sl.makeupexp.com Open in urlscan Pro
172.67.178.52 Public Scan

Software

ESF /

Resource Hash

12eebba255ce6f856459cab6b183b507be0417a322f46faf7dd71b3c4b0eec27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 15:12:55 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 24 Feb 2024 15:19:31 GMT

GET
H2 200 plugin.min.js Show response
get.optad360.io/sf/e0f4023d-1f54-4786-94e7-bff2e058d23f/ 319 KB
73 KB 922ms
487ms Script
application/javascript 54.192.51.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/e0f4023d-1f54-4786-94e7-bff2e058d23f/plugin.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-38.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a9dca4f8dc68c430aa629a96c60c52a3126cbd8d0bc2f8a009232ec7843126d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 08:01:58 GMT
content-encoding: gzip
via: 1.1 0012c469abc357ca0c936faaf17aa31a.cloudfront.net (CloudFront)
last-modified: Sat, 24 Feb 2024 08:00:07 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-C2
age: 26254
etag: W/"82bdc29bc841eb471eb10143923b340d"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-id: Ml80bii4j8PbdUARlBkFVcXtX6ZuxIxODh5yrppZ1xC6HFM5Gp00hA==

GET
H2 200 059f101d-0acc-47fb-a58d-9f68ce976fd8.min.js Show response
cmp.optad360.io/items/ 509 B
903 B 918ms
498ms Script
application/javascript 54.192.51.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cmp.optad360.io/items/059f101d-0acc-47fb-a58d-9f68ce976fd8.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-2.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3d55476038dfe34a53d1e5be0d78fa70b2dde6720d622be9ff8b9c9008b0de52

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 08:01:50 GMT
via: 1.1 8628ab00b77c57209ad876418b745f6e.cloudfront.net (CloudFront)
last-modified: Thu, 05 Oct 2023 07:18:57 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-C2
age: 26264
x-amz-server-side-encryption: AES256
etag: "381c4f6280220ef32c8f220972fdfaab"
vary: Accept-Encoding, Origin
x-cache: Error from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 509
x-amz-cf-id: cjKLSQXLeCz0m89YIGSAt1FsGYZc46BqVY1_H5lgBb-l2doacmZrcg==

GET
H2 200 how-long-are-dogs-pregnant.png
makeupexp.com/img/dogs-cats/45/ 777 B
1 KB 222ms
202ms Image
image/png 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/45/how-long-are-dogs-pregnant.png
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c24487962617ff725a8044ee120bcc6c03c58e7956dd69b12e795abfff9d01d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 777
last-modified: Tue, 13 Sep 2022 21:03:08 GMT
server: cloudflare
etag: "6320f00c-309"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zn%2FuC7MfJi6ZLy2oAQnz8pQMEiwsXcItj2ivoK8n014OHaeiv4HTm75H6KhZ0EtFELJaDBHbHASs1fkLabcWYEeNZ6YDYVaKZ87Z9Gdk%2FwXfEJLhmA0xxmy%2FdmTzucaC"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff49e271927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 7-best-collars-golden-retrievers-2022-reviews-top-picks.jpg
makeupexp.com/img/dogs-cats/86/ 22 KB
22 KB 294ms
275ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/86/7-best-collars-golden-retrievers-2022-reviews-top-picks.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5672bc9f0b244f9a57d4fdbd07be5d271a0f5312ec3299271515bb49fa14b6a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 22236
last-modified: Tue, 13 Sep 2022 20:38:00 GMT
server: cloudflare
etag: "6320ea28-56dc"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3mMY6A7ulLLWdR589fNrQVnAfZA4JWglRBtJmPRqIr3rHZbUeMHuWObigMIcezWtSNW7PezW20rbqw8wM6y6z215kjNl%2BU%2F1a6dJAPpBsf3ALFhSJg8r0XV9Kv31DIM"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff49e281927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 10-best-toys-cats-home-alone-2022-reviews-top-picks.jpg
makeupexp.com/img/dogs-cats/37/ 16 KB
16 KB 291ms
266ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/37/10-best-toys-cats-home-alone-2022-reviews-top-picks.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fb2d763e8a3a6a4b2510c1a2da75eed46d1396505835fbe69586ac1ba163d9d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 16519
last-modified: Tue, 13 Sep 2022 20:39:44 GMT
server: cloudflare
etag: "6320ea90-4087"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dzVmXPlSiMp%2BZ%2BI%2Bj0gyPAam85SGW18zoGXktqY4tSAPbadOi%2F%2FAbilUhdsg687veYv0Ug%2Fu4AhOAsHcefM5pPv2tP6tm18G%2FnrYyKwT0KamTtMZ0JCpSztXjGWhs8ks"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae3a1927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 raisin-toxicity-dogs.jpg
makeupexp.com/img/dogs-cats/74/ 39 KB
40 KB 293ms
267ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/74/raisin-toxicity-dogs.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e01d850c7975cd97ce5f0fcb2d1d050f990611aa2166262f985504baa39d208f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 40425
last-modified: Tue, 13 Sep 2022 20:32:40 GMT
server: cloudflare
etag: "6320e8e8-9de9"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a1DIf%2F%2BYO5815Yk9vhJgpkDEfVJuR3e235hp%2F8WGmCB8Q4XXhcZrwqeHdaNDkeV8GMXzX8K5Ot8GoeE3LvYO8We2NnQazFXjfgIo2sq2UcQ3WGrXCurBN8%2FSLwq5Wzlu"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae3b1927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 purina-beneful-vs-bil-jac-dog-food.png
makeupexp.com/img/dogs-cats/91/ 2 KB
3 KB 216ms
187ms Image
image/png 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/91/purina-beneful-vs-bil-jac-dog-food.png
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 79f2e62d37ddfe7d9fd83e1a84321b82a27b30f8108f526d75d2cb170218c3d2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 2548
last-modified: Tue, 13 Sep 2022 21:00:22 GMT
server: cloudflare
etag: "6320ef66-9f4"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XmZTfSiL7sW9F8rPnh627ukDjK9V%2BCuSoVmFhZ5rSmgD4DdtSGV0TIA0QcII9zmg58Ib%2BKjlTjWvM7CBe%2BS6Ro%2FmvRjscdBBuow1Q2Oa1GsPXIDpSH5OS3%2BdIzOIOwyt"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae3c1927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 10-best-wet-puppy-foods-2022-reviews-top-picks.jpg
makeupexp.com/img/dogs-cats/66/ 19 KB
19 KB 288ms
265ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/66/10-best-wet-puppy-foods-2022-reviews-top-picks.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 949bf4236f12f3e9d4ed80d8d7206f0b9a2257541c06a44c72d639fac2371735

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 19531
last-modified: Tue, 13 Sep 2022 20:38:52 GMT
server: cloudflare
etag: "6320ea5c-4c4b"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YpNzj0vW6ZwpWw7uQRkWyscSh8l2KJQ5mMKUyEkbVo4fvx%2B36OS54RsZ3wBv006K7wPpX7F8kqusigtfpMWMILQ0MsxDM1eQcwiiYTVAmB1XGdRBcKz47yHYDZbXPPOD"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae481927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 oravet-vs-greenies-dental-treats.png
makeupexp.com/img/dogs-cats/63/ 16 KB
16 KB 291ms
268ms Image
image/png 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/63/oravet-vs-greenies-dental-treats.png
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f69da46a040a463505e90219932f4d2682fe1d55604a2d2273329de6d99a75ee

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 16233
last-modified: Tue, 13 Sep 2022 20:42:50 GMT
server: cloudflare
etag: "6320eb4a-3f69"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FfpOyulb4945ZAtOBIgf7%2BHn0pDmlq9qIozhRVXMjXj%2Bew5I5h0Cg5scWdoqXgeXykaTieO0L2uUmMl3qeggc3URHETHiiMLYGqFVefgy%2Ff%2F60nV6gBUjq3kgcbEWGzT"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae491927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 15-dog-breeds-with-curly-hair.jpg
makeupexp.com/img/dogs/50/ 213 KB
214 KB 370ms
348ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs/50/15-dog-breeds-with-curly-hair.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ded874637251d97899c67c8d31110689e3abafd6d0ce57d8f439137d03be4fb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 218136
last-modified: Tue, 13 Sep 2022 20:12:00 GMT
server: cloudflare
etag: "6320e410-35418"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VLm8HgbIoEZjqhT8tEoqYVymgCl3vTBqfLhBuOSVGui6X4vdAckoHOnpl7PZR8iBOE6Aa8e8ZCN1SLgoOklXg9jGb26auR1HhCKQQhckTQRQQi2sBsvFvAmVzknWDwOb"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae4d1927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 can-dogs-eat-crab-crab-meat.png
makeupexp.com/img/dogs-cats/38/ 715 B
1 KB 214ms
192ms Image
image/png 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/38/can-dogs-eat-crab-crab-meat.png
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27877c98ca02a6267e1b4fc142fb76d1cc2c347ea9268a0f41c2af7a40fc31c2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 715
last-modified: Tue, 13 Sep 2022 21:03:26 GMT
server: cloudflare
etag: "6320f01e-2cb"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1%2FqCdwi%2BZQyCefYXtIw7246Q79UH2S8H%2ByO6kNcxf2q4is%2B3TIXxhq3J0CEe9tdPCai0rm%2BfpAqoC49ug3kJ83YyGo0Wcot9rWJgRHQ5hDVhanAHPGP7ysWET9q52I5i"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4ae4e1927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 how-intelligent-are-german-shepherds.png
makeupexp.com/img/dogs-cats/99/ 715 B
1 KB 224ms
202ms Image
image/png 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/99/how-intelligent-are-german-shepherds.png
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27877c98ca02a6267e1b4fc142fb76d1cc2c347ea9268a0f41c2af7a40fc31c2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 715
last-modified: Tue, 13 Sep 2022 21:03:22 GMT
server: cloudflare
etag: "6320f01a-2cb"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PnLMNUbMkZMRC0yX0vuqh%2B%2BwKwujMnQEZPM3TlFFm7po3S2vXzxnPNuJQMaW3BlzlHz4E0MuFZBs1h0LCqiBnulT88zphdvQXTW6DODU%2FDnK67bXla6RvGt0S4sl9qR6"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4be5f1927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 6-reasons-why-cats-nibble-you.jpg
makeupexp.com/img/dogs-cats/88/ 54 KB
54 KB 409ms
388ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/88/6-reasons-why-cats-nibble-you.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d994ae4b58a302ab21a96ac91b9081133ece12fedbde56a8384dc90aabc6f0a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 55012
last-modified: Tue, 13 Sep 2022 20:27:04 GMT
server: cloudflare
etag: "6320e798-d6e4"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ZR%2F8SbWyFbdLm5Y%2BsqyDMqobS%2B9K03I5xQRMZOatSwIu1gAq0%2FgCI0ycjqltUbQfnOGSjODN9zfrqy1U1JC2Hh5YTExHhxL9nRcvo5ZqW5KpIBfGWTp4Sg3dzMZSP9a"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4be611927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 10-best-tactical-dog-harnesses-2022-reviews-top-picks.jpg
makeupexp.com/img/dogs-cats/01/ 28 KB
28 KB 327ms
307ms Image
image/jpeg 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/01/10-best-tactical-dog-harnesses-2022-reviews-top-picks.jpg
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53bf9d8ea0c97bf1539088caea20862bca2b78f7787e7e284ff56e52c70dfbfa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 28484
last-modified: Tue, 13 Sep 2022 20:34:50 GMT
server: cloudflare
etag: "6320e96a-6f44"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/jpeg
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bcWhWIHfPEdqdrgFX4VHadHnS3svjm68VRSrxGVyE8%2BjBan1PNf%2FE2XCMYF6SNqi%2By1NJKEWLic3Cwj6aOOQhkJDTYRNyuZSaNFrtUvBZ0T3syCpFx6Ih9DLNjKGIK9I"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4be621927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 flat-coated-retriever.png
makeupexp.com/img/dogs-cats/29/ 703 B
1007 B 220ms
200ms Image
image/png 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://makeupexp.com/img/dogs-cats/29/flat-coated-retriever.png
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 150316c31db540f5b872862ec520aded88d4882153e52ce5cd42a3677253c450

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 703
last-modified: Tue, 13 Sep 2022 21:03:58 GMT
server: cloudflare
etag: "6320f03e-2bf"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: image/png
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aOjn14Q%2FyQRPtKxTdNu8WNur6aMNHGDZvvB9sGlqK9VYR6C4iR2hilsHIZqA0D3STLhl70tOA7LyCTvaGOfmoEkwBQZYSuYAceLQ70CMO1Ypa0jlP3Zr6u9W1424oqWq"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 85a8aff4be631927-EWR
expires: Mon, 25 Mar 2024 15:19:31 GMT

GET
H2 200 jquery-1.12.1.min.js Show response
makeupexp.com/template/js/ 95 KB
34 KB 35ms
7ms Script
application/javascript 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://makeupexp.com/template/js/jquery-1.12.1.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1065025
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 07 Aug 2023 14:51:49 GMT
server: cloudflare
etag: W/"64d10505-17c7b"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eYgv4ncm%2BH%2FkFKJ%2FGU%2FEuZHmibOwjUxFnya26ffx5s4ck9HqnHjB%2FL8QXVPDlAcPeN%2FxdSJAN0z5EYuFA%2FSar8EESJTsWkp%2BFU1SG%2B8fF%2B8owmnArZgzHm9SDT5sEh4D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
cf-ray: 85a8aff4ae3d1927-EWR
expires: Wed, 13 Mar 2024 07:29:06 GMT

GET
H2 200 popper.min.js Show response
makeupexp.com/template/js/ 21 KB
8 KB 31ms
3ms Script
application/javascript 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://makeupexp.com/template/js/popper.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1445173
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 07 Aug 2023 14:51:49 GMT
server: cloudflare
etag: W/"64d10505-520c"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oKzZyvqhV9N6an4VR4JjIm%2FKUDL3FUQw8yVPiNqKDzJq4QD2LRCIduQ1rTp9kDvjUlFnuNxLPDTYbrVxK2SLOesl4VCrPQ%2BP%2F%2FipFwGyyKFnkM3vP7Q9nYCThyL17TrG"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
cf-ray: 85a8aff4ae3e1927-EWR
expires: Fri, 08 Mar 2024 21:53:18 GMT

GET
H2 200 bootstrap.min.js Show response
makeupexp.com/template/js/ 57 KB
16 KB 33ms
6ms Script
application/javascript 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://makeupexp.com/template/js/bootstrap.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 117758
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 07 Aug 2023 14:51:49 GMT
server: cloudflare
etag: W/"64d10505-e2d8"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pZ2fFp5VFsnGjZY%2F33PJLCC%2FG%2BBLtLmyMY%2FVWtbyM%2BnsP93VQxRKcJF0KMpyhshjjnUp4bdZZX0591v%2BaKTpgCzVcjrEdFYc81Q1DtaaUTxmhU0rdXzuaSO4IrLYKK5Q"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
cf-ray: 85a8aff4ae401927-EWR
expires: Sun, 24 Mar 2024 06:36:53 GMT

