977f367370822c2dcf4b72817838fb25975eb9f14e25abfdf425a23
9a5d04f74cf2a5ac395114c141150def9ea2ec79fa5b06febc02cb396d2c88f7
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ab4e83b12ee7a3c4af979efc4d5b78b70f320bb94a8f3cb91b699c539baaf80
9e7dd4c381646efaad474d11deab4dd03f41d843427b2089e3fadfa8fbe2af7e
9f89d3a48cda8f6eb27fba7e495b987c0f64dda095b12a0ac23fa97ba4396d86
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1892cc92f36f93d02f1f8fe25b9c6f9fe025ad7c6f596189bc0f00ad7ffa575
a1a54f027b2f546b2ebe3cee0298f519e32124f3d8462b3525d8208caa7c44f3
a2cda6266b679fadce326a8f4bf7b4b42099b431f4300d2c1c168c58e70e538a
a42f2ec73409f2753ef17d737714c86303fa45fc3a3d484a9b0c8ed28ef0fd6b
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4f525fbcd94cdc71ba3399836356b39d0df8f535a8dbb698fc178bab6941285
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a7070d8f512699929458dd165b0e21205696f9eed9b6577380753be156b85bbd
a726199a71923c42f93af1ecbc5c68c36d9f059e9122df74bf42a2a1f2e7bf17
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7be4e9fff17af6b9714ec8bd377f2c72e49b7dee4bd192e05e1e7a02927f68c
a7e8a53262055fda93674c96c131549f2fa95b91d5abcd40f8068451dcc4be18
a811cdd3cc104921de89ce0729e2e22424166e328babe3d63929a11ba1114dce
a8cb93ebf2fd2978b6cc72dae22948c5709b1c2c4ea4463c1bb2ad8353e194b5
a90918a2ae487990634db4f5af82f0e0242cd6f69f3507497a9188232d273c05
a9bde835f4362e985222d49d502896a974881b1796148be58821c3ceab87d84e
aa7b6d5b770a73bfa79bb530f6549221a559d0e366daa55005255ec66ae752db
acbbae3ea8c718877be4d5cc6437e6837d712b847a82b4f0aed2dc10bf9fdb64
ad19e31b53c888cdbaa1b466e37e493b6a938c5d6084b70670ff8e911bb1868f
ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910
af8d80b7b208e83bdfd8218f77b18317b5e5f50b251b5b180aece1e8490a79a4
b2254b2d5856d54d17967db74e4cec415f1b22e98c376efc1d6bb9e7ee3ff0bc
b2f950e50fbe30ebae800be251297329e52454b3a1d7e9380285a855a4c3a85d
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b7a6b79b5a02d64e0adf826fc34e94e60985e497ec956aa4fe834cf48ace2520
b7e1233f57820817f87ddae403f20ab752314e5aa8fa2b8d72c8087531d2ecdd
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bb719cc044503dc3380932e75ff69982cdcca326a1c5889ca65e66fec997c271
bc29f13fb94cae8a4c37c09492574b3f35ad607cb0da8a65005ba15c73dc1f4f
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c15772210ea6cd29deb48acc82407f99bf9e5e2a465dac9ed4ed0cb7d4900de9
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c35529095f6b1a1b2f9345e8d7e86532048ffbfdd082f03ed114be88865388df
c524ba10500efc16ad21cd3163bb1b2ba835d20d70bd0131f8b31cdb30bed977
c73575543a5c99018f842960f9882edaa0918965ea856e91de9717a0d58d3f1c
c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca6a11dda45eda23b30636ac74137ee1b839b417b3b59644ecc8fa59e7af28ee
ca9e35504318e860fd9ad0ed48f1e313d5c232391cd258cced001d2c36f2a805
ceb0c4a7c517e56215c8bed93d88e391028dd3adabe0193a8f7a282b2370ee33
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfb0a9e1893bc36c2e40e4f9be137b9b6da63b6cd76df7b024199963d19f214e
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4
d167ba406bee58c34a8698ba5157f4e6ebba4a5fd7353f11cc7d2d304c882238
d6442ebe1948b7fdf0f75485cc8093a513bdee0fd4480332e91514aeddb4d787
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