GET
H2 200 custom.js Show response
makeupexp.com/template/js/ 424 B
682 B 30ms
2ms Script
application/javascript 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://makeupexp.com/template/js/custom.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cff480607f9f5a96493930146a621baf047233c8024ae916bdbba62faae43efb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 871813
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 07 Aug 2023 14:51:49 GMT
server: cloudflare
etag: W/"64d10505-1a8-gzip"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z2rfv5YSV0KtR0ZjhJqvD5sVcXyz3immlli%2F8DDsnfE%2FzdXMd33xPoJ37frVSUMbSt5SY%2FYDgFI69tk4ik9SYbJ%2FOqiF1hlhEE5ZlEQTkRG4Dx5HeJybF8S1kPRU4saw"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2592000
cf-ray: 85a8aff4ae421927-EWR
expires: Fri, 15 Mar 2024 13:09:18 GMT

GET
H2 404 jquery-1.12.1.min.js
sl.makeupexp.com/js/ 0
0 215ms
188ms Script
text/html 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sl.makeupexp.com/js/jquery-1.12.1.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RhH8%2FDrLIajLjl8ermM8dDm1qTkvmI1EJZvOWLkIIP90c9Xr6JLrBfMXtFnhPqSFW1jFLnAueuC158It%2FWH%2BNJm%2FLdyEDE%2BckhIqwWFtPa1JTQy%2BcXkoD%2FSrtRDmVCysFD0H"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-ray: 85a8aff4ae441927-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 404 popper.min.js
sl.makeupexp.com/js/ 0
0 216ms
191ms Script
text/html 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sl.makeupexp.com/js/popper.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TJ%2Bkgj4R0Bsph7jAuF9P%2FX23OyOEqnbX2tRFx59PybqBm9VSPfaH%2FBJFSoa7fwDYajS2krz82qW5y9m1OWZA9EDYh6Qt2lCr%2FxHi2cWGo0OhOOiaDWQVyNeiHJVtOgCNSrVz"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-ray: 85a8aff4ae451927-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 404 bootstrap.min.js
sl.makeupexp.com/js/ 0
0 215ms
190ms Script
text/html 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sl.makeupexp.com/js/bootstrap.min.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sDI7R5ls0846gIsL9rtqpcjvD3nOAzSJjxrNQ0GKI7xgxLleUacLK%2BsS0AAVS6inw%2FUJSgUZvxmH4SHNc%2F7O5jdrOTb8AEWXfUa8weQRycGsaeqKn25SHBIDA8mbqCf%2FQbTW"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-ray: 85a8aff4ae461927-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 404 custom.js
sl.makeupexp.com/js/ 0
0 218ms
194ms Script
text/html 172.67.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sl.makeupexp.com/js/custom.js
Requested by: Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.178.52 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SJplMjkNVQz%2BNej4T%2BHn88T%2BZwxZYWI0kGlKWmQNbElClfeoFyE6ecaAzgqbl%2Bk4f9JAkx3jAooElJ7d7uNJG%2BanBcJOQWfE02lLmHA67csDaBKdHDDFGWGGut8FYLeu9AX0"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-ray: 85a8aff4ae471927-EWR
alt-svc: h3=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 11 KB
2 KB 344ms
29ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Requested by

Host: makeupexp.com
URL: https://makeupexp.com/template/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c10b26ac661d1b022ef75e7a36929c479b88e22f31515f6bf10cf0ef79c3c319

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 24 Feb 2024 15:19:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 15:19:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 24 Feb 2024 15:19:31 GMT

GET
H2 200 wlp_gwjKBV1pqhv43IE.woff2
fonts.gstatic.com/s/cardo/v19/ 15 KB
15 KB 599ms
45ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v19/wlp_gwjKBV1pqhv43IE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1346360729e77380edf8f17fa421b76452289ae1b5f4be290b19c4d204e9587

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 08:25:20 GMT
x-content-type-options: nosniff
age: 24852
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14880
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 17:05:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Feb 2025 08:25:20 GMT

GET
H2 200 0QIvMX1D_JOuMwr7Iw.woff2
fonts.gstatic.com/s/lora/v35/ 37 KB
37 KB 574ms
20ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v35/0QIvMX1D_JOuMwr7Iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16a2619b4d831694734838f42d825eb871ee5160d241900b780ad523404b1c50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:35:25 GMT
x-content-type-options: nosniff
age: 200647
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37764
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 23:11:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 Feb 2025 07:35:25 GMT

GET
H2 200 wlpygwjKBV1pqhND-ZQW-WM.woff2
fonts.gstatic.com/s/cardo/v19/ 18 KB
19 KB 571ms
17ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v19/wlpygwjKBV1pqhND-ZQW-WM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f94a0b25ed421e6643ca8ae21ccd63cf5630e8db8a3b64f63a669936d068c427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:34:02 GMT
x-content-type-options: nosniff
age: 200730
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18852
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 17:09:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 Feb 2025 07:34:02 GMT

GET
H2 200 wlp_gwjKBV1pqhv23IEp2A.woff2
fonts.gstatic.com/s/cardo/v19/ 23 KB
23 KB 593ms
44ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v19/wlp_gwjKBV1pqhv23IEp2A.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aed2a517faa72011a5192fbdf01969219e9a4728cae4efdb8eb9d4f250692dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 12:18:58 GMT
x-content-type-options: nosniff
age: 10834
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23532
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 16:54:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 23 Feb 2025 12:18:58 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2
fonts.gstatic.com/s/opensans/v40/ 18 KB
18 KB 598ms
50ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7af9d60d875eb1c1b1037bbbfdec41fcb096d0ebcf98a48717ad8b07906ced6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:47:55 GMT
x-content-type-options: nosniff
age: 199897
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18668
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:00:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 Feb 2025 07:47:55 GMT

GET
H2 200 0QIvMX1D_JOuMwT7I-NP.woff2
fonts.gstatic.com/s/lora/v35/ 19 KB
20 KB 595ms
53ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v35/0QIvMX1D_JOuMwT7I-NP.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dac40935c6c2eae15288f77ac1b1e9c2927598f0dd45bf65426dbbac45f4dfdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 07:16:27 GMT
x-content-type-options: nosniff
age: 201785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19952
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 23:11:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 Feb 2025 07:16:27 GMT

GET
H2 200 wlpygwjKBV1pqhND-ZQY-WN3aQ.woff2
fonts.gstatic.com/s/cardo/v19/ 16 KB
16 KB 114ms
56ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v19/wlpygwjKBV1pqhND-ZQY-WN3aQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo:400,700|Lora:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd1aad7605548ccacaa16721b0eccc10987b0e29a67e86ae891ea7a7dba966a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://sl.makeupexp.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 02:25:21 GMT
x-content-type-options: nosniff
age: 219251
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16740
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 17:06:11 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 Feb 2025 02:25:21 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 90 KB
29 KB 885ms
87ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/e0f4023d-1f54-4786-94e7-bff2e058d23f/plugin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8b8ce377541bc103357cba62fe8f8de9d50c302977c5b63d52d9e5b8cad7b51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29066
x-xss-protection: 0
server: cafe
etag: 708 / 19777 / m202402200101 / config-hash: 2958856145408218626
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 15:19:33 GMT

GET
H2 200 prebid8.20.2.js Show response
get.optad360.io/assets/js/ 510 KB
164 KB 25ms
25ms Script
text/javascript 54.192.51.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/e0f4023d-1f54-4786-94e7-bff2e058d23f/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-38.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 510178b6d31d46a54c7bdacc0456720c5bbb9be1c47f603ecffc61899018b768

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 21:08:12 GMT
content-encoding: gzip
via: 1.1 0012c469abc357ca0c936faaf17aa31a.cloudfront.net (CloudFront)
last-modified: Thu, 11 Jan 2024 07:08:59 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-C2
age: 2571081
etag: W/"643c66a3d7b92031d1740b1b750e096d"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=360000000
x-amz-cf-id: goUYwFN_VGwbjVYg4f7O4_lH02wlOGuE54v8338MmuOkep0dBeDZJg==

GET
H2 200 branding-ads.svg
cdn.optad360.net/icons/ 7 KB
8 KB 839ms
22ms Image
image/svg+xml 3.161.213.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.optad360.net/icons/branding-ads.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.55 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-55.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d04a8585ca1c9cbff59e413fe76da6b8dcf3c567cbc68ec436b852d7f1694df1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 30 Dec 2023 22:54:23 GMT
via: 1.1 e9f20e77ad618b3d7de202fce429c5c4.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jun 2022 12:02:24 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P1
age: 4811111
etag: "b0a3aa2e09d4ddd83150d7bd3347c5c0"
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=360000000
accept-ranges: bytes
content-length: 7419
x-amz-cf-id: ef9RiBa2j8lXKQ-loPSYDk12bJ1xez0iT-uEgby8uU34-OsFoMPRcw==

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 602ms
10ms Fetch
application/json 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20240224

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

554cb59268d02de57a55cb6efd4e55bb9a0025b8b9aeca6d5ebcbad8674610f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 24 Feb 2024 15:19:33 GMT
x-content-type-options: nosniff
content-encoding: br
age: 40721
x-jsd-version: 1.0.1975
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 918
x-served-by: cache-fra-eddf8230103-FRA, cache-lga21982-LGA
x-jsd-version-type: version
etag: W/"642-P6ImyZ2jwKPKhIF4TUkyt0Bz9zI"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ 483 B
1007 B 591ms
15ms Script
application/javascript 104.26.8.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.8.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 15:19:33 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Wed, 21 Feb 2024 16:07:43 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 256273
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d5j2lybqWkTZPU5A2%2FspwYUIsvdj1MGYccQvrm%2BswPBFSHkEJCVv%2Be%2FlRPC92gEQwYkvs0Bv7PbkIWtXnAWcLGsWtfBxTJnj0VBxriYsN0ZfiwB6Z1iRu%2F8wScTW9sff"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 85a8b000b95e0f5b-EWR

POST
H/1.1 200
OK auction Show response
rtb.adxpremium.services/openrtb2/ 2 KB
2 KB 829ms
82ms Fetch
application/json 185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: 4a8d5dbff8e0bb835cf6a195f77270570d01f0a7f38b8f227dfe03836b791885

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:33 GMT
Server: nginx
X-Prebid: pbs-go/unknown
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://sl.makeupexp.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1863
Expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 918 B
1 KB 50ms
10ms Fetch
application/json 147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: f0bf5c9f920693c7c5ee34b070fb4b9d5b7347d92cb26622358ceb947da5da60

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 24 Feb 2024 15:19:32 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sl.makeupexp.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 470

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
179 B 832ms
87ms Fetch 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://sl.makeupexp.com
date: Sat, 24 Feb 2024 15:19:33 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
533 B 887ms
142ms Fetch 37.157.6.232
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.232 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 368 B
876 B 567ms
16ms Fetch
application/json 8.43.72.32
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=25230&site_id=477094&zone_id=2872706&size_id=2&alt_size_ids=39%2C55&gdpr=0&rp_schain=1.0,1!optad360.com,1194790,1,,,&eid_pubcid.org=bdb8c13a-c109-42e3-a54c-18185e6218d0%5E1&rf=https%3A%2F%2Fsl.makeupexp.com%2F&kw=PasmeHrane%2CVseZaVa%C5%A1eNajljub%C5%A1eHi%C5%A1neLjubljen%C4%8Dke%2CFebruar2024&tg_i.domain=sl.makeupexp.com&tg_i.page=https%3A%2F%2Fsl.makeupexp.com%2F&tk_flint=pbjs_lite_v8.20.0&x_source.tid=d2637473-1533-4a4e-bd1b-3dc245aedd2e&l_pb_bid_id=10bc5c5a8813424&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=dc02cbc4-07f7-4b8a-a357-91170f32ebee&rp_maxbids=1&slots=1&rand=0.28629908293576856
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 8.43.72.32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 220dd761c9b82a6af28de6a29fd9394517d1cf526a2475dcfb4d86a0a94be7fd

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:33 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 368
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ 75 KB
24 KB 475ms
149ms Fetch
application/javascript 104.26.8.169
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.8.169 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf644a55f623100a0471c92c7cd9f7a6e2b95f4a45376208bd9587b0ca9987c4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 15:19:33 GMT
Content-Encoding: br
CF-Cache-Status: MISS
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 21 Feb 2024 16:07:42 GMT
Server: cloudflare
ETag: W/"0f70690380eccf8211b60d6a0ca3951f"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bf%2FgPZmfV55VLksabx%2FgAxCrlhXgHV4cG1zrYZUYwoecLhM8f1aGq1y6tovm9kqwr%2BH3r6aD%2FaanpnwAlzE2OKnWQO5qIVIoftR8tEXRZTV%2ByR8eZY6QbZ02HAtjs%2Fm6"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 85a8b002de662365-EWR

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/ 428 KB
135 KB 15ms
14ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ae3dcf8002e428f15567c5a304172fe086cf525cc41c02a83c091989152e4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 07:09:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29383
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137981
x-xss-protection: 0
server: cafe
etag: 12437356588311396475
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sun, 23 Feb 2025 07:09:50 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 30ms
8ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 14 Feb 2024 03:57:11 GMT
content-encoding: gzip
age: 904942
x-guploader-uploadid: ABPtcPpk6oDx036tAyFrM6ODF6Dc7iDzxD5hnGhczM6YT3qls-8dFKPmCVbIOdtNGD5WNWEF4bzJSgzKAWV_jGhyW52PFQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 13 Feb 2025 03:57:11 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 41 KB
13 KB 795ms
23ms Script
text/javascript 74.119.119.131
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.131 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

309c794d20c6824c9c401713bc7ba07938e85509e557ddbc944f6fa17e7b7469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 07 Feb 2024 07:37:39 GMT
server: nginx
etag: W/"65c33343-a585"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 25 Feb 2024 15:19:34 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 90 KB
26 KB 796ms
25ms Script
text/javascript 104.22.53.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.53.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bb890d213e25cf33417e37de79c453a3768665521b8cd07cf5c18c32c1e30f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 20 Feb 2024 11:08:29 GMT
server: cloudflare
x-amz-request-id: V21YDXDZVR677FWC
age: 1344
etag: W/"514331e770d38f45104f07677b44d965"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 85a8b0075efc424b-EWR
x-amz-id-2: Nq2qlq25dvT7ePz8Bbxm7QZr9RXbfe7DCHjncL+zieQM5De+KPuB93K2hMzLWWkt6oUTkdYBRyw=

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 779ms
8ms Script
text/javascript 18.164.110.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.110.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-110-14.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Sat, 24 Feb 2024 10:29:07 GMT
Via: 1.1 4229f114865802c4acd3e785fddcbf9c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P6
Age: 20245
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: LXGcUe8VaS5mV7x1EAmP5w8eajnXzRRG3H1BJOtSJGk4n8p0Fgqd4Q==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
897 B 708ms
8ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 24 Feb 2024 15:19:34 GMT
x-content-type-options: nosniff
content-encoding: br
age: 10838
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-lga21929-LGA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 65ms
17ms Script
text/javascript 3.162.3.84
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-84.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6cd320c5ba515fef3997afe473332231160a2cb715f1a99679a7cefa1cf0be0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 18:25:08 GMT
content-encoding: gzip
via: 1.1 fb7b65b8cad8124239a4b25728a84288.cloudfront.net (CloudFront)
last-modified: Wed, 14 Feb 2024 17:39:57 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
age: 75266
etag: W/"21f8671135afbd2e874c42d3dc478afa"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: PQSyvZA7kH3DUXY5tEI37x04JGWWN-ADaUKXP4C10QepYWTG4InkxQ==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 122ms
100ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e388e19ca38c825b329e762c79c66bbd41bd334f18312c5e97fde0a8f64bca36

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:33 GMT
via: 1.1 google, 1.1 google
last-modified: Mon, 05 Feb 2024 22:07:56 GMT
server: Google Frontend
etag: cd19e0900da0cdbc6697310fd9330fb6
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: ad2b4435915f4427b494b1cbc0ff5bfc
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1195

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 184 KB
51 KB 756ms
755ms Fetch
text/plain 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2368126171279500&correlator=2860497531765380&eid=31079956%2C31079527&output=ldjh&gdfp_req=1&vrg=202402200101&ptt=17&impl=fif&iu_parts=121764058%3A22528037647%2Ccelebs-networth.com%2Ccelebs-networth.com_Interstitial&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&fas=8&sc=1&cookie_enabled=1&abxe=1&dt=1708787973505&lmt=1708787973&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsl.makeupexp.com%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=637035289.1708787974&ga_sid=1708787974&ga_hid=786751292&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQY9vrM3d0xSABSAghkEhkKCnB1YmNpZC5vcmcY9frM3d0xSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGPX6zN3dMUgAUgIIZBIXCghydGJob3VzZRj2-szd3TFIAFICCGQSFAoFb3BlbngY9frM3d0xSABSAghkEhkKCnVpZGFwaS5jb20Y9frM3d0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRj1-szd3TFIAFICCGQ.&dlt=1708787971220&idt=2232&adks=3132106321&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

123e9a9708efe642cfe452c1596ecf543d393e3d128988530e493762e20d4f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51864
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 850ms
80ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202402200101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a15762d8aa6dfebba86fdd18f9d287a2756d36f1ffd31a578cac9791898b90c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12033
x-xss-protection: 0

GET
H2 200 container.html Show response
1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 60AE 6 KB
3 KB 783ms
17ms Document
text/html 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:34 GMT
expires: Sun, 23 Feb 2025 15:19:34 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/ 46 KB
15 KB 16ms
14ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51cedd78bb282a5680c39864d40c404bbb049b02d4fc854adfd4d4f97bb21607

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:50:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52160
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15022
x-xss-protection: 0
server: cafe
etag: 12039705104838093267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sun, 23 Feb 2025 00:50:13 GMT

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsl.makeupexp.com%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsl.makeupexp.com%2F&rid=esp&cc=1

85 B
194 B

42ms
41ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsl.makeupexp.com%2F&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 638bde8f375e68015621ffe20d703d58715a59298e7131b6ae8f39630ad2b395

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:33 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-xm3KXJUAldDlRZ9r6jqLBpjIgqc"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sl.makeupexp.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sat, 24 Feb 2024 15:19:33 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://sl.makeupexp.com
location: /esp?url=https%3A%2F%2Fsl.makeupexp.com%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 22 KB
10 KB 694ms
693ms Fetch
text/plain 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2368126171279500&correlator=2860497531765380&eid=31079956%2C31079527&output=ldjh&gdfp_req=1&vrg=202402200101&ptt=17&impl=fif&iu_parts=121764058%3A22528037647%2Ccelebs-networth.com%2Ccelebs-networth.com_SF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C750x100%7C970x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1708787973579&lmt=1708787973&adxs=436&adys=1200&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsl.makeupexp.com%2F&vis=1&psz=0x-1&msz=728x-1&fws=640&ohw=0&ga_vid=637035289.1708787974&ga_sid=1708787974&ga_hid=786751292&ga_fc=false&a3p=EhwKDWNyd2RjbnRybC5uZXQY9vrM3d0xSABSAghkEhkKCnB1YmNpZC5vcmcY9frM3d0xSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGPX6zN3dMUgAUgIIZBIXCghydGJob3VzZRj2-szd3TFIAFICCGQSFAoFb3BlbngY9frM3d0xSABSAghkEhkKCnVpZGFwaS5jb20Y9frM3d0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRj1-szd3TFIAFICCGQ.&dlt=1708787971220&idt=2232&adks=583149734&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-34-234-1-132.compute-1.amazonaws.com

Software

cafe /

Resource Hash

306219d39fdb820b8bc08872648cb97d69e661de40fff306073985f676532d3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9958
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
613 B 711ms
27ms XHR
application/json 3.222.224.11
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.224.11 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-224-11.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 5cd6df2344afc788b6a86ae298d15775f4cfb736ab9837c16dd0ce099dae50b9

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache
x-server: 10.40.60.0
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame A26B 725 B
869 B 54ms
32ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: ab1d6437cc92816ebca3c1b7d1a47cbe5b973381bd4bc467280b3c6318816d0c

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 451
content-type: text/html
date: Sat, 24 Feb 2024 15:19:34 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 container.html Show response
1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7BA4 6 KB
3 KB 17ms
16ms Document
text/html 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:34 GMT
expires: Sun, 23 Feb 2025 15:19:34 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E8C1 6 KB
3 KB 17ms
15ms Document
text/html 142.251.167.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:34 GMT
expires: Sun, 23 Feb 2025 15:19:34 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 930d867f-16d2-eca1-c7cf-35ad2e9e4482
pr-bh.ybp.yahoo.com/sync/openx/ Frame A26B 43 B
602 B 352ms
19ms Image
image/gif 34.234.1.132
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/930d867f-16d2-eca1-c7cf-35ad2e9e4482?gdpr=0

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.234.1.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame A26B
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=5f1c9c46-9ad4-c512-3616-a1cfb9fa422b
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=5f1c9c46-9ad4-c512-3616-a1cfb9fa422b&dcc=t

43 B
855 B

36ms
36ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=5f1c9c46-9ad4-c512-3616-a1cfb9fa422b&dcc=t

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 8GCZ8SZQ18EVVR9VEQAH
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:34 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HEGAJKX8BHA00QQM3BV4
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=5f1c9c46-9ad4-c512-3616-a1cfb9fa422b&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A26B
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=07cae03b-867e-7ee8-f618-2358d1c989cb&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=07cae03b-867e-7ee8-f618-2358d1c989cb&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=bb42b77f-9076-4f7d-a15e-f9e0219b3a41&ttd_puid=07cae03b-867e-7ee8-f618-2358d1c989cb&gdpr=0&gdpr_consent=

43 B
240 B

44ms
44ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=bb42b77f-9076-4f7d-a15e-f9e0219b3a41&ttd_puid=07cae03b-867e-7ee8-f618-2358d1c989cb&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=bb42b77f-9076-4f7d-a15e-f9e0219b3a41&ttd_puid=07cae03b-867e-7ee8-f618-2358d1c989cb&gdpr=0&gdpr_consent=
date: Sat, 24 Feb 2024 15:19:34 GMT
server: Kestrel
content-length: 335

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame A26B 170 B
243 B 274ms
29ms Image
image/png 142.251.167.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MmJhNTMzZjEtNGYwOS0yMDRjLWUzZjgtNzllMTFiMmI0N2Fi

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A26B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBhsFt3yUlxmfmkfOZWsNYM&google_cver=1

43 B
171 B

31ms
29ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBhsFt3yUlxmfmkfOZWsNYM&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEBhsFt3yUlxmfmkfOZWsNYM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5B7D 624 B
538 B 79ms
78ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIuw7wEQ3bWDAhj9g4KIAjAB&v=APEucNU2Z7I6APBlHp3cGKbGB5DJR2DlFeQihtqp3jMNjGLfmGt8OHr97aU9yEkDntokcBzkXKTdh8PoQ7rk8c36USymSVfjQA

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:34 GMT
expires: Sat, 24 Feb 2024 15:19:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7BA4 93 KB
33 KB 919ms
82ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 15:19:35 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7BA4 42 B
173 B 908ms
72ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AABgPU_1N9sTVU5V8G5Ke9xQq8czYm81iZXPWpNvAeSrNFPlQ7xLFC63C4IRWm-yhKdeKovn1QBdTV2_63NAFLcF3ElBO62xsBcaNSm34bsbXbfLg

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/ Frame 7BA4 3 KB
1 KB 367ms
27ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/window_focus_fy2021.js

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 03:52:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41239
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 03:52:15 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/ Frame 7BA4 20 KB
8 KB 353ms
13ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7afde571c53d192943a40b3b7f109e698bb47e6d6424bc7d1f53a7cb9466360

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:42:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52644
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8211
x-xss-protection: 0
server: cafe
etag: 3968847549730513390
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 00:42:10 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7BA4 204 KB
62 KB 853ms
18ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be58ac66106f8f26b344b506dbca6968b96606a5bb9f89dac5678dfaf9522ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:03:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 992
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62895
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:03:03 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 370ms
31ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 24 Feb 2024 15:19:34 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame E8C1 5 KB
790 B 26ms
25ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 13:31:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 24 Feb 2024 15:19:34 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame FFD2 14 KB
1 KB 49ms
48ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 24 Feb 2024 15:19:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 14:14:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 24 Feb 2024 15:19:34 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/ Frame FFD2 2 KB
903 B 336ms
27ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:59:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 51606
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 00:59:28 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/ Frame FFD2 23 KB
9 KB 336ms
29ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/abg_lite_fy2021.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec1d799ea15ca9389d9dcd1f5d5c9698d612204464a24020099137878484a168

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 04:21:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39488
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8988
x-xss-protection: 0
server: cafe
etag: 12564770436581814922
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 04:21:26 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4824 143 B
247 B 16ms
15ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1124
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:00:50 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/ Frame FFD2 3 KB
1 KB 335ms
30ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/window_focus_fy2021.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 03:52:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41239
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 03:52:15 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/ Frame FFD2 20 KB
8 KB 321ms
17ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7afde571c53d192943a40b3b7f109e698bb47e6d6424bc7d1f53a7cb9466360

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:42:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52644
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8211
x-xss-protection: 0
server: cafe
etag: 3968847549730513390
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 00:42:10 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame FFD2 204 KB
62 KB 842ms
43ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1be58ac66106f8f26b344b506dbca6968b96606a5bb9f89dac5678dfaf9522ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:03:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 992
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62895
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 24 Feb 2024 16:03:03 GMT

GET
H2 200 c0f9635aabdd33ab086e3930fa461563.js Show response
www.gstatic.com/mysidia/ Frame FFD2 36 KB
15 KB 372ms
16ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c0f9635aabdd33ab086e3930fa461563.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

0bd3e64a75f43409aa3141f35c5d1bd599773aec49d61aaa02522dbe6101c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 00:59:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 138008
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15250
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 00:22:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 23 May 2024 00:59:26 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240221/r20110914/elements/html/ Frame E8C1 22 KB
9 KB 314ms
16ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240221/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

cafe /

Resource Hash

ce8c05a7248a3803ffc6d3a871f42b125e2358c700a59e082501d81d5c94400b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:47:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52334
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9139
x-xss-protection: 0
server: cafe
etag: 14231659491099539135
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 00:47:20 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E8C1 205 B
294 B 364ms
16ms Image
image/png 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:13:34 GMT
x-content-type-options: nosniff
age: 360
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 23 Feb 2025 15:13:34 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E8C1 604 B
1 KB 362ms
14ms Image
image/png 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 14:58:25 GMT
x-content-type-options: nosniff
age: 1269
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 23 Feb 2025 14:58:25 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 69DA 14 KB
6 KB 1616ms
17ms Document
text/html 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=sl.makeupexp.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8deb4dcd9ce02afc82cd8ee1938a02d0c40bd438fa8da4f22a255676fbe543e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:35 GMT
server: Kestrel
server-processing-duration-in-ticks: 475482
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
232 B 278ms
88ms XHR
text/plain 162.19.138.83
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://sl.makeupexp.com
date: Sat, 24 Feb 2024 15:19:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4824
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
170 B

33ms
33ms

Document
text/html

172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:36 GMT
expires: Sat, 24 Feb 2024 15:19:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:36 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 5B7D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1&C=1

43 B
341 B

33ms
29ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIuw7wEQ3bWDAhj9g4KIAjAB&v=APEucNU2Z7I6APBlHp3cGKbGB5DJR2DlFeQihtqp3jMNjGLfmGt8OHr97aU9yEkDntokcBzkXKTdh8PoQ7rk8c36USymSVfjQA
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JJ3iYNywvvSYrAq8J0kiBVoPnxyH0RRY5QXDXZgjmpIjLa37NIYJlGZO%2BVM1GBgAoJEkLGP%2Fh%2BAGRID86eBvsox0dpyhoQav0EZDnlPvIBbQFfwDJ4R2sCdI%2BZQw7t5dACOY6QJFSOMG7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85a8b00a9cc14385-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0lIGKG%2F9v1hhZ3ECn8360QtFtL09KN7TlFh7VFlgQv%2Fdj6ffYcAOotWakPAtExkdrdFekbkYPP8YuSmn7ytvvxvV%2FnuLUM3NS9Q7y3XSxIjP1%2FRLB4s2NsssNUDbc94j%2BVHyGGlOjJmvxA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1&C=1
cache-control: no-cache
cf-ray: 85a8b00a4c6f4385-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5B7D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZdoJBkt3uSsAADebAGBZzAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1

43 B
766 B

27ms
27ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIuw7wEQ3bWDAhj9g4KIAjAB&v=APEucNU2Z7I6APBlHp3cGKbGB5DJR2DlFeQihtqp3jMNjGLfmGt8OHr97aU9yEkDntokcBzkXKTdh8PoQ7rk8c36USymSVfjQA
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SvH6jI0Ha8ByJ%2BjIxJAaEngfUtabWjrf5i10H41hSvPxQZ8ddTgWbGpedRSDIaV3J1waW8Dl2LDZ3OXe8EFjjU4s9eFllxajpc0razQVJhxH4HfR%2BfJCxdmyr7UYPIDkfw4lBX2Wg98Qnw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85a8b00d595d0f68-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6vjKE-EyHc1GvkrlO_hMw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 5B7D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHbUo9UHdTdlBWvjwvQc9Fo&google_cver=1

43 B
1 KB

8ms
8ms

Image
image/gif

68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHbUo9UHdTdlBWvjwvQc9Fo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIuw7wEQ3bWDAhj9g4KIAjAB&v=APEucNU2Z7I6APBlHp3cGKbGB5DJR2DlFeQihtqp3jMNjGLfmGt8OHr97aU9yEkDntokcBzkXKTdh8PoQ7rk8c36USymSVfjQA