d69439261429c76c1f7643d3437d6cbfa7b0f7a8148e55d1bcdf0fddc89c51e7
d86a1f085058e7a82920bb9001286c7033b95dc0f7e1555e4fce2ffa6230748d
d8901fa0327db3662c3a45390b4e1bb8751f5432b4f743f0f9a17afabfd4011e
d928cf17dbe2e8386eb5aaea21667a4e255118f3c59047289e114e92711a8de5
d95c6a62ba32eb57c6e1165a98d89c61b462a52479917ebb811ca71a35fce0f1
d9925dc8fdc741305ffba07d91a1ea84c3e56187e55fa30b4063f7bddaaef318
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de5c6a54557523ce453b6d7a69b82083d77366e635eced1d8526010f9ee1850a
e17a0af89c14dd4f2e776d60d6f5bc81b1765c5c75357c1cd1e09a25baeab520
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e
e39d454539ee75b0abd32949ed1b98a26372b372835ad22c3e907a2d30b7021b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44f709face9013da1e9679c6b316b4b59280bdcba01ad65c1e87bf4bd889e35
e45818350fb6700935c0dce924d8317b166845c5516bc391a1dbda39203f143a
e482a48fef03d183029fa2edf995fc8e9ce023f18649fd1d9149958e977068a1
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e61660c659c426e45bce2937dddb01af6b550502a2904546575c1ec2ba1121dd
e74d690c55c4d97d5a5d5fe50352ba1c78651037684fb59c6acba97ea98c99cb
e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624
e7d005b3fb3c0c127e4fbe94d746f86a4a2b3c3468a2c8e8b1aa37abd29a65ed
e876d19cab827dbd742973a70681f7b8b70425db6d56d679fd42b851ccd084c5
ea597dacc66cab54b3c1d9863555b52f0bd53adb81e168b79798a8ce1ef63112
eaea61820092665c1a2bd21110eee0a777ef2c7d6048b39646e7680540cc7cea
eceb3544d41694df2c09dd939e55bc742e2a2a1e50bdc82f1b8ec6be84143d78
ed326683716e2ba42e83422611872e492783e5b610a086858518416c64ee66f1
ee22f683394ec9d609b8c7b90e446dc4fde1cdcf0895322f7004078b5d3ed549
ee6151a20ee9d58e3d61bdd21bdf5bf9be1f3087db2bc80e4b4350b19e5f60b6
eeda6b3f73792218da2a6f90f1966c3f4c0f282216a68c55014e77bed518a1bd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efe5b6d12c0b9d78012391db481d5d6037aef98b7288d1d5c730f6c1872a3a58
f058ecc947d0bc01e2855afaff0be17a2e30ae1e067ad3a5389b986a62225e26
f0b3328fc07a63c6c8b7dbcbb8cba062c5c1d196f2d3652b398e55269f769812
f2c17a862f3be5d23186e72de051a7967ba6caf173b0a1d950fd904c67985e3b
f33061bee42031c568f051b2780bf79ebad5fd3d22d5f86bc2f7b885b5ab4c20
f36208176fcc39db1577d9ccca9dc171215a06965d40886e093e8bfad122c8ba
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3f9d280476e08f41614dfe83939d905c8a63d2e86424f314041916338d174cd
f6c27bbe9d67cc35943d29ad4940c3ec766d5eadaeb82faa9fe87c951fa283b3
fc4ca8834002e12c86b0dd8d02c10ec5a09396f09877f730b5b9eedaa08e1a65
fea0268725ebc6cb05524948c1d104a022c45040834587f69c87d3cf3b95d500
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ffbf2d2525e0baabd5fdf5289510e03e86ccb28dc9767ef58bf483077f3bfc75

thebirthdaybest.com Open in urlscan Pro 18.158.98.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

373 Requests

100 %HTTPS

32 %IPv6

63 Domains

96 Subdomains

65 IPs

12 Countries

2563 kBTransfer

6034 kBSize

22 Cookies

6 Outgoing links

Redirected requests

373 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

thebirthdaybest.com Open in urlscan Pro
18.158.98.109 Public Scan

Screenshot
Live screenshot

Full Image

373
Requests

100 %
HTTPS

32 %
IPv6

63
Domains

96
Subdomains

65
IPs

12
Countries

2563 kB
Transfer

6034 kB
Size

22
Cookies

373 HTTP transactions
8 data transactions