Protocol

Server

68.67.161.208 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
an-x-request-uuid: 57c54255-aa6d-4957-9a16-95a4e0231dd3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHbUo9UHdTdlBWvjwvQc9Fo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5B7D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3MTQ5NjcxNTE0ODUwMDUyMw%3D%3D

170 B
188 B

27ms
26ms

Image
image/png

142.251.167.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3MTQ5NjcxNTE0ODUwMDUyMw%3D%3D

Requested by

Protocol

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:34 GMT
an-x-request-uuid: 501e96a2-15a6-449b-92a5-104fa8bb27db
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU3MTQ5NjcxNTE0ODUwMDUyMw%3D%3D
x-proxy-origin: 5.181.234.134; 5.181.234.134; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9AB3 13 KB
5 KB 396ms
15ms Document
text/html 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 66524
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Feb 2024 20:50:51 GMT
expires: Sat, 22 Feb 2025 20:50:51 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 823C 829 B
998 B 1065ms
34ms Document
text/html 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f99.1e100.net

Software

GSE /

Resource Hash

0cd69b4557905c87ef94b831872532c53cb1b4d412c9bc970f7fa28d3cabb3a7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-xZqIitRKBKQ1mwFIO_cnAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-xZqIitRKBKQ1mwFIO_cnAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:36 GMT
expires: Sat, 24 Feb 2024 15:19:36 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7BA4 0
58 B 70ms
70ms Ping
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9082087302766&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7BA4 0
56 B 70ms
70ms Ping
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9082087302766&version=m202401290101&ct=119&x=1&cor=7649592576889330000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7BA4 93 KB
39 KB 66ms
65ms Script
text/javascript 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BuIMggCWttVIghkkmlMdFzcFAaETky0r3gyNUjTuTsiZkkAl8bYVF9dWtvD9ygCd1qY3h1Mfg2X4ll7bP8iPIH0GUkQMMiFCLkWa2mi3M67ikm14-OGZr_7ba0xD4H8CxPbGnVG2TvfdQqc2jAEuo9eYuQR28UYHqVWPMi0vHGxaQwbTol7xLyK3eb-rXq1Xq6__xQSPQRIsWuIRHaa11kpkDA3VLagG8C0pQp_I1wWuNX5ts&cry=1&dbm_d=AKAmf-Bnwv8Pykd7hMiZ3wxe_55yQBFOYhXDJM4WjJ4xm1magx9i3vsTE_pqWMLnJNC7YJHZliaAPheLcwWlTy-7PecZ8OWLGOlV2PeBRIWPeBKvpidb-azsdJRqeCzEOhhR5H11TuDKlHXnSCc02RDn2D1VgHK9U-QAmKJU8i_74T_yFlUpZzWbjY735Atzm6-krddT48Gb02i5vUsd6TOx5YFlxWIDl1sRCZ_PEIocLQj7lKCtX2XTMlSRAacBxjRD9MnzQuLp408hapbmNzf1KrGn-89y7q7IWi4gS5TR4ERp98SIX9_U_-8_dyfLFst6WK7uVNJMyA4GjOP2gvk7BZrfQe00a6-gg11y4gPabzrBnKy1NVGBZpn9Oz2R70sOW0_xm3hEyDdFhRibS9J-L9YH0B_PAws6qi7sylBf0FV1puKHc_tKgeblizVQbOaj695mzVoS45wdsr0to7SKwM-tHseEIde4n20lPrQbUjJPvDJ-CsYS64Q6EtdDzqskMbl4eCWYwmBqsMdzJZTLkVSUFzYG8cF6CWe0iYXF4lqmHDakMNF_e0HHjIFYxQIRk6Vcfmkwpe1mwMuzhEsWt2s0k1OgkNQ9nH-oLeWNVSBmNj5QdrAe427aYrd7TPmEdhtPX_djMHkeaXVNXbOO1L4v_7FBuJDJyqc3ZwRhcdtDlOBeWX-3JvaIApZdrDkh88yqpSdTuLbJuiuLiUUAxI5XWcHMVwT1WchE1HkpMuhAe8NhtTK9V-VeIphrOsoKyfNECAZCsVWk77FiZC29Kj6sZ130ZpthPbw0eEl_gg8kfLaeuW1cxM4qXPrtVLAlGyzUdmzc6tviSdgErp-tyGivJ6zWGfrhNDRFiqpO1di-DTfVJ-0_A5iJn2TlhGuRVPt3ZYJ9eSFswim7kRhAWNFWJsE5T3mF1pwVoqb_MbxRn_NJ5QBqR7XS_WR4IH1t0-5vxMzfx5qaeZjYegJv_MYoIesFLHSc5gU-ms84GkfNzOzn4w-vdUh2Ye72LbNqL-lMMcpLDnoMR1HAxw-qM-vYNnvTQ4tWKOLY-OVGvISvEFqCONuUpxGC8ji05aYMOlkj7UC9wis2wfffidE14fQF2JftzI8Js7jJxSmVDsB_ifo-gFR6Pl9zpTCtJIS7cMFdg3fZCfY8naQAyPGi0pVN3c681_dO9QZw9rgX61F1ehHgdGKslPE35HFfoDOTGc65qjmIFt-01FLaunSiNyUWS472x8KNmebvWOS-eDnfFt1AbpfjULZG4YRywwS7YvUyF3v6cHmLMx52rhwdyvVajyc3i3-PCj2Tsb6-iQj4ulteu0uUgso2TseYHIJjB8PJCfp6V6FZa9GplPUPojvou_vwcuMkfjHLoDMsM08e2Q_WCgjTFaRzglUJ_iketIv0llnGqvmflySs1_j4adN-TqX5m8_VnByCfrelJ6KXXT8nRpmVdwIUpk4N0LMrNJq3wECkswVJfzcUPbbEvSEcsyVmgp8vL8Br_2YzYvuLjMkP_Rh6B2lRVwQIoxU1ArC6XaNw7uYtUm3WKSiAtiRexyzEcIcXp_OGmg8Z8-QpKJle_jDCEBZ20bmeVRp9-Aa57zaf2lOLRVWWCYaG5e4MB0eiqENaE0xzHd9MS1B_wLZnLSGrqwK7LupZTz6NweFle3iDkvHjWZ7b2XTg3ckvqJbRaDVPKpwbR8iSamDqRf_APoWQJpbNfaGOkfvBXumq6_Qho9ps4n2joSK2gPceVf-Sy1Guo_QPqEU2B-CR0ktCQ8FHmR-S-JChKzuwV8XPXcPNZjk1IMJg_mLs9jw9AwowkKkJf0i0C2d73-Jb2lMdR2r24dtF_NlWlJFyL-jbvZy61LBfUMyRGdGiSeyWOaovy2-Eqq2w9A8sKTkA1N32t9z50tnhrvZStxQD_wG_RdrOtlGYr2bUtbFlZDo9WcB7pAvFF4r_PjqyGC3rrIQCH0Fuxy0_PWbhonYLWytij-4LUqqkkmd_uRmwQwwgMyBjcOElbcyTTZZP85ZQZLTOUx3_c6NPD3NWBRx4vnfy62lFZs0ohuHZ1zIIRami4g1QlQdCcVdUi-FCgu1p1wlpDcpF82wSJVc6lS6UEx6fLJn1gydQp5vGbFNWbySYBdhgxUazTLjiKbuzeRrDhM5-x1bmtNlHdyHu6ra3wLQLL9ZwXkqoyNBC2qp0HQ1rklECuQTmrBrLxNoQS--MuNpGcYb6vV92Pfe0KhnVgZxh6akM-ON2Er_3kChTKSRN3wmJklnqOB1Plr6_FYNCE7vYZGxU3qogkHV11z3uCIDoSqCWzy5wsz1I2euD0Urp_aM9j9DaJcRz3bBBz_dW8IZ8MyGpAwfugxZ0nQs1arD67XTux0YjXxPC6dIowdg1Plzuw6ZWPD932Hfh14jPZLaW1XrcA3XsTDGQAvByfwXzguZcUo42dOR4j575I5WPkP1lAQCt_HQBL_DP9jlnriGgaGdlu8f_iVvq5WF365DJqBbUygzeCpiW4upcC0sh987eKBOVRLxuclaDEHv7rVqDHIEfk4BCi5hkTgd7cTON-2WfA_51qPAfeeEN6mMvoGclnhJ_qdeZMFidNegnsOglNsqs9-ye-IPKbIEsLhC2U4FvFWknUvLiqXatwer2Ky7ZlhJnJjUGkXO6qu5QBCl7Vwb3dw5VeclD7gbxfPoiLnCiHgzmGo8aQUO3UrxAc20v5dmOTut01lY8zzoUglenJ2giaWsvv9cWHZOYlhJ_3SdAL82VKHwV2X330xi4ylJJCk6x78q6_nZ2LTHRWHWYCoKJA_XI1yEc4MjyYBBjricqB9gnde4GWopDO_0d05P7aV2GAVtS1Drz7mafizwDpV5zUp6_qR8OwnZgXQ7SEmDAaFrooQy1vJHBZFVBbjiByMVPLUavylJsa8nbAg2PLrAZ0Ck5WrKGzM8RyvQOf0Yh2JJNEIVBvn4JT9oAMecDoIlFS3XxdRRKazXvHJn_SjWvmbs7s2DEYcJc9DWd8Rzv7fgk4D-INE2_i9azKpQUoIAR-QiyGt4V-sy-94wB8C3Q7RrHgE0vbgHurwQhyhr978Pse6Qt8-_VP7Kz1-I6ChgW5_bkM1E85I-DBpNlYnSfkmFo9Q_B7PQLqrSM7qPaKqcU2AyhSOUrF4qVKwDpkQ3zCRyA5PQyZVMi1FI5XE3UEgkpBPRVY7UKqUx6Jqm8kZrz1hXCikGvucIo_XFyOWndmv4bpIrhwZPZvELh8x6HZUQXTGqWJ75EhYrmQKc1gkzQGb30VhKTnjaKXkfHY-QPJVak6Kz-xEr2N-lB7hCUyBtgZVFYCvRrNC-I2wavvpvHmV7yUha5skG92XVpFbj1MwoVLNcqp7HvaoN5APu9aikfPA3CMZXnyccKKYj_01XOZsjsrMaZkSnMbiYQXZYD9ebAznXID3nW_H4OnoR15_z2-MHMJkTUn_9JPHNeq3RToVcdwBYT5theRrRglOi3Aznc-S9CaDnVxozA2tUBvVW8SnfmwJ-r-V1xiqu-1XBKXGdlsdjwHephjYhFuvV9ZcJDVdbWWxTwS_9B9hjhF9B5whsGvmO-XRiSaSqFBDpp5Mcu4gHTALLpUrj4fSqPTQ4GcBcRZJTA0gYdOyGgDNW6onM4xGQKSEpCNdYTmk7yve-2YIqApxbE8zuutMJjL24lZIgpYL8-N8EQuMZuN4UFzffTSJutVZNlUfjHOXDYQ7jPAe7Pv8t9m6YA4YvpieW9Ibuq5UkN942TfNs-E-CRW-6e3gpJBFG7gosg0jaupDtn8_vmwvZXkUByMQsKoleC53ONCNJNbYRxNTIcghrfFK_t49QHsuokHMeIoW_aPJ0CXfhYTuiPdUh_UPcAxFeXZT5ycadsp-eY3uqxco-4Niuo_D77Z7yLU_iI2hNLgh8CecQ3aIEM1Hhg1q9MMyklnNqMs_WICR7D4mdAcZdPLZiv8aRFzsyaz3W3&cid=CAQSTgAvHhf_xL9KQX6dgNi9JmLheM5yqCf4IGXYTGDHHNx7yle7w5zCBFv9T0U4vbqziYFzoh3MhvGqa2cKqw-ySALmdpuiG1KxFlyVG8_uCRgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fsl.makeupexp.com%2F&ds=l&xdt=1&iif=1&cor=7649592576889330000&adk=2923430906&idt=928&cac=0&dtd=26

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8e2b9c6e4a2bac1fa356babbe4f849d1338a65b3665a1e8e9056aba58201f6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39627
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7BA4 172 KB
61 KB 431ms
15ms Script
text/javascript 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
Origin: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:52:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52046
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Feb 2024 00:52:10 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240221/r20110914/elements/html/ Frame 7BA4 12 KB
4 KB 15ms
14ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240221/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BuIMggCWttVIghkkmlMdFzcFAaETky0r3gyNUjTuTsiZkkAl8bYVF9dWtvD9ygCd1qY3h1Mfg2X4ll7bP8iPIH0GUkQMMiFCLkWa2mi3M67ikm14-OGZr_7ba0xD4H8CxPbGnVG2TvfdQqc2jAEuo9eYuQR28UYHqVWPMi0vHGxaQwbTol7xLyK3eb-rXq1Xq6__xQSPQRIsWuIRHaa11kpkDA3VLagG8C0pQp_I1wWuNX5ts&cry=1&dbm_d=AKAmf-Bnwv8Pykd7hMiZ3wxe_55yQBFOYhXDJM4WjJ4xm1magx9i3vsTE_pqWMLnJNC7YJHZliaAPheLcwWlTy-7PecZ8OWLGOlV2PeBRIWPeBKvpidb-azsdJRqeCzEOhhR5H11TuDKlHXnSCc02RDn2D1VgHK9U-QAmKJU8i_74T_yFlUpZzWbjY735Atzm6-krddT48Gb02i5vUsd6TOx5YFlxWIDl1sRCZ_PEIocLQj7lKCtX2XTMlSRAacBxjRD9MnzQuLp408hapbmNzf1KrGn-89y7q7IWi4gS5TR4ERp98SIX9_U_-8_dyfLFst6WK7uVNJMyA4GjOP2gvk7BZrfQe00a6-gg11y4gPabzrBnKy1NVGBZpn9Oz2R70sOW0_xm3hEyDdFhRibS9J-L9YH0B_PAws6qi7sylBf0FV1puKHc_tKgeblizVQbOaj695mzVoS45wdsr0to7SKwM-tHseEIde4n20lPrQbUjJPvDJ-CsYS64Q6EtdDzqskMbl4eCWYwmBqsMdzJZTLkVSUFzYG8cF6CWe0iYXF4lqmHDakMNF_e0HHjIFYxQIRk6Vcfmkwpe1mwMuzhEsWt2s0k1OgkNQ9nH-oLeWNVSBmNj5QdrAe427aYrd7TPmEdhtPX_djMHkeaXVNXbOO1L4v_7FBuJDJyqc3ZwRhcdtDlOBeWX-3JvaIApZdrDkh88yqpSdTuLbJuiuLiUUAxI5XWcHMVwT1WchE1HkpMuhAe8NhtTK9V-VeIphrOsoKyfNECAZCsVWk77FiZC29Kj6sZ130ZpthPbw0eEl_gg8kfLaeuW1cxM4qXPrtVLAlGyzUdmzc6tviSdgErp-tyGivJ6zWGfrhNDRFiqpO1di-DTfVJ-0_A5iJn2TlhGuRVPt3ZYJ9eSFswim7kRhAWNFWJsE5T3mF1pwVoqb_MbxRn_NJ5QBqR7XS_WR4IH1t0-5vxMzfx5qaeZjYegJv_MYoIesFLHSc5gU-ms84GkfNzOzn4w-vdUh2Ye72LbNqL-lMMcpLDnoMR1HAxw-qM-vYNnvTQ4tWKOLY-OVGvISvEFqCONuUpxGC8ji05aYMOlkj7UC9wis2wfffidE14fQF2JftzI8Js7jJxSmVDsB_ifo-gFR6Pl9zpTCtJIS7cMFdg3fZCfY8naQAyPGi0pVN3c681_dO9QZw9rgX61F1ehHgdGKslPE35HFfoDOTGc65qjmIFt-01FLaunSiNyUWS472x8KNmebvWOS-eDnfFt1AbpfjULZG4YRywwS7YvUyF3v6cHmLMx52rhwdyvVajyc3i3-PCj2Tsb6-iQj4ulteu0uUgso2TseYHIJjB8PJCfp6V6FZa9GplPUPojvou_vwcuMkfjHLoDMsM08e2Q_WCgjTFaRzglUJ_iketIv0llnGqvmflySs1_j4adN-TqX5m8_VnByCfrelJ6KXXT8nRpmVdwIUpk4N0LMrNJq3wECkswVJfzcUPbbEvSEcsyVmgp8vL8Br_2YzYvuLjMkP_Rh6B2lRVwQIoxU1ArC6XaNw7uYtUm3WKSiAtiRexyzEcIcXp_OGmg8Z8-QpKJle_jDCEBZ20bmeVRp9-Aa57zaf2lOLRVWWCYaG5e4MB0eiqENaE0xzHd9MS1B_wLZnLSGrqwK7LupZTz6NweFle3iDkvHjWZ7b2XTg3ckvqJbRaDVPKpwbR8iSamDqRf_APoWQJpbNfaGOkfvBXumq6_Qho9ps4n2joSK2gPceVf-Sy1Guo_QPqEU2B-CR0ktCQ8FHmR-S-JChKzuwV8XPXcPNZjk1IMJg_mLs9jw9AwowkKkJf0i0C2d73-Jb2lMdR2r24dtF_NlWlJFyL-jbvZy61LBfUMyRGdGiSeyWOaovy2-Eqq2w9A8sKTkA1N32t9z50tnhrvZStxQD_wG_RdrOtlGYr2bUtbFlZDo9WcB7pAvFF4r_PjqyGC3rrIQCH0Fuxy0_PWbhonYLWytij-4LUqqkkmd_uRmwQwwgMyBjcOElbcyTTZZP85ZQZLTOUx3_c6NPD3NWBRx4vnfy62lFZs0ohuHZ1zIIRami4g1QlQdCcVdUi-FCgu1p1wlpDcpF82wSJVc6lS6UEx6fLJn1gydQp5vGbFNWbySYBdhgxUazTLjiKbuzeRrDhM5-x1bmtNlHdyHu6ra3wLQLL9ZwXkqoyNBC2qp0HQ1rklECuQTmrBrLxNoQS--MuNpGcYb6vV92Pfe0KhnVgZxh6akM-ON2Er_3kChTKSRN3wmJklnqOB1Plr6_FYNCE7vYZGxU3qogkHV11z3uCIDoSqCWzy5wsz1I2euD0Urp_aM9j9DaJcRz3bBBz_dW8IZ8MyGpAwfugxZ0nQs1arD67XTux0YjXxPC6dIowdg1Plzuw6ZWPD932Hfh14jPZLaW1XrcA3XsTDGQAvByfwXzguZcUo42dOR4j575I5WPkP1lAQCt_HQBL_DP9jlnriGgaGdlu8f_iVvq5WF365DJqBbUygzeCpiW4upcC0sh987eKBOVRLxuclaDEHv7rVqDHIEfk4BCi5hkTgd7cTON-2WfA_51qPAfeeEN6mMvoGclnhJ_qdeZMFidNegnsOglNsqs9-ye-IPKbIEsLhC2U4FvFWknUvLiqXatwer2Ky7ZlhJnJjUGkXO6qu5QBCl7Vwb3dw5VeclD7gbxfPoiLnCiHgzmGo8aQUO3UrxAc20v5dmOTut01lY8zzoUglenJ2giaWsvv9cWHZOYlhJ_3SdAL82VKHwV2X330xi4ylJJCk6x78q6_nZ2LTHRWHWYCoKJA_XI1yEc4MjyYBBjricqB9gnde4GWopDO_0d05P7aV2GAVtS1Drz7mafizwDpV5zUp6_qR8OwnZgXQ7SEmDAaFrooQy1vJHBZFVBbjiByMVPLUavylJsa8nbAg2PLrAZ0Ck5WrKGzM8RyvQOf0Yh2JJNEIVBvn4JT9oAMecDoIlFS3XxdRRKazXvHJn_SjWvmbs7s2DEYcJc9DWd8Rzv7fgk4D-INE2_i9azKpQUoIAR-QiyGt4V-sy-94wB8C3Q7RrHgE0vbgHurwQhyhr978Pse6Qt8-_VP7Kz1-I6ChgW5_bkM1E85I-DBpNlYnSfkmFo9Q_B7PQLqrSM7qPaKqcU2AyhSOUrF4qVKwDpkQ3zCRyA5PQyZVMi1FI5XE3UEgkpBPRVY7UKqUx6Jqm8kZrz1hXCikGvucIo_XFyOWndmv4bpIrhwZPZvELh8x6HZUQXTGqWJ75EhYrmQKc1gkzQGb30VhKTnjaKXkfHY-QPJVak6Kz-xEr2N-lB7hCUyBtgZVFYCvRrNC-I2wavvpvHmV7yUha5skG92XVpFbj1MwoVLNcqp7HvaoN5APu9aikfPA3CMZXnyccKKYj_01XOZsjsrMaZkSnMbiYQXZYD9ebAznXID3nW_H4OnoR15_z2-MHMJkTUn_9JPHNeq3RToVcdwBYT5theRrRglOi3Aznc-S9CaDnVxozA2tUBvVW8SnfmwJ-r-V1xiqu-1XBKXGdlsdjwHephjYhFuvV9ZcJDVdbWWxTwS_9B9hjhF9B5whsGvmO-XRiSaSqFBDpp5Mcu4gHTALLpUrj4fSqPTQ4GcBcRZJTA0gYdOyGgDNW6onM4xGQKSEpCNdYTmk7yve-2YIqApxbE8zuutMJjL24lZIgpYL8-N8EQuMZuN4UFzffTSJutVZNlUfjHOXDYQ7jPAe7Pv8t9m6YA4YvpieW9Ibuq5UkN942TfNs-E-CRW-6e3gpJBFG7gosg0jaupDtn8_vmwvZXkUByMQsKoleC53ONCNJNbYRxNTIcghrfFK_t49QHsuokHMeIoW_aPJ0CXfhYTuiPdUh_UPcAxFeXZT5ycadsp-eY3uqxco-4Niuo_D77Z7yLU_iI2hNLgh8CecQ3aIEM1Hhg1q9MMyklnNqMs_WICR7D4mdAcZdPLZiv8aRFzsyaz3W3&cid=CAQSTgAvHhf_xL9KQX6dgNi9JmLheM5yqCf4IGXYTGDHHNx7yle7w5zCBFv9T0U4vbqziYFzoh3MhvGqa2cKqw-ySALmdpuiG1KxFlyVG8_uCRgB&dv3_ver=m202401290101&rfl=https%3A%2F%2Fsl.makeupexp.com%2F&ds=l&xdt=1&iif=1&cor=7649592576889330000&adk=2923430906&idt=928&cac=0&dtd=26

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 19:59:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69607
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 08 Mar 2024 19:59:29 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240221/r20110914/ Frame 7BA4 30 KB
11 KB 15ms
14ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240221/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f43ea6cbbf261394f83dc2f3425942bf6ddf498490f6cecfbf38739c1ff8b71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 09:42:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 20234
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11549
x-xss-protection: 0
server: cafe
etag: 13750958460409166979
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 09 Mar 2024 09:42:22 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 7BA4 41 KB
14 KB 14ms
13ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 01:02:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 137851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Feb 2025 01:02:05 GMT

GET
H2 200 BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js Show response
pagead2.googlesyndication.com/bg/ Frame 9AB3 39 KB
15 KB 15ms
14ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068123d4c4589cecb90523791256c9c9277a306172601593fd9b6414420056f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 06:37:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31349
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15302
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 23 Feb 2025 06:37:07 GMT

GET
DATA 200
OK truncated
/ Frame 7BA4 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e5a736f05568b5cbb02a52914d31ee4049f6c803052423b4e11683ca915993c

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 69DA 438 B
959 B 22ms
21ms Fetch
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=makeupexp.com&sn=ChromeSyncframe&so=0&topUrl=sl.makeupexp.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=sl.makeupexp.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5a4f4989e54e11a4f6b640acc0acb07cc8fa7938f1fd0a42968a7d0e47782891

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=sl.makeupexp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:35 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 4992314
expires: 0

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame EEBE 38 KB
13 KB 21ms
14ms Document
text/html 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 139298
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 23 Feb 2024 00:37:58 GMT
expires: Sat, 22 Feb 2025 00:37:58 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 823C 0
0 71ms
70ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202402200101&jk=2368126171279500&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

GET
H2 200 p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 5343 51 KB
19 KB 14ms
14ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a797e70bc52226063fae939bcd9f69b525838d0d9a466c30ed6a9defe8bf8244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 20:17:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19860
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 20:17:36 GMT

GET
H2 200 p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js Show response
pagead2.googlesyndication.com/bg/ Frame EEBE 51 KB
19 KB 17ms
16ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/p5fnC8UiJgY_rpObzZ9ptSWDjQ2aRmww7Wqd7-i_gkQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a797e70bc52226063fae939bcd9f69b525838d0d9a466c30ed6a9defe8bf8244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 20:17:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68520
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19860
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 20:17:36 GMT

GET
H2 200 json Show response
gum.criteo.com/sid/ 423 B
712 B 20ms
18ms Fetch
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsl.makeupexp.com%2F&domain=sl.makeupexp.com&cw=1&pbt=1&lsw=1&gdpr=0

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8c7278d9af28d3b017a9a885cf42bd89a1c4d4aed89a9b9443343aca7d9d6090

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: application/json

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1672128
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
671 B 15ms
14ms Fetch
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=prebid&fmt=json
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8cd47246ee6d59aa07c825ab95041c46ede7cdd080431234848aa98d6694ff9e

Request headers

Referer: https://sl.makeupexp.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: text/plain

Response headers

date: Sat, 24 Feb 2024 15:19:36 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://sl.makeupexp.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Mon, 25 Mar 2024 15:19:36 GMT

GET
H2 200 sync-all.html Show response
adxbid.info/ Frame 0221 7 KB
3 KB 693ms
89ms Document
text/html 172.67.138.13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.138.13 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1787a5dfdba5a51fbef09d57aaadebb83af016d1b4f087236fa1ce27c06a99c5

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 85a8b019dad87c8d-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 24 Feb 2024 15:19:37 GMT
last-modified: Thu, 26 Jan 2023 09:50:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UzSsUdquZBml%2BGdAHX%2BRZL2PxzS47VGTKP%2BDfqiw5%2BcZ21RDz7RnUBjhQ%2F57hLsSoq%2FoG%2BdrDW687Cupj959nHj5X1l%2BlMod33DSGxpyOm06Z7rKWgq9thjrARXyjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 isyn Show response
sync.a-mo.net/ Frame 8C90 2 KB
833 B 52ms
8ms Document
text/html 147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=Cq0BShBzbC5tYWtldXBleHAuY29tUgthYXMtMWQ1MjgxZFoIcGJhMS4zLjNqEHNsLm1ha2V1cGV4cC5jb236AQY4LjIwLjDoAgGIA4SS6K4GqAM26gMkOTMyYzM1NjEtMmQ3MC00NTBkLThiNmEtNTY0ZThkMzMxNTI2qgQDRENIsgUDVVNE6gUHZGVza3RvcPoFA255NaoHA3dlYsoHDW1ha2V1cGV4cC5jb23gBwE
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/assets/js/prebid8.20.2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e112fad47d386565c5c4bc8925fe21096d74700691b8452fe43e1de5aff771ae

Request headers

Referer: https://sl.makeupexp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-length: 684
content-type: text/html; charset=utf-8
date: Sat, 24 Feb 2024 15:19:35 GMT
server: envoy
vary: accept-encoding
x-envoy-upstream-service-time: 1

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 661ms
15ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsl.makeupexp.com%2F&domain=sl.makeupexp.com&cw=1&pbt=1&lsw=1&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://sl.makeupexp.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://sl.makeupexp.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 24 Feb 2024 15:19:36 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 204220
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 204 generate_204
tpc.googlesyndication.com/ Frame 9AB3 0
40 B 23ms
22ms Image
text/plain 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?pzUGBA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.115.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f132.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:36 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 cframe.js Show response
assets.a-mo.net/js/ Frame 8C90 16 KB
7 KB 546ms
31ms Script
text/javascript 104.19.159.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/cframe.js
Requested by: Host: sync.a-mo.net
URL: https://sync.a-mo.net/isyn?__st=iframe&gdpr=0&gdpr_consent=&us_privacy=1---_e=Cq0BShBzbC5tYWtldXBleHAuY29tUgthYXMtMWQ1MjgxZFoIcGJhMS4zLjNqEHNsLm1ha2V1cGV4cC5jb236AQY4LjIwLjDoAgGIA4SS6K4GqAM26gMkOTMyYzM1NjEtMmQ3MC00NTBkLThiNmEtNTY0ZThkMzMxNTI2qgQDRENIsgUDVVNE6gUHZGVza3RvcPoFA255NaoHA3dlYsoHDW1ha2V1cGV4cC5jb23gBwE
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.19.159.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a79e82fb537b0621dd3cad7ccff489e28d71450ae91ee4e27b85c5e0f0fd26d9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
via: 1.1 82713ebbf03d41ed38c813ce60a18fea.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: JFK52-P2
age: 383
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 25 Jan 2024 17:28:00 GMT
server: cloudflare
etag: W/"d458c9c4d04e49d089648ee8a1473ba4"
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cf-ray: 85a8b019de761978-EWR
x-amz-cf-id: E2z95YwxQJjRVi3lUubYe5aqDuxsKdbBo0JhOlbW-9IuyHTgCYU2JQ==
expires: Sat, 24 Feb 2024 16:19:37 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/16419211492756663328/ Frame 960B 88 KB
23 KB 1021ms
23ms Document
text/html 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efe658edf9c26c38e237b389774ae9b9a6b808443a32bbc94b70603f934f5118

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 24 Feb 2024 15:19:38 GMT
expires: Sun, 23 Feb 2025 15:19:38 GMT
last-modified: Wed, 14 Feb 2024 22:16:38 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7BA4 0
0 87ms
82ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssajdQbHkqxEiCOWA7_LTl7rpwIskExhJIVJrqYJsIKXNsVjb41AjuwXyNbJIAJxTSoH_6WBoZvmyK3dyMKrwdvafE6xzuD_n8tLGzXUsc5-N7Of8CFwS3JVQMnLFFh9xSd8THaQmeYU0B40XYnkXhrBY58gMYCNGyLai-mj_7uqxjTX1TXdwXdPwHIzyDJ25mTIUK59Xqzb3MiWzIouXbZXdfUGM0V1EgZHoEmRh7WOZ3tlkuFj4B7E13YlOCJWXWV3wOW3Fed49IwR4tN2WrhX0UeZ0o6KO_EmLqKRsiXVm46gklMIZ1NKYzr3rxnyoGTyzweC9yQczcIAPbsXyogZykruf6OPl_BCg83ofgaA3RflIor0D9NREQixPVTRkM1UyfLT2BGipAEvOKU1IFeNj8V656N0quAAEKSkdzpKVC2ypGfETJJcU3XWDDOubHIS32t6gAg3fyb2h7oe19Q4MOr0qAuYx9bpGaOYL5YYAgcnMyfWfnTrNGnQvczmi4owvU9S3MBu-11STbGgEIAs6gzaFY64FhrrS1TaKsK-mBiDqzh2yrDjGCzW1S0zQf8Ty59rUrnXyYxDqjyNRDlu80mcsnokxZEWqVMxeC8-39qI0DDwFf9DN-txvq5W6IXRUQgnjcWwx1siSqE70nUPHps1NrjCXGdBOHDdwCM6rIw-CUBNVXckXwjVrKYj6X6EsVKsjHx4pHZohawIkD6OVnlLrJRmBwbPvs3uxyvuZyMeRg9iyRjh9vq4tqmkr8ieqr0GQS3Ea3EyIjk9XEWXttqUQf9oExw0k3Wj9GQhz-D0OeU6Yx3DcqUcnxq2yl5AXxDagGSdWbMY0-gAMh1lHaxJsjYtVLQ4uKGoxvRkwikx5J7iM0mqKB_nNuouwDJWlGmIHZ7Pc0J_jJoky_zdFek_UY15Txkoz-QDjtAanhDi_ETeE8XAhj0FiEIRkzQ7xx76SHBfuNzBJ59CCS8ZSHCWhoDFkxKzmNwaXR25wmvB7g696lmYtFGU-A3YCq8aV2dE5inTvuasQstND3C4xc7oeqaOdtAeHvUSCcaxz52tkm3lK28FNPmldxLHA2nDPPa9apyI5crqVuAklJtABRw4omC0WcxuA7FCJ1yHmOq2gTwRUL1TNd0qev40gQA8F7a2buBJi_8fBbza0VUDv0y-cVnJWpthjfvhjDHQJrec5ezL2qMTJwGxUR2oVnog1Gz-M2r7g4z8H45eXGv4KADouKdcNzqiq9gWmOxPp_EQl1Auo6b307axVLQCOjv4bRjmtP_q5JGHj63waY1cIQAMcOJXs2bmriK32-ajfc3ki4pqGQATkldzb0XbVCj3uiIIFcieXO2XhngMxRzx7IES3p_2iuIADbms3orqEu65es0I64zOINlxMSC_EnjAfU5oCS60Fs&sai=AMfl-YQoD0JCFV3qG3amgP1xdtp7bbv8NAUWj43i9ZYlBi9uEmN6dSQjT0BOax-HJp0iD0Q0lwU7D0zeQuXg4cUW1UlJ-p2diMQynmqsn_QaZBGd4kAT-IFvSLIA40OSOgOC6xThabyd95EDq5r5_b1OTJgcZgWmX8c5jk864wcKLicVpIFRDM6D6WMRchO1Cnmw9Ec6N7Psy78BQ23n87np0an7GrDKMYofCizqvfBBN9ISUL-SYiCSNMEGj_y3kvgZ1vJqXc_RTxPAktxUYK80Gzj8F3n0nQ3piyQUNg&sig=Cg0ArKJSzDG645Y2iUFyEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1001&cbvp=1&cstd=982&cisv=r20240221.19367&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 24 Feb 2024 15:19:37 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sat, 24 Feb 2024 15:19:37 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7BA4 42 B
174 B 75ms
72ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuch3ifltJJM_DMF_WzVAoESaKUFEcQVfO3Q2Lgg7GitMXet3k-tUsnotxfyZB3yzCZ31jF5jJKrvbXJSqf8-zRl16MCWxIGP6BSt_msh6hp3-ma-mdSSufbsy5JIvm804SIbGpIQed16-MnT_BviKIinn9kA4354M&sai=AMfl-YTjyyjX3fBtQc54R_KuZCo1dl4io95bv5vgPPT5REbu4mg7GSMgXBzHsi30Ah0IvbnIV3OvcnFZfc-TnNOWOjtCnsIvlEz9eSUM3-i18vg70vW4imrJVp5r7X-KcgOOEj0l-jhMvAkv1tShsTko&sig=Cg0ArKJSzL8xnM1oUBIMEAE&cid=CAQSTgAvHhf_xL9KQX6dgNi9JmLheM5yqCf4IGXYTGDHHNx7yle7w5zCBFv9T0U4vbqziYFzoh3MhvGqa2cKqw-ySALmdpuiG1KxFlyVG8_uCRgB&id=lidar2&mcvt=1023&p=1110,436,1200,1164&mtos=1023,1023,1023,1023,1023&tos=1023,0,0,0,0&v=20240222&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=583149734&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=472077600&rst=1708787974297&rpt=1988&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
rtb.adxpremium.services/ Frame 0221
Redirect Chain

https://eb2.3lift.com/getuid?limit=50&redir=https%3A%2F%2Frtb.adxpremium.services%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frtb.adxpremium.services%2Fsetuid%3Fbidder%3Dtriplelift%26uid%3D%24UID
https://rtb.adxpremium.services/setuid?bidder=triplelift&uid=4069881379886949757496

0
556 B

82ms
81ms

Image
text/html

185.106.140.18
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adxpremium.services/setuid?bidder=triplelift&uid=4069881379886949757496
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Server: 185.106.140.18 , Netherlands, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:37 GMT
Server: nginx
Vary: Origin
Content-Type: text/html
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

Redirect headers

location: https://rtb.adxpremium.services/setuid?bidder=triplelift&uid=4069881379886949757496
date: Sat, 24 Feb 2024 15:19:37 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EEBE 0
56 B 73ms
72ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BzBePBwnaZZOtGuG_oPMPkoa40A4AAAAAOAHgBAI&bg=!mZqlmtXNAAbA870Z4PM7ADQBe5WfOC4QcjfNwgHWdfg01X0UmZ5P1YJ6Rkx970PXvYHP4mWpeLENa76rbG7-ySa2c531AgAAArJSAAAABGgBB5kDSY8j2Y_hoLqK76yNWTVO9lG6EJmTIFLGx2teumCVX5jBxq6UcHyJTh8d5lWQw5J4gJ7TwAq1NxQKv3ljTWrZlLbJf16U2Ycz9Oe5wA8UfU6WDz_CanNunD6N2B_OhFsPjcqWpRcLqKpNqj8-aVH8lU2rtrlqHfGd52AN4uGSmIGNyXfwIUKaCDHztdNXNf9ExqbKkr96K_9PvbGdSMPkAxgBqyAgC22aL_-u9On5Q0dgJZtKzcZofO6WzyZ4cfI96tWidV_2gwlIX-Q9pkD-fsCCxJ11nb24b_PETg186FRlhMnxmWgn8yUas7dUn-9dvxg8mGboRxgabYTmAjxS-LEcPatPVJC2Vzgf4KkhaumLthRIbxa2TKPa_naLX15cq2atlhLTbZGB_B0jjB0-YluMO673JRBSL83XrNOvJjNDxZJnR1w4oM1d2uWbxj-w4AlechrbKH_0bE2E10w2xhEVtSVewfa6AZvJkd1AwL3slo8sVzQSJXNF0RM38-IOMR4zlWQu_nkdZoxWWm06tC8cKpt0BJiHz1LGOlb9jGIY8dsANcU8sBGuV4sUjQc0Ne6Re_AaEQz9p1_az2mH7-w2AJm6tXvxf-SCoEQjwxV3HOtDAQkRETS7fUJyCtliKhLL4OQUX168zKZjWGi-6h9OQvtkoDi6U-ZHkv4T2JMFTPVC2CmGYENsbc9SHvcumc48fqzlaHVWRcTxhIueziMdTO8D1DDrmsW5j1cg8H6diY1tW5FYFE0kJrAT2eLT8qqLRrIcRxliB_AGSNUodISX6GVZCik-pi4HsmfpRO9KLmN5numEop3b0ADMYFOu10Qe01-Xxbc4iTchT3j-dYwJAvHHmL9i7a1QXEVjYtIvZbFj5NhznwZ9nsaofMJZHxZU2xOa10_4PhWmKSv8_exVlcTtUS9MH9S8NhLqwdy6NqrbbtO8H6ieQxnwzvWH6Wq5xlwO4zgAcX3j61SgnbN0E01TfzRubECtt0By4kDVsRtOk-Z0iNjeu9hl7QNKNsKs9g5xgdbVTjA6AAVLmyq8vBiD81v8_CWkt0z8h2augoKL7acqSThxOU2HoOiyvXOuE6TIWwYb6xcovZnmB356er-S7hrmDgs

Requested by

Host: 1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com
URL: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content prebid.gif
as.ck-ie.com/ Frame 0221 0
137 B 145ms
9ms Image
text/plain 8.2.110.113
NATCOWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://as.ck-ie.com/prebid.gif?limit=50&redir=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dsmartyads%26uid%3D%5BUID%5D
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.2.110.113 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 15:19:37 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Type: text/plain

GET
H2 200 idl.js Show response
assets.a-mo.net/js/ Frame 8C90 3 KB
2 KB 15ms
15ms Script
application/javascript 104.19.159.19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=sl.makeupexp.com&e=27&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.19.159.19 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8c49bc14e5b5041853d619fe2dc1b01b28bfd4974b8e732f13fa4943efaada3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
via: 1.1 8af02ce0419e91e83834b7deea9dd962.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-cf-pop: JFK52-P2
age: 567
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 02 Nov 2023 21:08:31 GMT
server: cloudflare
etag: W/"771a6a92588a8fb45e42a04fa3fe9ddd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600
cf-ray: 85a8b01c38ec1978-EWR
x-amz-cf-id: VjdJlFcdjXJqLcI8tCn3-q5HR3qJOvBVTiCAi9NqSlsby5BLjpet1A==
expires: Sat, 24 Feb 2024 16:19:37 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 47D1
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-adaptmx
https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx

281 B
555 B

62ms
25ms

Document
text/html

104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
Requested by: Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/cframe.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://sync.a-mo.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sat, 24 Feb 2024 15:19:37 GMT
ETag: "280524-119-60b38417c4040"
Last-Modified: Tue, 28 Nov 2023 15:41:45 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 24 Feb 2024 15:19:37 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
server: AkamaiGHost

GET

bidswitch
sync-dmp.mobtrakk.com/match/ Frame 8C90
Redirect Chain

https://x.bidswitch.net/sync?ssp=adaptmx&user_id=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=
https://x.bidswitch.net/ul_cb/sync?ssp=adaptmx&user_id=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=
https://sync-dmp.mobtrakk.com/match/bidswitch?id=${user_id}&gdpr=0&consent=&usp=1---_e&ssp=adaptmx&bsw=de382d4a-4aec-49f3-80cd-ab5c38322428

0
0

GET
H2

204

yahoo
prebid.a-mo.net/setuid/ Frame 8C90
Redirect Chain

https://ups.analytics.yahoo.com/ups/58570/occ?uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c
https://prebid.a-mo.net/setuid/yahoo?uid=y-B.2wxE9E2uGFlugFmQcsmlTEaeo5LZNRkkAnrWg-~A

0
138 B

10ms
9ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/yahoo?uid=y-B.2wxE9E2uGFlugFmQcsmlTEaeo5LZNRkkAnrWg-~A
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://prebid.a-mo.net/setuid/yahoo?uid=y-B.2wxE9E2uGFlugFmQcsmlTEaeo5LZNRkkAnrWg-~A
date: Sat, 24 Feb 2024 15:19:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
sync.a-mo.net/ Frame 8C90
Redirect Chain

https://id.a-mx.com/u?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Damx_com%26uid%3D
https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=amx_com&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c

0
112 B

10ms
9ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=amx_com&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=amx_com&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c
date: Sat, 24 Feb 2024 15:19:37 GMT
content-length: 0

GET
H2

204

setuid
sync.a-mo.net/ Frame 8C90
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&us_privacy=1---_e&r=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Dopenx%26uid%3D%24%7BUID%7D
https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=openx&uid=3e146ff4-3fe1-4d01-9d94-e34d50924b46

0
135 B

10ms
10ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=openx&uid=3e146ff4-3fe1-4d01-9d94-e34d50924b46
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:36 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
via: 1.1 google
content-type: text/html; charset=utf-8
location: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=openx&uid=3e146ff4-3fe1-4d01-9d94-e34d50924b46
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 152

GET
H2 200 cookie
cm.adform.net/ Frame 8C90 43 B
106 B 710ms
96ms Image
image/gif 37.157.6.233
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.adform.net/cookie?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&redirect_url=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Dadform%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:38 GMT
server: nginx
content-length: 43
content-type: image/gif

GET
H2

204

setuid
sync.a-mo.net/ Frame 8C90
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&us_privacy=1---_e&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252...
https://image8.pubmatic.com/AdServer/ImgSync?p=158355&gdpr=0&gdpr_consent=&us_privacy=1---_e&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D158355%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RDFBRDFDMzctNUI1NS00MDVBLTk1RTgtM0QwODc3NUM4MDk0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=158355&pmc=1&pr=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Dpubmatic%26uid%3DD1AD1C37-5B55-405A-95E...
https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=pubmatic&uid=D1AD1C37-5B55-405A-95E8-3D08775C8094

0
111 B

15ms
14ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=pubmatic&uid=D1AD1C37-5B55-405A-95E8-3D08775C8094
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

location: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=pubmatic&uid=D1AD1C37-5B55-405A-95E8-3D08775C8094
date: Sat, 24 Feb 2024 15:19:38 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

setuid
sync.a-mo.net/ Frame 8C90
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&gdpr=0&gdpr_consent=&us_privacy=1---_e&cb=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Dindex_rtb%2...
https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=index_rtb&uid=ZdoJBkt3ubcAACuMAGDjWAAA%261251

0
111 B

10ms
10ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=index_rtb&uid=ZdoJBkt3ubcAACuMAGDjWAAA%261251
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x7dTX2SEh1n9cWlKAF%2BNUwxoDewfsoJRJW183w%2FdB6DOajfevFTbZUnLZMEG4L0c%2FhCVkHXEoJnag6OA3%2Fv8i4EE5zgw4pouWrcyfCO58T7z%2FMXnu8o5r7uVwW55Vl5v2gzcGGdP"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=index_rtb&uid=ZdoJBkt3ubcAACuMAGDjWAAA%261251
cache-control: no-cache
cf-ray: 85a8b01c4b5c4385-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 pixel
ap.lijit.com/ Frame 8C90 0
175 B 68ms
15ms Image
text/plain 54.235.242.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&us_privacy=1---_e&gpp=&gpp_sid=&redir=https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Dsovrn%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.235.242.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-235-242-57.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 24 Feb 2024 15:19:37 GMT
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT

GET
H2

204

setuid
sync.a-mo.net/ Frame 8C90
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fsync.a-mo.net%2Fsetuid%3FA%3D6a498ea7-f576-4337-9fb4-0b0f1e03e73c%26bidder%3Dappnexus%26uid%3D%24UID
https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=appnexus&uid=2571496715148500523

0
146 B

10ms
10ms

Image
text/plain

147.75.195.77
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=appnexus&uid=2571496715148500523
Protocol: H2
Server: 147.75.195.77 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
an-x-request-uuid: 46b64e0c-35b4-4f04-84c8-8a699516cc56
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://sync.a-mo.net/setuid?A=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&bidder=appnexus&uid=2571496715148500523
x-proxy-origin: 5.181.234.134; 5.181.234.134; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 setuid
ow.pubmatic.com/ Frame 8C90 0
248 B 51ms
14ms Image
text/html 8.28.7.105
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ow.pubmatic.com/setuid?bidder=amx&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&do=sl.makeupexp.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.105 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
content-length: 0
content-type: text/html

GET
H2 200 setuid
ib.adnxs.com/prebid/ Frame 8C90 43 B
1 KB 8ms
7ms Image
image/gif 68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=amx&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c&do=sl.makeupexp.com

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.208 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sync.a-mo.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:37 GMT
an-x-request-uuid: 5e15194a-08c2-4a25-b50e-308c8848fc1d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
BLOB 200
OK a97871fc-d04b-45f5-b23f-61c931bd3935
https://sync.a-mo.net/ Frame 8C90 177 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://sync.a-mo.net/a97871fc-d04b-45f5-b23f-61c931bd3935
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ede9583be20458a44a79ef2a1030080f3cd5ac31d976517e144064610b364032

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Length: 177
Content-Type

GET
H2 200 sync Show response
vid.vidoomy.com/ Frame 3CB9 49 KB
19 KB 955ms
15ms Document
text/html 37.19.206.5
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.vidoomy.com/sync?limit=50&redirect=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dvidoomy%26uid%3D%7B%7BVID%7D%7D
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.19.206.5 Ashburn, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 476000398.ash.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 4cd9d7fe6bef9e82616b20d2c4a7a9842652ed469b704922e4c682f209754768

Request headers

Referer: https://adxbid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Sat, 24 Feb 2024 15:19:38 GMT
etag: W/"a9290c6b5f8c75ebc321b414a16a5c2a"
last-modified: Tue, 12 Dec 2023 09:09:26 GMT
server: CDN77-Turbo
vary: Accept-Encoding Accept-Encoding
x-77-age: 136603
x-77-cache: HIT
x-77-nzt: AyUTzgQ3Nzf/mxUCAJySO983NzexbT1aAu29CQA
x-77-nzt-ray: 8e305f1cb73c80360a09da65d265a823
x-77-pop: ashburnUSVA
x-accel-date: 1708651375
x-accel-expires: @1709688175
x-age: 136603
x-amz-request-id: tx000006aeb86d76e16f6b5-0065c0ebbc-2730a77-prg
x-amz-storage-class: STANDARD
x-cache: HIT
x-rgw-object-type: Normal

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58771/ Frame 8C90 316 B
406 B 18ms
17ms XHR
application/json 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58771/fed?1p=0&gdpr=0&gdpr_consent=&us_privacy=&pixelId=58771&puid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c

Requested by

Host: assets.a-mo.net
URL: https://assets.a-mo.net/js/idl.js?ga=0&gc=&do=sl.makeupexp.com&e=27&uid=6a498ea7-f576-4337-9fb4-0b0f1e03e73c

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

df0737f452063c10949762abe13da1fd229c138c6c83f836fc4fac975c08fd85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sync.a-mo.net/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 24 Feb 2024 15:19:37 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://sync.a-mo.net
content-type: application/json
access-control-allow-credentials: true

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 47D1 40 KB
11 KB 17ms
17ms Script
text/html 104.72.158.153
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.72.158.153 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-72-158-153.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: fde9675576761dc0f594b9b5f324e2d8d7fde1c5c4d64b433333a73e65bce5af

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-adaptmx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 15:19:37 GMT
Content-Encoding: gzip
Last-Modified: Sat, 24 Feb 2024 02:27:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=40041
Connection: keep-alive
Content-Length: 11261
Expires: Sun, 25 Feb 2024 02:26:58 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 47D1 7 B
778 B 824ms
134ms XHR
application/json 8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: b08401febecfa1b1a0c0270265f29df4
Expires: 0

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 356ms
355ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202402200101&jk=2368126171279500&bg=!eHulezTNAAZ3BdUuVwU7ADQBe5WfOMYnYUBA0DrAvq2szZOpSp-m3umyc49Mw93paO6Oy8i4qGvSyOl4xD5JCZGPeqWAAgAAA9JSAAAABWgBB5kC6pEv1z4b1vrKJ5fslSzyNmLS0PMsl5yOHOU5IAkYChtubh6wsKNViH3Oxie001maL-_vHHadgv1CWfeT8mnBGfUXFUhCtOTRBFKZZj8El4z79qg24eMijp861Ib-yPMbC09sGv2dsRcv_Cgb114VnwXOU_douOyAtsbfSQL2X0I-qTNpfcCZXn55KK72CEjKPrqgCuoXXrtuTelMN6YirGNGD1H7L0Kg4Y0PwAaDA5gfGo5IRaUk5_dgmTAEdQVr5dgbZh5VIL-s3nlNLFV1K2bN9jUfBh7CVXwsnQ2jSHHC0qnC0S71-e7_Krd5vtXSZgHsxWvodWCuBpB34h9VR4GC-eJBCTojX3shtTfMZEdRFDaySeecElUoItQ_lHuitP2V2_kRvdy0EKi-ir1klGoodP0nhq3itaZY1lpS5b0_l2R-WPDBWr25ryf2MtESPSMB_-Yj29bFkY-gDLghoRlYTEpHoVR09Xjw3euqZnZYvrLmVXRF-l6G_FPGCWG3Rnxw-coMVMoaJ9fuuT2OAlyx1Wt5DfesYXKIhadjmd52MbmpaJxjWh5IyC-rDB138liKUDCsvzojuRX6zujMb7BZfiIlgWaI4wlqmmh4L287kJzi979IyVtH7O1erNzJYW9kktULYzD5OPHOgOc1xxX46sOF174uBMGEGFDCMXMdBBV8lQ7roGrLj--jb7WYGXxvBgrnDovehukeSKAvUASyaQW6kVylQfB4fVF-g_xapvPKk8Zomm78CzHBv5s1BKDfdod47JaoFpJYraxYadyXirODAev36Q4mlqzuuEI6DQ6msdl_2UqoWfsrmFv1DkExn9CMqak8g64DlNYAf2LvzLYFhLk6sH8A9OhihHkTtC3lNE64_EM_XhYNx2ryrIr2-xuDcOLHN9W9I34ymCYYw8JL1WpXBnrLRKSlfqDKXa5uETDqwKmA0c_cW5Z9UqE4AO6-KTe5wOsKexF5JJT3G--iOvJU-5aT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://sl.makeupexp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

GET
H2 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 960B 120 KB
41 KB 15ms
14ms Script
text/javascript 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 00:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52548
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Feb 2024 00:43:50 GMT

GET
H2 200 preload.jpg
s0.2mdn.net/sadbundle/16419211492756663328/ Frame 960B 2 KB
2 KB 15ms
15ms Image
image/jpeg 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16419211492756663328/preload.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c64bc40632fa695cc9d2625524e1708a17f7c331fab12a9cc46a78eddc362257

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

expires: Sat, 22 Feb 2025 00:46:22 GMT
date: Fri, 23 Feb 2024 00:46:22 GMT
x-content-type-options: nosniff
age: 138796
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2255
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:16:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 960B 8 KB
6 KB 73ms
73ms XHR
application/json 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5d996e73ead1fd704861bf2921cdb596e59a39bc13f129ffe58dc90a4d2a547

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5964
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7BA4 0
0 75ms
74ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssajdQbHkqxEiCOWA7_LTl7rpwIskExhJIVJrqYJsIKXNsVjb41AjuwXyNbJIAJxTSoH_6WBoZvmyK3dyMKrwdvafE6xzuD_n8tLGzXUsc5-N7Of8CFwS3JVQMnLFFh9xSd8THaQmeYU0B40XYnkXhrBY58gMYCNGyLai-mj_7uqxjTX1TXdwXdPwHIzyDJ25mTIUK59Xqzb3MiWzIouXbZXdfUGM0V1EgZHoEmRh7WOZ3tlkuFj4B7E13YlOCJWXWV3wOW3Fed49IwR4tN2WrhX0UeZ0o6KO_EmLqKRsiXVm46gklMIZ1NKYzr3rxnyoGTyzweC9yQczcIAPbsXyogZykruf6OPl_BCg83ofgaA3RflIor0D9NREQixPVTRkM1UyfLT2BGipAEvOKU1IFeNj8V656N0quAAEKSkdzpKVC2ypGfETJJcU3XWDDOubHIS32t6gAg3fyb2h7oe19Q4MOr0qAuYx9bpGaOYL5YYAgcnMyfWfnTrNGnQvczmi4owvU9S3MBu-11STbGgEIAs6gzaFY64FhrrS1TaKsK-mBiDqzh2yrDjGCzW1S0zQf8Ty59rUrnXyYxDqjyNRDlu80mcsnokxZEWqVMxeC8-39qI0DDwFf9DN-txvq5W6IXRUQgnjcWwx1siSqE70nUPHps1NrjCXGdBOHDdwCM6rIw-CUBNVXckXwjVrKYj6X6EsVKsjHx4pHZohawIkD6OVnlLrJRmBwbPvs3uxyvuZyMeRg9iyRjh9vq4tqmkr8ieqr0GQS3Ea3EyIjk9XEWXttqUQf9oExw0k3Wj9GQhz-D0OeU6Yx3DcqUcnxq2yl5AXxDagGSdWbMY0-gAMh1lHaxJsjYtVLQ4uKGoxvRkwikx5J7iM0mqKB_nNuouwDJWlGmIHZ7Pc0J_jJoky_zdFek_UY15Txkoz-QDjtAanhDi_ETeE8XAhj0FiEIRkzQ7xx76SHBfuNzBJ59CCS8ZSHCWhoDFkxKzmNwaXR25wmvB7g696lmYtFGU-A3YCq8aV2dE5inTvuasQstND3C4xc7oeqaOdtAeHvUSCcaxz52tkm3lK28FNPmldxLHA2nDPPa9apyI5crqVuAklJtABRw4omC0WcxuA7FCJ1yHmOq2gTwRUL1TNd0qev40gQA8F7a2buBJi_8fBbza0VUDv0y-cVnJWpthjfvhjDHQJrec5ezL2qMTJwGxUR2oVnog1Gz-M2r7g4z8H45eXGv4KADouKdcNzqiq9gWmOxPp_EQl1Auo6b307axVLQCOjv4bRjmtP_q5JGHj63waY1cIQAMcOJXs2bmriK32-ajfc3ki4pqGQATkldzb0XbVCj3uiIIFcieXO2XhngMxRzx7IES3p_2iuIADbms3orqEu65es0I64zOINlxMSC_EnjAfU5oCS60Fs&sai=AMfl-YQoD0JCFV3qG3amgP1xdtp7bbv8NAUWj43i9ZYlBi9uEmN6dSQjT0BOax-HJp0iD0Q0lwU7D0zeQuXg4cUW1UlJ-p2diMQynmqsn_QaZBGd4kAT-IFvSLIA40OSOgOC6xThabyd95EDq5r5_b1OTJgcZgWmX8c5jk864wcKLicVpIFRDM6D6WMRchO1Cnmw9Ec6N7Psy78BQ23n87np0an7GrDKMYofCizqvfBBN9ISUL-SYiCSNMEGj_y3kvgZ1vJqXc_RTxPAktxUYK80Gzj8F3n0nQ3piyQUNg&sig=Cg0ArKJSzDG645Y2iUFyEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2102&vt=11&dtpt=1101&dett=3&cstd=982&cisv=r20240221.19367&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: sl.makeupexp.com
URL: https://sl.makeupexp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:38 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 24 Feb 2024 15:19:38 GMT

GET
H2 200 replay.png
s0.2mdn.net/sadbundle/16419211492756663328/ Frame 960B 457 B
531 B 22ms
20ms Image
image/png 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16419211492756663328/replay.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4701179c17827a7d417dbc7d9a40cdd6fbb0112d29e90b822bbf5b2a33d63af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

expires: Sat, 22 Feb 2025 00:56:35 GMT
date: Fri, 23 Feb 2024 00:56:35 GMT
x-content-type-options: nosniff
age: 138183
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 457
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:16:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 poster.jpg
s0.2mdn.net/sadbundle/16419211492756663328/ Frame 960B 30 KB
30 KB 15ms
14ms Image
image/jpeg 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16419211492756663328/poster.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0f53a73f9d08e98e49b13eec0416d679617b78563ced043be634ef22e546c4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

expires: Sat, 22 Feb 2025 00:56:35 GMT
date: Fri, 23 Feb 2024 00:56:35 GMT
x-content-type-options: nosniff
age: 138183
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31060
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:16:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H/1.1

206
Partial Content

file.mp4
r2---sn-ab5l6nrl.c.2mdn.net/videoplayback/id/449b77d8d9161bfd/itag/59/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740323975/sparams/acao,ctier,expire,id,i... Frame 960B
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/449b77d8d9161bfd/itag/59/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740323975/sparams/ip,ipbits,expire,id,itag,sou...
https://r2---sn-ab5l6nrl.c.2mdn.net/videoplayback/id/449b77d8d9161bfd/itag/59/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740323975/sparams/acao,ctier,exp...

243 KB
243 KB

533ms
9ms

Media
video/mp4

74.125.172.71
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-ab5l6nrl.c.2mdn.net/videoplayback/id/449b77d8d9161bfd/itag/59/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740323975/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source,xpc/signature/57597660E2FDF2169E17A2EDC6616A0CF16BA365.7DEF9356CC4B0FDA265613EB6DC6584C850110A3/key/cms1/cms_redirect/yes/mh/As/mip/5.181.234.134/mm/42/mn/sn-ab5l6nrl/ms/onc/mt/1708787075/mv/m/mvi/2/pl/24/file/file.mp4

Protocol

HTTP/1.1

Server

74.125.172.71 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s82-in-f7.1e100.net

Software

gvs 1.0 /

Resource Hash

98ae4b39ec53336ef5d7f7c1e3aae4ba0b869f0f48de896d4b3bef5b55d11246

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sat, 24 Feb 2024 15:19:39 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 14 Feb 2024 22:17:10 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-248775/248776
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 248776
Expires: Sat, 24 Feb 2024 15:19:39 GMT

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:38 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r2---sn-ab5l6nrl.c.2mdn.net/videoplayback/id/449b77d8d9161bfd/itag/59/source/web_video_ads/xpc/EgVovf3BOg%3D%3D/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1740323975/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source,xpc/signature/57597660E2FDF2169E17A2EDC6616A0CF16BA365.7DEF9356CC4B0FDA265613EB6DC6584C850110A3/key/cms1/cms_redirect/yes/mh/As/mip/5.181.234.134/mm/42/mn/sn-ab5l6nrl/ms/onc/mt/1708787075/mv/m/mvi/2/pl/24/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 667
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 960B 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 prod_studio_01_250_videomodule.js Show response
s0.2mdn.net/879366/ Frame 960B 13 KB
5 KB 15ms
15ms Script
text/javascript 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_250_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03656ff565d2cc90c3b8f2c1963c5804304e5d9dc796e920db21a6db906a942d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 04:50:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 37738
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4955
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:43 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 25 Feb 2024 04:50:40 GMT

GET
H2 200 replay.png
s0.2mdn.net/sadbundle/16419211492756663328/ Frame 960B 457 B
519 B 14ms
14ms Image
image/png 172.253.122.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16419211492756663328/replay.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4701179c17827a7d417dbc7d9a40cdd6fbb0112d29e90b822bbf5b2a33d63af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16419211492756663328/index.html?e=69&leftOffset=0&topOffset=0&c=ndqncl4AKj&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

expires: Sat, 22 Feb 2025 00:56:35 GMT
date: Fri, 23 Feb 2024 00:56:35 GMT
x-content-type-options: nosniff
age: 138183
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 457
x-xss-protection: 0
last-modified: Wed, 14 Feb 2024 22:16:38 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 960B 17 KB
6 KB 17ms
16ms Script
text/javascript 172.253.115.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 24 Feb 2024 15:19:38 GMT

GET
H2 200 BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js Show response
pagead2.googlesyndication.com/bg/ Frame 84E7 39 KB
15 KB 16ms
15ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BoEj1MRYnOy5BSN5ElbJySd6MGFyYBWT_ZtkFEIAVvM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068123d4c4589cecb90523791256c9c9277a306172601593fd9b6414420056f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 06:37:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31351
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15302
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 17:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 23 Feb 2025 06:37:07 GMT

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 47D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&khaos=LT088MM7-1U-92V9
https://prebid.a-mo.net/setuid/magnite?uid=LT088MM7-1U-92V9

0
135 B

10ms
10ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LT088MM7-1U-92V9
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:39 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LT088MM7-1U-92V9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
Expires: 0

GET
H/1.1

200
OK

setuid
user-sync.adxpremium.services/ Frame 0221
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=194962&limit=50&cb=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dix%26uid%3D
https://user-sync.adxpremium.services/setuid?bidder=ix&uid=ZdoJBkt3ubcAACuMAGDjWAAA%261251

86 B
640 B

603ms
50ms

Image
image/png

209.192.201.180
SERVERS-COM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://user-sync.adxpremium.services/setuid?bidder=ix&uid=ZdoJBkt3ubcAACuMAGDjWAAA%261251
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: HTTP/1.1
Server: 209.192.201.180 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://adxbid.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:39 GMT
content-length: 86
content-type: image/png

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:38 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zobgs%2Bd%2BoDZC8%2F35aUuYaUJk%2F6h2n2X4rnuAyuHIb2UiexjfXJqnKgitiEnwe%2B5ju7SKXs1Ie5g%2F%2Fu3sNW%2FFdZAaQjei29kr5WCSf3qFVWrY8gHI%2FGkSBMSV4Pll0yW7wG1bqfxf"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://user-sync.adxpremium.services/setuid?bidder=ix&uid=ZdoJBkt3ubcAACuMAGDjWAAA%261251
cache-control: no-cache
cf-ray: 85a8b0227b610f68-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 urlsvid.json Show response
vpaid.vidoomy.com/sync/ Frame 3CB9 1 KB
1 KB 577ms
16ms XHR
application/json 37.19.206.6
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://vpaid.vidoomy.com/sync/urlsvid.json
Requested by: Host: vid.vidoomy.com
URL: https://vid.vidoomy.com/sync?limit=50&redirect=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dvidoomy%26uid%3D%7B%7BVID%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.19.206.6 Ashburn, United States, ASN60068 (CDN77 _, GB),
Reverse DNS: 476000398.ash.cdn77.com
Software: CDN77-Turbo /
Resource Hash: b05155416aa1689236072fb1338ceaefc9809a849bda6588965f5979e8a01aa8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://vid.vidoomy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-77-pop: ashburnUSVA
date: Sat, 24 Feb 2024 15:19:39 GMT
content-encoding: gzip
x-amz-request-id: tx00000338a9d38d48655a4-0065b3ac46-2bbae03-prg
x-77-cache: HIT
x-cache: HIT
x-amz-storage-class: STANDARD
x-age: 440515
x-accel-date: 1708347464
x-77-nzt: AyUTzgQ3Nzf/w7gGALk73xQ3NzexWbu8qRkRtwA
x-accel-expires: @1709216254
x-77-age: 440515
last-modified: Tue, 26 Dec 2023 20:45:55 GMT
server: CDN77-Turbo
x-amz-meta-s3cmd-attrs: atime:1703619207/ctime:1703619207/gid:1000/gname:federicoi/md5:d0bbf411bc053227f208739885ca90c0/mode:33204/mtime:1703619207/uid:1000/uname:federicoi
etag: W/"d0bbf411bc053227f208739885ca90c0"
x-77-nzt-ray: 8e305f1cf03ebc4a0b09da6530d12310
vary: Accept-Encoding, Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-rgw-object-type: Normal
access-control-allow-credentials: true
timing-allow-origin: *

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 47D1
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bb42b77f-9076-4f7d-a15e-f9e0219b3a41&gdpr=0&gdpr_consent=&expires=30

42 B
872 B

1593ms
135ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bb42b77f-9076-4f7d-a15e-f9e0219b3a41&gdpr=0&gdpr_consent=&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=bb42b77f-9076-4f7d-a15e-f9e0219b3a41&gdpr=0&gdpr_consent=&expires=30
date: Sat, 24 Feb 2024 15:19:38 GMT
server: Kestrel
content-length: 289

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 47D1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGzbN9B0DZXXM-ERb9uZ2IE&google_cver=1

42 B
872 B

1563ms
134ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGzbN9B0DZXXM-ERb9uZ2IE&google_cver=1
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:38 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGzbN9B0DZXXM-ERb9uZ2IE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 47D1
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=awnXmJIJTvKxLMPFe2WAYw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=awnXmJIJTvKxLMPFe2WAYw

43 B
479 B

27ms
25ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=awnXmJIJTvKxLMPFe2WAYw

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:40 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: YDHEY54R077KV4PW7TYV
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=awnXmJIJTvKxLMPFe2WAYw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 47D1 43 B
855 B 772ms
185ms Image
image/gif 67.220.228.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

67.220.228.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:39 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SM0H5MG7C1M19DCACP17
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 47D1
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjdlOWQ3N2M4NzA2YWNlMGVmYTNlYWJmZDZhMzg4NGRhYmJmYmYyOA

170 B
188 B

26ms
26ms

Image
image/png

142.251.167.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjdlOWQ3N2M4NzA2YWNlMGVmYTNlYWJmZDZhMzg4NGRhYmJmYmYyOA

Protocol

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjdlOWQ3N2M4NzA2YWNlMGVmYTNlYWJmZDZhMzg4NGRhYmJmYmYyOA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 47D1
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFQwODhNTTctMVUtOTJWOQ==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEBeKdoRnVtEwYAtoCteFtks&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFQwODhNTTctMVUtOTJWOQ==&google_push=

170 B
188 B

25ms
24ms

Image
image/png

142.251.167.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFQwODhNTTctMVUtOTJWOQ==&google_push=

Protocol

Server

142.251.167.156 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFQwODhNTTctMVUtOTJWOQ==&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 47D1
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/mV-2g3fm1IsN_ixMCL_Fz8n5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-wr68hTVE2oLaM4NOSJkcKtXp9SnYWp9aHBbUSQ--~A

42 B
872 B

710ms
129ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-wr68hTVE2oLaM4NOSJkcKtXp9SnYWp9aHBbUSQ--~A
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Sat, 24 Feb 2024 15:19:39 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-wr68hTVE2oLaM4NOSJkcKtXp9SnYWp9aHBbUSQ--~A
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 47D1
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LT088MM7-1U-92V9

0
517 B

461ms
66ms

Image
text/plain

13.107.42.14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LT088MM7-1U-92V9
Protocol: H2
Server: 13.107.42.14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:39 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: CDD29095AAAF4BDC9BC28B1178BD3B29 Ref B: EWR30EDGE0217 Ref C: 2024-02-24T15:19:40Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYSIjSPvk6GRUhfY6d82Q==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LT088MM7-1U-92V9
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 47D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=LT088MM7-1U-92V9&ex=d-rubiconproject.com&status=ok

43 B
479 B

27ms
26ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=LT088MM7-1U-92V9&ex=d-rubiconproject.com&status=ok

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 24 Feb 2024 15:19:40 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: HXPQ4T25JR9Q31QMBMN6
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://s.amazon-adsystem.com/ecm3?id=LT088MM7-1U-92V9&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
Expires: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 47D1
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAFzpU7LtBIAABUljJyHkA&expires=30

42 B
872 B

1082ms
131ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAFzpU7LtBIAABUljJyHkA&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAFzpU7LtBIAABUljJyHkA&expires=30
Date: Sat, 24 Feb 2024 15:19:39 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2

204

magnite
prebid.a-mo.net/setuid/ Frame 47D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://prebid.a-mo.net/setuid/magnite?uid=LT088MM7-1U-92V9

0
135 B

11ms
7ms

Image
text/plain

147.75.195.55
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid/magnite?uid=LT088MM7-1U-92V9
Protocol: H2
Server: 147.75.195.55 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:40 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
vary: Accept-Encoding

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://prebid.a-mo.net/setuid/magnite?uid=LT088MM7-1U-92V9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
Expires: 0

GET
H2

200

pixel
capi.connatix.com/us/ Frame 47D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=LT088MM7-1U-92V9&pId=11&gdpr=&gdpr_consent=&us_privacy=
https://capi.connatix.com/us/pixel?puid=LT088MM7-1U-92V9&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true

82 B
82 B

48ms
47ms

Image
image/gif

172.64.146.152

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=LT088MM7-1U-92V9&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
Protocol: H2
Server: 172.64.146.152 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:40 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 85a8b02da95041e0-EWR
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 24 Feb 2024 15:19:40 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://capi.connatix.com/us/pixel?puid=LT088MM7-1U-92V9&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 85a8b02d590d41e0-EWR
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 47D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LT088MM7-1U-92V9

68 B
280 B

56ms
15ms

Image
image/png

23.22.166.141

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LT088MM7-1U-92V9
Protocol: H2
Server: 23.22.166.141 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:40 GMT
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LT088MM7-1U-92V9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
Expires: 0

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame 47D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LT088MM7-1U-92V9

43 B
2 KB

9ms
8ms

Image
image/gif

68.67.161.208
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LT088MM7-1U-92V9

Protocol

Server

68.67.161.208 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:40 GMT
an-x-request-uuid: b0ad1d1b-90a6-40d2-8edf-e81f6b68e9bf
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 5.181.234.134; 5.181.234.134; 806.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LT088MM7-1U-92V9
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b9bd3ce43b0f5c29a708abe94979ac15
Expires: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 47D1
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LT088MM7-1U-92V9

95 B
124 B

31ms
30ms

Image
image/png

34.111.113.62

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LT088MM7-1U-92V9

Protocol

Server

34.111.113.62 -, , ASN (),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sat, 24 Feb 2024 15:19:40 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LT088MM7-1U-92V9
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 47D1
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=1465f288-1b8d-416f-bd4d-fd8aea24c1bd&expires=30

42 B
872 B

136ms
136ms

Image
image/gif

8.43.72.97
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=1465f288-1b8d-416f-bd4d-fd8aea24c1bd&expires=30
Protocol: HTTP/1.1
Server: 8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=1465f288-1b8d-416f-bd4d-fd8aea24c1bd&expires=30
Date: Sat, 24 Feb 2024 15:19:40 GMT
Connection: keep-alive
X-CI-RTID: a1c8f9d5-aee2-41da-8043-dd45cbea2a3d
Content-Length: 144
Content-Type: text/html; charset=utf-8

GET
H2 200 dc_oe=ChMI08yWoqPEhAMV4R9oCB0SAw7qEAAYACCG5MRkQhMI6P69oaPEhAMVMoqDCB0MQAPG;dc_eps=AHas8cCO5_4axUZIQIq06BWLWJ4KmWg4oGQ7bAa3EMJX59WIv25wgG5jMmZPlDynZNbdnk5mb5Cc5EtHKqPaiPvc;met=1;&timestamp=170878797...
ade.googlesyndication.com/ddm/activity/ Frame 7BA4 42 B
401 B 110ms
73ms Image
image/gif 172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI08yWoqPEhAMV4R9oCB0SAw7qEAAYACCG5MRkQhMI6P69oaPEhAMVMoqDCB0MQAPG;dc_eps=AHas8cCO5_4axUZIQIq06BWLWJ4KmWg4oGQ7bAa3EMJX59WIv25wgG5jMmZPlDynZNbdnk5mb5Cc5EtHKqPaiPvc;met=1;&timestamp=1708787979273;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://1471b48579b31bb02f446ef6daa6c20d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 24 Feb 2024 15:19:39 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame D4B4 16 KB
6 KB 128ms
40ms Document
text/html 23.204.76.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?limit=50&predirect=https%3A%2F%2Fuser-sync.adxpremium.services%2Fsetuid%3Fbidder%3Dpubmatic%26uid%3D
Requested by: Host: adxbid.info
URL: https://adxbid.info/sync-all.html?gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.204.76.201 Miami, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-204-76-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c861dd92be984fe498ece34c0f3c921861ac51bfee50323fcae21231abf7a82b

Request headers

Referer: https://adxbid.info/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=114411
content-encoding: gzip
content-length: 5685
content-type: text/html
date: Sat, 24 Feb 2024 15:19:39 GMT
expires: Sun, 25 Feb 2024 23:06:30 GMT
last-modified: Tue, 13 Feb 2024 04:57:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7BA4 0
57 B 72ms
72ms Ping
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9082087302766&version=m202401290101&ct=119&x=1&cor=7649592576889330000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS