windowsxlive.saftawy.com Open in urlscan Pro
108.167.181.192 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://windowsxlive.saftawy.com/
Submission: On August 27 via api (August 27th 2023, 2:24:22 pm UTC) from US — Scanned from US

Summary HTTP 243 Redirects Links 75 Behaviour Indicators

Summary

This website contacted 53 IPs in 5 countries across 55 domains to perform 243 HTTP transactions. The main IP is 108.167.181.192, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is windowsxlive.saftawy.com.
TLS certificate: Issued by R3 on July 4th 2023. Valid for: 3 months.

This is the only time windowsxlive.saftawy.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
27	108.167.181.192 108.167.181.192	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
5	2607:f8b0:402... 2607:f8b0:4020:805::200a	15169 (GOOGLE) (GOOGLE)
5	23.43.85.18 23.43.85.18	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.215.130.187 23.215.130.187	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	108.156.184.115 108.156.184.115	16509 (AMAZON-02) (AMAZON-02)
5	172.66.41.9 172.66.41.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2607:f8b0:400... 2607:f8b0:4006:80b::200e	15169 (GOOGLE) (GOOGLE)
1	34.230.226.68 34.230.226.68	14618 (AMAZON-AES) (AMAZON-AES)
5	2607:f8b0:402... 2607:f8b0:4020:806::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4004:c0b::9b	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:402... 2607:f8b0:4020:806::2008	15169 (GOOGLE) (GOOGLE)
1	2600:1400:900... 2600:1400:9000::172c:edbb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	3.160.5.103 3.160.5.103	16509 (AMAZON-02) (AMAZON-02)
2 6	52.204.12.229 52.204.12.229	14618 (AMAZON-AES) (AMAZON-AES)
4	2600:9000:25f... 2600:9000:25f5:8c00:2:42d9:3100:93a1	16509 (AMAZON-02) (AMAZON-02)
1 9	2607:f8b0:402... 2607:f8b0:4020:805::2002	15169 (GOOGLE) (GOOGLE)
2	3.212.40.172 3.212.40.172	14618 (AMAZON-AES) (AMAZON-AES)
1	54.237.107.196 54.237.107.196	14618 (AMAZON-AES) (AMAZON-AES)
1	2602:803:c002... 2602:803:c002:200::42	26667 (RUBICONPR...) (RUBICONPROJECT)
1	104.18.39.155 104.18.39.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 5	68.67.160.26 68.67.160.26	29990 (ASN-APPNEX) (ASN-APPNEX)
3	34.197.182.56 34.197.182.56	14618 (AMAZON-AES) (AMAZON-AES)
1	108.156.184.25 108.156.184.25	16509 (AMAZON-02) (AMAZON-02)
9	2607:f8b0:402... 2607:f8b0:4020:806::2001	15169 (GOOGLE) (GOOGLE)
1	2600:9000:24f... 2600:9000:24fd:a800:1d:667e:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:402... 2607:f8b0:4020:804::2002	15169 (GOOGLE) (GOOGLE)
35	2607:f8b0:402... 2607:f8b0:4020:806::2002	15169 (GOOGLE) (GOOGLE)
19	2607:f8b0:402... 2607:f8b0:4020:807::2001	15169 (GOOGLE) (GOOGLE)
1 6	2607:f8b0:402... 2607:f8b0:4020:807::2004	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:402... 2607:f8b0:4020:807::2003	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:402... 2607:f8b0:4020:806::200e	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:402... 2607:f8b0:4020:805::200e	15169 (GOOGLE) (GOOGLE)
2	2600:9000:25f... 2600:9000:25f3:400:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2 2	184.86.146.172 184.86.146.172	16625 (AKAMAI-AS) (AKAMAI-AS)
9 32	172.217.13.162 172.217.13.162	15169 (GOOGLE) (GOOGLE)
3 3	54.159.93.151 54.159.93.151	14618 (AMAZON-AES) (AMAZON-AES)
1 1	35.236.220.17 35.236.220.17	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 3	64.74.236.191 64.74.236.191	19024 (INTERNAP-...) (INTERNAP-BLK5)
3 3	104.36.115.113 104.36.115.113	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	23.105.12.170 23.105.12.170	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
1 1	44.196.176.11 44.196.176.11	14618 (AMAZON-AES) (AMAZON-AES)
6 10	192.40.39.223 192.40.39.223	27381 (CASALE-MEDIA) (CASALE-MEDIA)
2	2600:1f13:800... 2600:1f13:800:7780:78aa:1966:9c24:9c12	16509 (AMAZON-02) (AMAZON-02)
7	2607:f8b0:402... 2607:f8b0:4020:807::2006	15169 (GOOGLE) (GOOGLE)
5	172.217.13.194 172.217.13.194	15169 (GOOGLE) (GOOGLE)
1	108.156.184.93 108.156.184.93	16509 (AMAZON-02) (AMAZON-02)
1	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	18.211.192.157 18.211.192.157	14618 (AMAZON-AES) (AMAZON-AES)
2 2	185.167.164.39 185.167.164.39	198622 (ADFORM) (ADFORM)
2 2	54.85.16.190 54.85.16.190	14618 (AMAZON-AES) (AMAZON-AES)
1 1	23.205.72.21 23.205.72.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	35.208.249.213 35.208.249.213	19527 (GOOGLE-2) (GOOGLE-2)
1	2620:116:800b... 2620:116:800b:21:c1e8:5385:5098:6bf0	14618 (AMAZON-AES) (AMAZON-AES)
3 3	199.127.204.142 199.127.204.142	26120 (RHYTHMONE) (RHYTHMONE)
2 2	35.207.24.140 35.207.24.140	15169 (GOOGLE) (GOOGLE)
1 1	54.81.223.21 54.81.223.21	14618 (AMAZON-AES) (AMAZON-AES)
1 2	23.205.56.163 23.205.56.163	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2600:9000:24f... 2600:9000:24fd:e00:12:6a04:c9c0:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2600:9000:25f... 2600:9000:25f4:5e00:5:393a:f0c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	34.227.123.3 34.227.123.3	14618 (AMAZON-AES) (AMAZON-AES)
1	54.209.208.39 54.209.208.39	14618 (AMAZON-AES) (AMAZON-AES)
1	72.247.64.74 72.247.64.74	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
4	184.50.205.247 184.50.205.247	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	3.225.218.10 3.225.218.10	14618 (AMAZON-AES) (AMAZON-AES)
243	53

27 108.167.181.192 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: fall-pro.com

windowsxlive.saftawy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
windowsxlive.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4020:805::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.43.85.18 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-43-85-18.deploy.static.akamaitechnologies.com

cdn.nsstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.static.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ns.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.215.130.187 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-215-130-187.deploy.static.akamaitechnologies.com

a.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.156.184.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-184-115.cmh68.r.cloudfront.net

native.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.66.41.9 (United States)

ASN13335 (CLOUDFLARENET, US)

resources.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
router.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80b::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.230.226.68 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-226-68.compute-1.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4020:806::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

windowsxslive.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c0b::9b (Ashburn, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:806::2008 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1400:9000::172c:edbb (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

g.pcmag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.160.5.103 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-160-5-103.cmh68.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.204.12.229 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-12-229.compute-1.amazonaws.com

secure-us.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:25f5:8c00:2:42d9:3100:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4020:805::2002 (Montreal, Canada) 1 redirects

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.212.40.172 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-40-172.compute-1.amazonaws.com

gurgle.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.237.107.196 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-237-107-196.compute-1.amazonaws.com

zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:803:c002:200::42 (United States)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.39.155 (None, )

ASN13335 (CLOUDFLARENET, US)

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.98.64.218 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

ziffdavis-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 68.67.160.26 (New York, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.197.182.56 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-182-56.compute-1.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.156.184.25 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-184-25.cmh68.r.cloudfront.net

bee.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4020:806::2001 (Montreal, Canada)

ASN15169 (GOOGLE, US)

63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:24fd:a800:1d:667e:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

9wgixs4lne8uceb5vwr9yffkq55wf1693146245.nuid.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4020:804::2002 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

35 2607:f8b0:4020:806::2002 (Montreal, Canada)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2607:f8b0:4020:807::2001 (Montreal, Canada)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4020:807::2004 (Montreal, Canada) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:807::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4020:806::200e (Montreal, Canada)

ASN15169 (GOOGLE, US)

encrypted-tbn1.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4020:805::200e (Montreal, Canada)

ASN15169 (GOOGLE, US)

encrypted-tbn3.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
encrypted-tbn2.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:25f3:400:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.86.146.172 (Eden Prairie, United States) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-86-146-172.deploy.static.akamaitechnologies.com

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 172.217.13.162 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.159.93.151 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-93-151.compute-1.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.236.220.17 (Washington, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 17.220.236.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 64.74.236.191 (United States) 3 redirects

ASN19024 (INTERNAP-BLK5, US)
PTR: chi.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.36.115.113 (United States) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.105.12.170 (Manassas, United States) 1 redirects

ASN30633 (LEASEWEB-USA-WDC, US)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.196.176.11 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-196-176-11.compute-1.amazonaws.com

cc.adingo.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 192.40.39.223 (Canada) 6 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1f13:800:7780:78aa:1966:9c24:9c12 (Boardman, United States)

ASN16509 (AMAZON-02, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4020:807::2006 (Montreal, Canada)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.13.194 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.156.184.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-156-184-93.cmh68.r.cloudfront.net

realtime.clinch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.211.192.157 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-192-157.compute-1.amazonaws.com

fksnk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.167.164.39 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.85.16.190 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-16-190.compute-1.amazonaws.com

match.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.205.72.21 (Edison, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-72-21.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.208.249.213 (Council Bluffs, United States) 1 redirects

ASN19527 (GOOGLE-2, US)
PTR: 213.249.208.35.bc.googleusercontent.com

trace.mediago.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800b:21:c1e8:5385:5098:6bf0 (United States)

ASN14618 (AMAZON-AES, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.127.204.142 (United States) 3 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.207.24.140 (North Charleston, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com

rtb.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.81.223.21 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-223-21.compute-1.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.56.163 (Edison, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-56-163.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:24fd:e00:12:6a04:c9c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.clinch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:25f4:5e00:5:393a:f0c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

img-cdn.clinch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.227.123.3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-227-123-3.compute-1.amazonaws.com

trk.clinch.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.209.208.39 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-208-39.compute-1.amazonaws.com

jogger.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.64.74 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-64-74.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 184.50.205.247 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-247.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.218.10 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	googlesyndication.com 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 116 tpc.googlesyndication.com — Cisco Umbrella Rank: 155 ade.googlesyndication.com	269 KB
49	doubleclick.net 10 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 93 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 210 googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 cm.g.doubleclick.net — Cisco Umbrella Rank: 242 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 371	286 KB
26	windowsxlive.net windowsxlive.net	551 KB
14	clinch.co realtime.clinch.co — Cisco Umbrella Rank: 5952 cdn.clinch.co — Cisco Umbrella Rank: 5094 img-cdn.clinch.co — Cisco Umbrella Rank: 6482 trk.clinch.co — Cisco Umbrella Rank: 4040	108 KB
12	imrworldwide.com 2 redirects secure-us.imrworldwide.com — Cisco Umbrella Rank: 2409 cdn-gl.imrworldwide.com — Cisco Umbrella Rank: 3353 bee.imrworldwide.com — Cisco Umbrella Rank: 47115 9wgixs4lne8uceb5vwr9yffkq55wf1693146245.nuid.imrworldwide.com	77 KB
11	casalemedia.com 6 redirects as-sec.casalemedia.com — Cisco Umbrella Rank: 1969 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 594	8 KB
11	gstatic.com fonts.gstatic.com www.gstatic.com encrypted-tbn1.gstatic.com encrypted-tbn3.gstatic.com encrypted-tbn0.gstatic.com encrypted-tbn2.gstatic.com	364 KB
8	zdbb.net cdn.static.zdbb.net — Cisco Umbrella Rank: 16242 ns.zdbb.net — Cisco Umbrella Rank: 221117 gurgle.zdbb.net — Cisco Umbrella Rank: 21466 zdbb.net — Cisco Umbrella Rank: 11687 jogger.zdbb.net — Cisco Umbrella Rank: 16530	46 KB
7	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 328	200 KB
7	adsafeprotected.com pixel.adsafeprotected.com — Cisco Umbrella Rank: 764 static.adsafeprotected.com — Cisco Umbrella Rank: 632 dt.adsafeprotected.com — Cisco Umbrella Rank: 586	101 KB
6	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	708 B
5	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 428	110 KB
5	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 245	4 KB
5	infolinks.com resources.infolinks.com — Cisco Umbrella Rank: 6851 router.infolinks.com — Cisco Umbrella Rank: 2893	60 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 45	4 KB
4	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 589 tags.bluekai.com — Cisco Umbrella Rank: 646	2 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 222	227 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	21 KB
3	pubmatic.com 3 redirects image6.pubmatic.com — Cisco Umbrella Rank: 769	1 KB
3	zemanta.com 3 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 553	2 KB
3	w55c.net 3 redirects pm.w55c.net — Cisco Umbrella Rank: 877	3 KB
3	openx.net 1 redirects ziffdavis-d.openx.net — Cisco Umbrella Rank: 204213 us-u.openx.net — Cisco Umbrella Rank: 481	1 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 164	3 KB
3	sharethrough.com 1 redirects native.sharethrough.com — Cisco Umbrella Rank: 2771 match.sharethrough.com — Cisco Umbrella Rank: 562	228 KB
2	yahoo.com 2 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1358 ups.analytics.yahoo.com — Cisco Umbrella Rank: 325	554 B
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1339	604 B
2	mfadsrvr.com 2 redirects rtb.mfadsrvr.com — Cisco Umbrella Rank: 1087	1 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 565	2 KB
2	360yield.com 2 redirects match.360yield.com — Cisco Umbrella Rank: 2028	813 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 597	1 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 150
2	owneriq.net 2 redirects px.owneriq.net — Cisco Umbrella Rank: 1695	2 KB
2	disqus.com windowsxslive.disqus.com	2 KB
2	postrelease.com a.postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 1201	164 KB
1	adsrvr.org 1 redirects match.adsrvr.org — Cisco Umbrella Rank: 360	492 B
1	krxd.net cdn.krxd.net — Cisco Umbrella Rank: 2856	405 B
1	bkrtx.com tags.bkrtx.com — Cisco Umbrella Rank: 5259	16 KB
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1251	680 B
1	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 798	465 B
1	mediago.io 1 redirects trace.mediago.io — Cisco Umbrella Rank: 1049	452 B
1	media.net 1 redirects cs.media.net — Cisco Umbrella Rank: 1532	1 KB
1	fksnk.com 1 redirects fksnk.com — Cisco Umbrella Rank: 4925	610 B
1	blismedia.com tr.blismedia.com — Cisco Umbrella Rank: 2024	174 B
1	adingo.jp 1 redirects cc.adingo.jp — Cisco Umbrella Rank: 7773	416 B
1	smartadserver.com 1 redirects ssbsync.smartadserver.com — Cisco Umbrella Rank: 814	399 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 800	714 B
1	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 545	3 KB
1	pcmag.com g.pcmag.com — Cisco Umbrella Rank: 82179	280 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 48	79 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1966	1 KB
1	nsstatic.net cdn.nsstatic.net — Cisco Umbrella Rank: 151100	105 KB
1	saftawy.com windowsxlive.saftawy.com	21 KB
0	keywordblocks.com Failed search.keywordblocks.com Failed
0	eyeota.net Failed ps.eyeota.net Failed
0	po.st Failed w.po.st Failed
243	55

	Domain	Requested by
32	cm.g.doubleclick.net	9 redirects 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com googleads.g.doubleclick.net
30	pagead2.googlesyndication.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com pagead2.googlesyndication.com googleads.g.doubleclick.net windowsxlive.saftawy.com tpc.googlesyndication.com www.googletagservices.com securepubads.g.doubleclick.net
26	windowsxlive.net	windowsxlive.saftawy.com
19	tpc.googlesyndication.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com windowsxlive.saftawy.com googleads.g.doubleclick.net tpc.googlesyndication.com securepubads.g.doubleclick.net
10	dsum-sec.casalemedia.com	6 redirects googleads.g.doubleclick.net
9	securepubads.g.doubleclick.net	1 redirects cdn.nsstatic.net securepubads.g.doubleclick.net windowsxlive.saftawy.com www.googletagservices.com
8	img-cdn.clinch.co	realtime.clinch.co
7	s0.2mdn.net	windowsxlive.saftawy.com s0.2mdn.net
6	www.google.com	1 redirects 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com windowsxlive.saftawy.com tpc.googlesyndication.com
6	secure-us.imrworldwide.com	2 redirects secure-us.imrworldwide.com windowsxlive.saftawy.com
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	googleads.g.doubleclick.net	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com pagead2.googlesyndication.com windowsxlive.saftawy.com
5	ib.adnxs.com	2 redirects cdn.nsstatic.net googleads.g.doubleclick.net
5	fonts.gstatic.com	fonts.googleapis.com
5	fonts.googleapis.com	windowsxlive.saftawy.com client securepubads.g.doubleclick.net 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
4	www.googletagservices.com	securepubads.g.doubleclick.net 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
4	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	cdn-gl.imrworldwide.com	windowsxlive.saftawy.com secure-us.imrworldwide.com cdn-gl.imrworldwide.com
4	www.google-analytics.com	windowsxlive.saftawy.com www.google-analytics.com www.googletagmanager.com
3	tags.bluekai.com	stags.bluekai.com
3	cdn.clinch.co	realtime.clinch.co
3	image6.pubmatic.com	3 redirects
3	b1sync.zemanta.com	3 redirects
3	pm.w55c.net	3 redirects
3	pixel.adsafeprotected.com	cdn.nsstatic.net windowsxlive.saftawy.com
3	cdn.static.zdbb.net	cdn.nsstatic.net cdn.static.zdbb.net
3	sb.scorecardresearch.com	1 redirects cdn.nsstatic.net windowsxlive.saftawy.com
3	router.infolinks.com	resources.infolinks.com
2	trk.clinch.co	realtime.clinch.co
2	us-u.openx.net	1 redirects windowsxlive.saftawy.com
2	googleads4.g.doubleclick.net	windowsxlive.saftawy.com
2	sync.teads.tv	1 redirects 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
2	rtb.mfadsrvr.com	2 redirects
2	sync.1rx.io	2 redirects
2	match.360yield.com	2 redirects
2	c1.adform.net	2 redirects
2	www.googleadservices.com	windowsxlive.saftawy.com
2	dt.adsafeprotected.com	windowsxlive.saftawy.com
2	px.owneriq.net	2 redirects
2	static.adsafeprotected.com	pixel.adsafeprotected.com windowsxlive.saftawy.com
2	encrypted-tbn0.gstatic.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
2	gurgle.zdbb.net	windowsxlive.saftawy.com cdn.static.zdbb.net
2	windowsxslive.disqus.com	windowsxlive.net windowsxslive.disqus.com
2	resources.infolinks.com	windowsxlive.saftawy.com
2	native.sharethrough.com	windowsxlive.saftawy.com cdn.nsstatic.net
1	ade.googlesyndication.com
1	ups.analytics.yahoo.com	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	match.adsrvr.org	1 redirects
1	stags.bluekai.com	tags.bkrtx.com
1	cdn.krxd.net	cdn.static.zdbb.net
1	tags.bkrtx.com	cdn.static.zdbb.net
1	jogger.zdbb.net	cdn.static.zdbb.net
1	match.sharethrough.com	1 redirects
1	sync.targeting.unrulymedia.com	1 redirects
1	cms.quantserve.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	trace.mediago.io	1 redirects
1	cs.media.net	1 redirects
1	fksnk.com	1 redirects
1	tr.blismedia.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	realtime.clinch.co	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	cc.adingo.jp	1 redirects
1	ssbsync.smartadserver.com	1 redirects
1	um.simpli.fi	1 redirects
1	encrypted-tbn2.gstatic.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	encrypted-tbn3.gstatic.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	encrypted-tbn1.gstatic.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	www.gstatic.com	63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
1	9wgixs4lne8uceb5vwr9yffkq55wf1693146245.nuid.imrworldwide.com	windowsxlive.saftawy.com
1	bee.imrworldwide.com	secure-us.imrworldwide.com
1	ziffdavis-d.openx.net	cdn.nsstatic.net
1	as-sec.casalemedia.com	cdn.nsstatic.net
1	fastlane.rubiconproject.com	cdn.nsstatic.net
1	zdbb.net	cdn.static.zdbb.net
1	ns.zdbb.net	cdn.nsstatic.net
1	g.pcmag.com	cdn.nsstatic.net
1	www.googletagmanager.com	www.google-analytics.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	secure.gravatar.com	windowsxlive.saftawy.com
1	jadserve.postrelease.com	a.postrelease.com
1	a.postrelease.com	windowsxlive.saftawy.com
1	cdn.nsstatic.net	windowsxlive.saftawy.com
1	windowsxlive.saftawy.com
0	search.keywordblocks.com Failed	securepubads.g.doubleclick.net
0	ps.eyeota.net Failed	windowsxlive.saftawy.com
0	w.po.st Failed	windowsxlive.saftawy.com
243	86

This site contains links to these domains. Also see Links.

Domain
windowsxlive.net
thememypc.net
www.wpbeginner.com
www.facebook.com
www.twitter.com
www.windowsxlive.net

Subject Issuer	Validity	Valid
thememypc.net R3	`2023-07-04` - `2023-10-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
www.ziffdavis.com COMODO RSA Organization Validation Secure Server CA	`2023-07-27` - `2024-07-26`	a year	crt.sh
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1	`2023-05-16` - `2024-05-15`	a year	crt.sh
*.sharethrough.com Amazon RSA 2048 M01	`2023-06-14` - `2024-07-12`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-15` - `2024-05-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.postrelease.com Amazon RSA 2048 M01	`2023-03-01` - `2023-12-25`	10 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-13` - `2024-04-20`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.scorecardresearch.com Sectigo RSA Domain Validation Secure Server CA	`2022-12-15` - `2023-12-28`	a year	crt.sh
*.zdbb.net Amazon RSA 2048 M01	`2023-03-06` - `2024-04-03`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
casalemedia.com Cloudflare Inc ECC CA-3	`2023-05-21` - `2024-05-20`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M01	`2023-03-29` - `2024-04-27`	a year	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-03` - `2024-02-03`	a year	crt.sh
*.nuid.imrworldwide.com Amazon RSA 2048 M01	`2023-04-12` - `2024-05-10`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M01	`2023-05-09` - `2024-06-06`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.clinch.co Amazon ECDSA 256 M01	`2023-03-27` - `2024-04-24`	a year	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-08-07` - `2023-11-05`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.bkrtx.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-18` - `2024-01-17`	a year	crt.sh
cdn.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-02-09`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
odc-pixel-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-07` - `2024-02-08`	a year	crt.sh

This page contains 26 frames:

Primary Page: https://windowsxlive.saftawy.com/
Frame ID: 8A6CA97C8DA6331401B4EE921C4D66A4
Requests: 90 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=8259&wsid=0&pdom=windowsxlive.saftawy.com&purl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F
Frame ID: 54F6C142D8E0A248002F2732DE43F4B9
Requests: 1 HTTP requests in this frame

Frame: https://secure-us.imrworldwide.com/storageframe.html
Frame ID: 8B6460904C2C2F01D43A293A8FDC43E7
Requests: 1 HTTP requests in this frame

Frame: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 4BB53D78278B1C514567F44F478D9B81
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 9EC0774E6E78C187DBBFCC96A292B64D
Requests: 3 HTTP requests in this frame

Frame: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C9D25A57CF09470CA228185486DAB994
Requests: 21 HTTP requests in this frame

Frame: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 913DE3E28C357D469CFBC06C696AF638
Requests: 18 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=7529&campId=160x600&pubId=25294052&chanId=188820212&placementId=44261492&pubCreative=54414788972&pubOrder=129093572&cb=549555660&adsafe_par&impId=
Frame ID: 396D9B9217F3A56A3666B78197EBAEC1
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv133HKmtWbJVY2NcnUyJ-nD7Xg6RgZTd1c-vG0hQg1fmTZpew9iqBiBHXg8spp5f-fUqVOexX7hSsHHCs96py1KuiQ374fnsE8XIxkqnzEqKnyyKHfWDyJyAukGvGaB82tFCwHg4zKP2Z633SyLfQyXyfdCjpOpdqFeldNs7HB9X1lMSqLR_mGFHbbwHI0nJrzwBmyp0pK6U9YNih6qsiOr-gvrz9yB2-YjrIFrINaPfAP0WjSNkdNGDMoSPKO5so3YxzE60TqumZnYCJZeD8n-FhlVrmKVEaYCEnjyDb4szHrTZBhh3DFSJj3bvC3iv431Cgbu97-st0KndGtf4o_s20v154&sai=AMfl-YTW4vczyzL8VtJVJgQgDHqRPGA6q9rQubzwpJXWWnVQ-7qW05DVcL7ecCo9m5BDXOKMm23wansml48y4llwBLCxfr69y0eWdyqTTg96qo5Ovu3T03yhdbDt9AV7MA&sig=Cg0ArKJSzEgY0VeXl6ghEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 5F36674EFD8F3837E464FE61D357F384
Requests: 5 HTTP requests in this frame

Frame: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 54C20C965C471B8BCE850CFA78332ED4
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSckNwEEMnO-vAEGMLC4O0BMAE&v=APEucNVBBv70yisfPqz5c9rEw_JqQC_CXpCAsC3B6QEpSzAiGGV0iQ6-eLQJV7ebiRRPtk5HodvrmMxkp8EAsA71g6HFz2C_nQ
Frame ID: ADCA521364288C82145D55C0C1D3CD0A
Requests: 5 HTTP requests in this frame

Frame: data://truncated
Frame ID: 14CE2252DF244AFCA8318E5BEBAAFD45
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012307272333000/amp4ads-v0.mjs
Frame ID: 2B5311391FCF6D0BB975DE0C2B2B0212
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0500309292A3A7202B66E108CDAC42D2
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN2JswIQ7J7MAhir6a7zATAB&v=APEucNVMP3buThg4DqNbL9BG_GwV7J-_H6LGaGH4RflEzEdFX8VaJBKAf6p1G0RSjYxRAhL6MGFqXt3Fw3gzSvahucCXDS1Tcg
Frame ID: 1A0123A280BEA760886AD6030D587FE9
Requests: 5 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: DA51E6A86CDBB97EDA5C158C205CA77B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0FEC6B6A5E4A0D33FA6554CE08E3E199
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js
Frame ID: 04F9ED89250F7C571EB2F292D6692419
Requests: 1 HTTP requests in this frame

Frame: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Frame ID: D2823D489A5A6593FF7C238944646910
Requests: 14 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0D9462368CC16F065EF770094F8B71A4
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 1FC11E5005960F5C16D86E2B85E7A6A2
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 985E1CAAD96F28FAC0F089100A368DE2
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250
Frame ID: 6F0897C09C7EC92F087DD1821E73696C
Requests: 7 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: EBB61E2E29885839C8A784CE2F373EE6
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 9C60EA434930548EB234A1BF0D0AC20C
Requests: 2 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dwindowsxlive.saftawy.com&phint=referer%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=bbseg%3D1100034&phint=bbseg%3D900492&phint=bbseg%3D900111&phint=bbseg%3D6929&phint=bbseg%3D900115&phint=bbseg%3D6816&phint=bbseg%3D6817&phint=bbseg%3D900002&phint=bbseg%3D6947&phint=bbseg%3D900387&phint=bbseg%3D6823&phint=bbseg%3D900263&phint=bbseg%3D6825&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D6831&phint=bbseg%3D6833&phint=bbseg%3D6834&phint=bbseg%3D1100095&phint=bbseg%3D6848&phint=bbseg%3D1100482&phint=bbseg%3D900163&phint=bbseg%3D900171&phint=bbseg%3D6867&phint=bbseg%3D900189&phint=bbseg%3D1200482&phint=bbseg%3D6886&phint=bbseg%3D900455&phint=bbseg%3D900331&phint=bbseg%3D1100015&phint=bbseg%3D900207&phint=__bk_t%3DWindows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&phint=__bk_k%3Dwindows%2010%2C%20mac%2C%20os%20x%20el%20capitan%2C%20windows%2010%20theme%2C%20windows%208%20theme%2C%20windows%208%20customization%2C%20mac%20theme%2C%20mac%20customization%2C%20download%2C%20windows%20xp%2C%20windows%207%2C%20windows%208%2C%20windows%208.1%2C%20theme%2C%20transformation%2C%20customization%2C%20pack%2C%20news%2C%20review%2C%20ux%2C%20windows%2C%20apple%2C%20os%20x%20yosemite%2C%20os%20x%20mavericks%2C%20mavericks%2C%20lion%2C%20transformation%20pack%2C%20uxtheme%2C%20patcher%2C%20aero%2C%20glass%2C%20windows%20x%2C%20speed%20up%2C%20faster%2C%20livetuner%2C%20optimization%2C%20optimizer%2C%20optimizer%20xp%2C%20performance%2C%20tuner%2C%20tuning%2C%20tweak&phint=__bk_l%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=39506220
Frame ID: C265C10FDD6735B2F23FB78B5F180017
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Windows X's Live – Bringing the best Windows 10 and OS X El Capitan user experience to everyone

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Lightbox (JavaScript Libraries) Expand

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

243
Requests

83 %
HTTPS

36 %
IPv6

55
Domains

86
Subdomains

53
IPs

5
Countries

3070 kB
Transfer

8007 kB
Size

90
Cookies

75 Outgoing links

These are links going to different origins than the main page.

URL: https://windowsxlive.net/
Title: Windows X's Live

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/category/os-customization/
Title: OS Customization

Search URL Search Domain Scan URL

URL: https://thememypc.net/
Title: Download Transformation/UX Packs

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/category/news/
Title: News

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/category/utilities/
Title: Utilities

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/category/mobile/
Title: Mobile

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/about-us/
Title: About Us

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-11-ux-pack-1-0-released-safest-way-to-enjoy-windows-11-user-experience-on-windows-10/
Title: Windows 11 UX Pack 1.0 Released – Safest way to enjoy Windows 11 user experience on Windows 10

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-11-ux-pack-1-0-released-safest-way-to-enjoy-windows-11-user-experience-on-windows-10/#more-1083
Title: Continue reading “Windows 11 UX Pack 1.0 Released – Safest way to enjoy Windows 11 user experience on Windows 10”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/author/admin/
Title: Windows X

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-11-ux-pack-1-0-released-safest-way-to-enjoy-windows-11-user-experience-on-windows-10/#disqus_thread
Title: 8 Comments

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-transformation-ux-pack-5-0-released-windows-10-compatibility-fixes-with-new-wallpapers/
Title: macOS Transformation/UX Pack 5.0 Released – Windows 10 compatibility fixes with new wallpapers

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-transformation-ux-pack-5-0-released-windows-10-compatibility-fixes-with-new-wallpapers/#more-961
Title: Continue reading “macOS Transformation/UX Pack 5.0 Released – Windows 10 compatibility fixes with new wallpapers”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-transformation-ux-pack-5-0-released-windows-10-compatibility-fixes-with-new-wallpapers/#disqus_thread
Title: 8 Comments

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-transformationux-pack-7-0-released-anniversary-update-is-here/
Title: Windows 10 Transformation/UX Pack 7.0 Released – Anniversary Update is here

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-transformationux-pack-7-0-released-anniversary-update-is-here/#more-871
Title: Continue reading “Windows 10 Transformation/UX Pack 7.0 Released – Anniversary Update is here”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/10tp/
Title: 10TP

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/10uxp/
Title: 10UXP

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/customization/
Title: customization

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/metro/
Title: Metro

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/microsoft/
Title: Microsoft

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/pack/
Title: pack

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/skin/
Title: skin

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/theme/
Title: theme

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/transformation/
Title: transformation

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/ux/
Title: UX

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/windows/
Title: Windows

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/windows-10/
Title: Windows 10

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/windows-10-transformation-pack/
Title: Windows 10 Transformation Pack

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/tag/windows-10-ux-pack/
Title: Windows 10 UX Pack

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-transformationux-pack-7-0-released-anniversary-update-is-here/#disqus_thread
Title: 14 Comments

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/how-to-speed-up-your-business-internet/
Title: How To Speed Up Your Business Internet?

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/how-to-speed-up-your-business-internet/#more-1125
Title: Continue reading “How To Speed Up Your Business Internet?”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/author/boris/
Title: Boris Zegarac

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/the-benefits-of-renting-a-car-with-chauffeur-in-germany/
Title: The Benefits of Renting a Car with Chauffeur in Germany

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/the-benefits-of-renting-a-car-with-chauffeur-in-germany/#more-1123
Title: Continue reading “The Benefits of Renting a Car with Chauffeur in Germany”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/web-development-trends-for-2023/
Title: Web Development Trends for 2023

Search URL Search Domain Scan URL

URL: https://www.wpbeginner.com/research/web-design-industry-statistics-and-latest-trends/#:~:text=In%20the%20second%20quarter%20of,why%20visitors%20leave%20a%20website.
Title: 58% of global website traffic

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/web-development-trends-for-2023/#more-1119
Title: Continue reading “Web Development Trends for 2023”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/a-guide-to-building-a-business-app/
Title: A Guide To Building A Business App

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/a-guide-to-building-a-business-app/#more-1116
Title: Continue reading “A Guide To Building A Business App”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/4-apps-to-decorate-your-house-in-augmented-reality/
Title: 4 apps to decorate your house in augmented reality

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/4-apps-to-decorate-your-house-in-augmented-reality/#more-1113
Title: Continue reading “4 apps to decorate your house in augmented reality”

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/page/2/
Title: Page 2

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/page/60/
Title: Page 60

Search URL Search Domain Scan URL

URL: http://www.facebook.com/windowsxlive

Search URL Search Domain Scan URL

URL: http://www.twitter.com/windowsx

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-transformationux-pack-7-0-released-anniversary-update-is-here/#comment-10915
Title: Windows 10 Transformation/UX Pack 7.0 Released – Anniversary Update is here

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/el-capitan-ux-patcher-fixes-theme-engine-hack-installation-failure-in-windows-10/#comment-10914
Title: El Capitan UX Patcher – Fixes theme engine hack installation failure in Windows 10

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-ux-pack/#comment-10913
Title: Windows 10 UX Pack 7.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-transformationux-pack-4-0-released-support-all-windows-10-versions-with-bugs-resolved/#comment-10912
Title: macOS Transformation/UX Pack 4.0 Released – Support all Windows 10 versions with bugs resolved

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-transformationux-pack-4-0-released-support-all-windows-10-versions-with-bugs-resolved/#comment-10911
Title: macOS Transformation/UX Pack 4.0 Released – Support all Windows 10 versions with bugs resolved

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/fidelizer/
Title: Fidelizer

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/lion-transformation-pack/
Title: Lion Transformation Pack 1.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/lion-ux-pack/
Title: Lion UX Pack 1.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/livetuner/
Title: LiveTuner 4.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-transformation-pack/
Title: macOS Transformation Pack 5.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/macos-ux-pack/
Title: macOS UX Pack 5.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/os-x-mavericks-transformation-pack/
Title: OS X Mavericks Transformation Pack 3.1

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/os-x-mavericks-ux-pack/
Title: OS X Mavericks UX Pack 3.1

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/seven-transformation-pack/
Title: Seven Transformation Pack 5.1

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/snow-transformation-pack/
Title: Snow Transformation Pack 1.5

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/uxtheme-multi-patcher/
Title: UXTheme Multi-Patcher 15.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/vifind/
Title: ViFind

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/vista-transformation-pack/
Title: Vista Transformation Pack 9.0.1

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-transformation-pack/
Title: Windows 10 Transformation Pack 7.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-10-ux-pack/
Title: Windows 10 UX Pack 7.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-11-ux-pack/
Title: Windows 11 UX Pack

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-8-transformation-pack/
Title: Windows 8 Transformation Pack 9.1

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/windows-8-ux-pack/
Title: Windows 8 UX Pack 9.1

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/yosemite-transformation-pack/
Title: Yosemite Transformation Pack 4.0

Search URL Search Domain Scan URL

URL: https://windowsxlive.net/yosemite-ux-pack/
Title: Yosemite UX Pack 4.0

Search URL Search Domain Scan URL

URL: https://www.windowsxlive.net/
Title: Windows X's Live

Search URL Search Domain Scan URL

URL: https://www.windowsxlive.net/about-us/
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.windowsxlive.net/privacy/
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

https://secure-us.imrworldwide.com/v60.js HTTP 301
https://cdn-gl.imrworldwide.com/v60.js

Request Chain 60

https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?additionalInformation=&cms_page_id=&local_uid=&referrer=&zd_pageview_id=e63eada2-6e88-426b-80e5-7cb3e608ebcd&zd_session_id=5e26014c-637f-45c6-b5f7-bfcc6ad3c6f9&zd_location=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&evidon_consent=undefined&third_party_consent=&fu=true&ppid=596c1b2487b54888839a91a0750f662b HTTP 303
https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?additionalInformation=&cms_page_id=&local_uid=&referrer=&zd_pageview_id=e63eada2-6e88-426b-80e5-7cb3e608ebcd&zd_session_id=5e26014c-637f-45c6-b5f7-bfcc6ad3c6f9&zd_location=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&evidon_consent=undefined&third_party_consent=&fu=true&ppid=596c1b2487b54888839a91a0750f662b&_cc=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=ziffdavis_dmp&google_cm&google_hm=NTk2YzFiMjQ4N2I1NDg4ODgzOWE5MWEwNzUwZjY2MmI= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ziffdavis_dmp&google_cm=&google_hm=NTk2YzFiMjQ4N2I1NDg4ODgzOWE5MWEwNzUwZjY2MmI=&google_tc= HTTP 302
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?google_gid=CAESEMn9RoxMb5CvX1tSPT2UVs0&google_cver=1 HTTP 303
https://aa.agkn.com/adscores/g.pixel?sid=9212302198 HTTP 302
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=neusbftgslopjfixorwbst&tpc=hf%2B2givALZlA2MyUkBwwM91PbwUbNV1FPqmISYjX2i0%3D HTTP 303
https://stags.bluekai.com/site/31875?limit=0&id=596c1b2487b54888839a91a0750f662b&redir=https%3A//zdbb.net/l/qI109lRAEeGCiBIxORcFRw/%3Ftp%3Dbkcsbftodcapjfixorcfrw%26tpc%3D%24_BK_UUID HTTP 302
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=bkcsbftodcapjfixorcfrw&tpc=$_BK_UUID HTTP 303
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pexu87e&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pexu87e&ttd_tpi=1 HTTP 302
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=lk45j3o5TTDlkj35h3g4&tpc=b63acc23-5e25-44ec-82bb-fa25cc39cfd3 HTTP 303
https://match.prod.bidr.io/cookie-sync/spiceworks2?buyer_user_id=596c1b2487b54888839a91a0750f662b HTTP 303
https://match.prod.bidr.io/cookie-sync/spiceworks2?buyer_user_id=596c1b2487b54888839a91a0750f662b&_bee_ppp=1 HTTP 303
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=kh4u2bm23bbewk4h35&tpc=AAAyoU7J1rkAACYsVV_yHA HTTP 303
https://dpm.demdex.net/ibs:dpid=266306&dpuuid=596c1b2487b54888839a91a0750f662b&redir=https%3A//zdbb.net/l/qI109lRAEeGCiBIxORcFRw/%3Ftp%3Daamipowqlssjirtmmlknrp%26tpc%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=266306&dpuuid=596c1b2487b54888839a91a0750f662b&redir=https%3A//zdbb.net/l/qI109lRAEeGCiBIxORcFRw/%3Ftp%3Daamipowqlssjirtmmlknrp%26tpc%3D%24%7BDD_UUID%7D HTTP 302
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=aamipowqlssjirtmmlknrp&tpc=16517465780325121254070302540021926316 HTTP 303
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fzdbb.net%2Fl%2FqI109lRAEeGCiBIxORcFRw%2F%3Ftp%3Dpubgwejkldsfjdflkslpoww%26tpc%3D%23PM_USER_ID HTTP 302
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=pubgwejkldsfjdflkslpoww&tpc=6230F9F1-7335-4158-84FF-01580FA7F598 HTTP 303
https://ps.eyeota.net/pixel?pid=mla6m40&t=gif

Request Chain 61

https://sb.scorecardresearch.com/b?c1=8&c2=6036316&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1693146243849&ns_c=UTF-8&c3=1&c7=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c8=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1693146243849&ns_c=UTF-8&c3=1&c7=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c8=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&c9=

Request Chain 74

https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1693146244766&ci=ziffdavis&js=1&cg=0&ts=infolinks_main.js&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&sr=1600x1200&id=lstrg-1c77853b696b264b2aeeb9203ca76be0&tz=-10 HTTP 302
https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1693146244766&ci=ziffdavis&js=1&cg=0&ts=infolinks_main.js&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&sr=1600x1200&id=lstrg-1c77853b696b264b2aeeb9203ca76be0&tz=-10&ja=1

Request Chain 132

https://px.owneriq.net/ecmg?google_gid=CAESELC6JZQufca-T6OSGJ15CHo&google_cver=1&google_push=AXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp%26google_cver%3d1%26google_gid%3dCAESELC6JZQufca-T6OSGJ15CHo%26google_hm%3dUTc0NjQzMjY0NjE1NDgxNjUwNDc%3d&uid=Q7464326461548165047&ref=%2Fecmg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp&google_cver=1&google_gid=CAESELC6JZQufca-T6OSGJ15CHo&google_hm=UTc0NjQzMjY0NjE1NDgxNjUwNDc=

Request Chain 133

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmRJK-UywWo2qPUuXuUDt6fj_azqixUyH26xjhYCmuIOFg4So3aP3W-7eZDPl36e0F8sjEF5VShehvOWgWvz2QDJMgzCKEL2 HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmRJK-UywWo2qPUuXuUDt6fj_azqixUyH26xjhYCmuIOFg4So3aP3W-7eZDPl36e0F8sjEF5VShehvOWgWvz2QDJMgzCKEL2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmRJK-UywWo2qPUuXuUDt6fj_azqixUyH26xjhYCmuIOFg4So3aP3W-7eZDPl36e0F8sjEF5VShehvOWgWvz2QDJMgzCKEL2

Request Chain 134

https://um.simpli.fi/gp_match?google_gid=CAESEE_9PctX8fWbxN4eZanoqPU&google_cver=1&google_push=AXcoOmS-kzkAW5Djhzu0Q1rWLvLsiK8HHcSS6OEyuWLsBU-2WMU_XSQopz-2leBqRT8C3uVBIZW-X5QZCMGR4X-MxRJbUZvVAAt_ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CC62689BB1534F359EF2A228B8FA6803&google_push=AXcoOmS-kzkAW5Djhzu0Q1rWLvLsiK8HHcSS6OEyuWLsBU-2WMU_XSQopz-2leBqRT8C3uVBIZW-X5QZCMGR4X-MxRJbUZvVAAt_

Request Chain 135

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEJtpij3zmHcswjLc6OUqyqs&google_cver=1&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NYGzWHqSjwWStlq9t HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEJtpij3zmHcswjLc6OUqyqs&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NYGzWHqSjwWStlq9t&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NYGzWHqSjwWStlq9t&google_hm=eEtPdEx3QkhSQjNfV3drNlN6MGI=

Request Chain 136

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJ9yYsfoOmRt8ww6ytqgcJk&google_cver=1&google_push=AXcoOmR77H8W-DJl2YSYZoXJ6-Qq1oy3112hUik6dvPvHuxTaaz5LRnsPQbMgawJ1ON2KCysZVhXxGrGKRhTks0C91FVNthcvlan HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJ9yYsfoOmRt8ww6ytqgcJk&google_cver=1&google_push=AXcoOmR77H8W-DJl2YSYZoXJ6-Qq1oy3112hUik6dvPvHuxTaaz5LRnsPQbMgawJ1ON2KCysZVhXxGrGKRhTks0C91FVNthcvlan&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmR77H8W-DJl2YSYZoXJ6-Qq1oy3112hUik6dvPvHuxTaaz5LRnsPQbMgawJ1ON2KCysZVhXxGrGKRhTks0C91FVNthcvlan

Request Chain 137

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEK3G7mHcYmmZ32RE6z3jdy4&google_cver=1&google_push=AXcoOmT0Y2hQXtAaCFsUpy_uuc8LqkU-KVcg5LdJkpuE90dTmwmYhp6LxRj7jsBODLdjFQN9P6BNski4oU0A3B-AQXz-cpffHlqO HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmT0Y2hQXtAaCFsUpy_uuc8LqkU-KVcg5LdJkpuE90dTmwmYhp6LxRj7jsBODLdjFQN9P6BNski4oU0A3B-AQXz-cpffHlqO&google_hm=MjE2NTA2NjkwNTQzMjMxMDAx

Request Chain 138

https://cc.adingo.jp/adx/push/?google_gid=CAESEB1ShcsI5p11PZNIe26cFjA&google_cver=1&google_push=AXcoOmQv-llc0U4q4dfYXJkno4XrV8bVfTVxAu0kEkA6cJUI_fKre0rMARlVpsjVoReMHdzWBgEUXolpqCP3oeCGt18Yz9tOlPNf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmQv-llc0U4q4dfYXJkno4XrV8bVfTVxAu0kEkA6cJUI_fKre0rMARlVpsjVoReMHdzWBgEUXolpqCP3oeCGt18Yz9tOlPNf&google_hm=cb2524cd04f0865c2d6fc3255a792a88

Request Chain 140

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1

Request Chain 141

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZOtchvwmdzIifd8VY0TdywAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1

Request Chain 142

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1

Request Chain 143

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D

Request Chain 145

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1

Request Chain 146

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZOtchvwmdzIifd8VY0TdywAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1

Request Chain 147

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1

Request Chain 148

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D

Request Chain 159

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 171

https://securepubads.g.doubleclick.net/pagead/adview?ai=CMCUkhFzrZLyuOJyxoPwPhNysqAW9tr2scq6Iq93gEYug6uCpMBABIOXP6xZgyYaAgNyjxBCgAZeJypoDyAEJ4AIAqAMByAPLBKoE_AFP0Frw7MupqMXYivOrMwte77Lk0yUearDfeRFYY9ZKsv6mzTNh7SGc1fEASJVlH5NzNxGQO4-v9Mm6buzeanvlHZKvqFIe7AHkSruSIetXv-d_VAgxMRmX9BZRPLw13-IvuYeNXyVsB28ZCKgwhh28MuHV3IH-aTafNrejUshGjbvrtMFxyYDwtIorHY2HBU8PLjO59kha1udEKYCRuEoQVEBtNh2gfYjH_XhRIEone1j2_qTRVkb7H3L6k5gg_tBr-Otyha4TJgwJncECYDHKeOH_ahY0NMNmIsaEYZ0W7U9PIxGZWYyPzVJeBw7vhBXphLxu_2QvowobEg_ABMuz8tf_A-AEAYgFr9Puz0CSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH0fa1ZagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAPIHBBDyvTLSCBQIgGEQARgdMgKKAjoCgEBIvf3BOpoJFGh0dHBzOi8vcmhvYmFjay5jb20vgAoDyAsB2gwRCgsQ0I6-7db5ka-OARICAQPYEwvQFQGYFgGAFwGyFx4KHAgAEhRwdWItMzI3OTg3Mzc2MzM4ODkxNBiknRA&sigh=OVM4dmlnL8I&uach_m=[UACH]&ase=2&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&template_id=494&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xe21c5b6ab69a69e20000000000000000%22,%222%22:%220x88e6876a9cc42a520000000000000000%22,%223%22:%220xc7ce27825322bfde0000000000000000%22,%224%22:%220x88d94216d7b1acc00000000000000000%22,%225%22:%220x6c3750fcf65893bf0000000000000000%22},%22debug_key%22:%2216651490904284972302%22,%22debug_reporting%22:true,%22destination%22:%22https://rhoback.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22861045911%22],%224%22:[%2208-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224602709718900259025%22}&andc=true

Request Chain 181

https://fksnk.com/cs/google?google_gid=CAESECPlx2WXx_k6ABK9O01d_nc&google_cver=1&google_push=AXcoOmQ_EeaBRi9Ovz-qou7dxciRfKudf0mWQO1C11IZ_Xu-cmZ7lco-gpdav0712BHGA73NPkELvKwwFgU-T74_L7sfp71VgGez HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MEFBQzI1ODQxN0FDQjE1MA==

Request Chain 182

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEM-g1KBSi3p0VFfPkVTyz0I&google_cver=1&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT6nusd8h6BSdn_MsDnZ7ul7 HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEM-g1KBSi3p0VFfPkVTyz0I&google_cver=1&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT6nusd8h6BSdn_MsDnZ7ul7 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgxNjE0NDk2Njg1MTg2OTYyMw&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT6nusd8h6BSdn_MsDnZ7ul7

Request Chain 183

https://match.360yield.com/match/ebda?google_gid=CAESEKzhtuVpk5fEwY51-_dzKH8&google_cver=1&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJUwENv467zOSw HTTP 302
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEKzhtuVpk5fEwY51-_dzKH8&google_cver=1&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJUwENv467zOSw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=L9gaFJdcSIWNAxKkv0b-7g&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJUwENv467zOSw

Request Chain 184

https://cs.media.net/cksync?type=g&google_gid=CAESEF2dnPIHI-V-KZGPIFqL0hU&google_cver=1&google_push=AXcoOmTjJgAX_YJ9ilVzIG2mjArPMUuIv25O-v_01v50Iv3EuDnjddkVaU8JT370v6cN9WYSVJzoG3Nc1_O_Oey2ruWbgWsaWdU HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&mn_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTjJgAX_YJ9ilVzIG2mjArPMUuIv25O-v_01v50Iv3EuDnjddkVaU8JT370v6cN9WYSVJzoG3Nc1_O_Oey2ruWbgWsaWdU&gdpr=&gdpr_consent=

Request Chain 185

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEAuYLFUDMKsDRI617Nzgn8U&google_cver=1&google_push=AXcoOmQeJXxZ6LbPX60dwm6Dh0CLMRhsmeXjaO06vn8rElSgVsrlrrY8Xy-R-Xi_1ZqJI37CJ7cWyPwhQy76N0Xj6rFG5iXB2puraQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQeJXxZ6LbPX60dwm6Dh0CLMRhsmeXjaO06vn8rElSgVsrlrrY8Xy-R-Xi_1ZqJI37CJ7cWyPwhQy76N0Xj6rFG5iXB2puraQ&google_hm=eEtPdEx3QkhSQjNfV3drNlN6MGI=

Request Chain 186

https://trace.mediago.io/cs/google?google_gid=CAESEENuSalujrTphHp7AooAbCE&google_cver=1&google_push=AXcoOmSiOQibDZVNHNjXicm_7uOAC3-9NBikfZIBVTpalCr85a_mYj7c4J6JFPlRzI7Nf1WMtGM7suchyFpZZSA0GWR0kz815bNIHg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSiOQibDZVNHNjXicm_7uOAC3-9NBikfZIBVTpalCr85a_mYj7c4J6JFPlRzI7Nf1WMtGM7suchyFpZZSA0GWR0kz815bNIHg&google_hm=bbce98103257336f0b10f0bbe93aff34

Request Chain 191

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmSpvRCXgEYXmDeoRFaLynwWfB4RGTGjqvX6IjDEObQCtalISdphuHJlDAFK-fjxhrOZsTcMwhPO3lvBV95UBZOpmWMhv5A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmSpvRCXgEYXmDeoRFaLynwWfB4RGTGjqvX6IjDEObQCtalISdphuHJlDAFK-fjxhrOZsTcMwhPO3lvBV95UBZOpmWMhv5A

Request Chain 192

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEJ9yYsfoOmRt8ww6ytqgcJk&google_cver=1&google_push=AXcoOmS2huX8kHPT1zhU04IJ6V3btMhTOaRAx854OzBhfzhRlqpHjJ3IoopYRbmOxAxMERE2AZspitQf8A_a5Q4q2ib5ilsN5Eei HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS2huX8kHPT1zhU04IJ6V3btMhTOaRAx854OzBhfzhRlqpHjJ3IoopYRbmOxAxMERE2AZspitQf8A_a5Q4q2ib5ilsN5Eei

Request Chain 193

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEFsJS1X-VUIYyS8ZBaEGc9E&google_cver=1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5 HTTP 302
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1693146247625 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-d7032288-63a6-4bd1-a77f-814159b8a9c4-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5%26google_hm%3DBdcDIohjpkvRp3-BQVm4qcQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5&google_hm=BdcDIohjpkvRp3-BQVm4qcQ

Request Chain 194

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESEPSgpNBwa6AVVerLVh4myZQ&google_cver=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26XmEPzhrc1vSPeEMhXJ116JRIPBWX0gTAbw HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESEPSgpNBwa6AVVerLVh4myZQ&google_cver=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26XmEPzhrc1vSPeEMhXJ116JRIPBWX0gTAbw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=c24AmxjYQl6iN4KNU0lAuQ==&no_redirect=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26XmEPzhrc1vSPeEMhXJ116JRIPBWX0gTAbw

Request Chain 195

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESECjQai0LjX0XPO2kdi202no&google_cver=1&google_push=AXcoOmTJU1MTH3fxRiPWz9FP1CwLm4pqt1rMD6nP03LhucPn-XqZdFdrDIXXa1XD8FTDZCOFK6wLqUmC6LGjzT21Tf3PsSfWKkY2KA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZGRiYjMyY2YtMzRmOC00ZDZjLWI0YzktZTQyYmY0YjA2MmY4&google_push=AXcoOmTJU1MTH3fxRiPWz9FP1CwLm4pqt1rMD6nP03LhucPn-XqZdFdrDIXXa1XD8FTDZCOFK6wLqUmC6LGjzT21Tf3PsSfWKkY2KA

Request Chain 196

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEG2ON1aEvzoWwzdEESuV6kU&google_cver=1&google_push=AXcoOmQbRIGDshHfnJJFhwBQuPD7OQRJWsmEDmZQE1jCwuu8ZyPzRAsz054Aycrw2nmyFLrSHwzn30x65Oot7xvPXk90YfxuiI71tQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=NGQwNmZmZjYtY2Q2My00NmEyLWE2YTItYzVkOTI1ZmI1MzQ1&google_push=AXcoOmQbRIGDshHfnJJFhwBQuPD7OQRJWsmEDmZQE1jCwuu8ZyPzRAsz054Aycrw2nmyFLrSHwzn30x65Oot7xvPXk90YfxuiI71tQ HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 207

https://us-u.openx.net/w/1.0/pd?plm=6&ph=dc423def-06ad-4fb4-a386-363c0a8315a3&gdpr=0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGMIdo-xyTtnLeLyS7SudUM&google_cver=1

Request Chain 244

https://cm.g.doubleclick.net/pixel?google_nid=bluekai&google_cm&google_sc&google_hm=Z1RoemUwamw5OTlRUEkrQQ%3D%3D HTTP 302
https://tags.bluekai.com/site/2981?id=&google_gid=CAESEBNygMp8u18yF1EUCOu5mnE&google_cver=1

Request Chain 245

https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://tags.bluekai.com/site/5386?id=b63acc23-5e25-44ec-82bb-fa25cc39cfd3&gdpr=0&gdpr_consent=

Request Chain 246

https://cms.analytics.yahoo.com/cms?partner_id=BLKAI HTTP 302
https://ups.analytics.yahoo.com/ups/58739/cms?partner_id=BLKAI HTTP 302
https://tags.bluekai.com/site/19505?id=y-gZThhsBE2pKhg.ZvZAnqlWon3tYg9mbCWX0-~A

243 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
windowsxlive.saftawy.com/ 61 KB
21 KB 457ms
233ms Document
text/html 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: b539aa567737502e514c07c10b6aac24bf529773c73242e1dcd73d195b0d9148

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 27 Aug 2023 14:24:02 GMT
link: <https://windowsxlive.saftawy.com/wp-json/>; rel="https://api.w.org/"
server: Apache
vary: Accept-Encoding,Cookie

GET
H2 200 style.min.css
windowsxlive.net/wp-includes/css/dist/block-library/ 102 KB
19 KB 130ms
58ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-includes/css/dist/block-library/style.min.css?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Aug 2023 16:58:51 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 disqus_rcw.css
windowsxlive.net/wp-content/plugins/disqus-recent-comments-widget/ 881 B
401 B 223ms
152ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/disqus-recent-comments-widget/disqus_rcw.css?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 865b01752fdbd28411769343be9b09b8d7626efb9f81dc4efbe0be082e8d2a2c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 369

GET
H2 200 nivo-lightbox.css
windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/nivo-lightbox/ 6 KB
1 KB 225ms
153ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/nivo-lightbox/nivo-lightbox.css?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: cca4f37b4a4385ecdf4190c9f2be8e2ded15b5ed018bc04d4f63dd42c2eaf2fc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Dec 2020 07:16:22 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1170

GET
H2 200 default.css
windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/nivo-lightbox/themes/default/ 3 KB
884 B 224ms
152ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/nivo-lightbox/themes/default/default.css?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: d9ecacf0e4adcba3a7b7dfa57becbc921434053158e57401578818ab40bab332

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Dec 2020 07:16:22 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 852

GET
H2 200 css
fonts.googleapis.com/ 15 KB
1 KB 257ms
95ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Merriweather%3A400%2C700%2C900%2C400italic%2C700italic%2C900italic%7CMontserrat%3A400%2C700%7CInconsolata%3A400&subset=latin%2Clatin-ext

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e714852f3b82bb509bcee07036e4663506b0d7389d9f02cbb2b0cc7523b8e094

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 27 Aug 2023 13:17:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 27 Aug 2023 14:24:02 GMT

GET
H2 200 genericons.css
windowsxlive.net/wp-content/themes/twentysixteen/genericons/ 28 KB
16 KB 130ms
59ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/themes/twentysixteen/genericons/genericons.css?ver=3.4.1
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/css

GET
H2 200 style.css
windowsxlive.net/wp-content/themes/twentysixteen/ 52 KB
16 KB 224ms
153ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/themes/twentysixteen/style.css?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: dd5493d72c92e81a1e612241012ccb48a8e2d285af3d3319cb55528b313340ca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 16081

GET
H2 200 jquery.min.js Show response
windowsxlive.net/wp-includes/js/jquery/ 85 KB
37 KB 225ms
154ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-includes/js/jquery/jquery.min.js?ver=3.7.0
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Aug 2023 16:58:51 GMT
server: Apache
accept-ranges: bytes
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery-migrate.min.js Show response
windowsxlive.net/wp-includes/js/jquery/ 13 KB
5 KB 268ms
197ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Aug 2023 16:58:51 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 5422

GET
H2 200 nivo-lightbox.min.js Show response
windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/nivo-lightbox/ 7 KB
3 KB 223ms
153ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/nivo-lightbox/nivo-lightbox.min.js?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 610b306b09d3bf72d6f223228530fd45a7a8519fe94ce478d27046ed687bda3d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Dec 2020 07:16:22 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2535

GET
H2 200 script.js Show response
windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/inc/ 742 B
378 B 222ms
152ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/responsive-lightbox-lite/assets/inc/script.js?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 1510fc6ba5664447376b7b5f15cb988571edd425abf91a0784bd17bf4e52ce86

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Thu, 24 Dec 2020 07:16:22 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 306

GET
H2 200 windowsxlive.net.js Show response
cdn.nsstatic.net/ns/ 323 KB
105 KB 479ms
137ms Script
application/javascript 23.43.85.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.85.18 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-43-85-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 978135170529b02153aadd1f34e89413e4d36b0c9e1fe3a4fa9c23dbfd6525da

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Thu, 03 Nov 2022 10:38:43 GMT
etag: "e4c38f565cf86e780452c52b30854411"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
content-length: 107535
expires: Sun, 27 Aug 2023 15:24:03 GMT

GET
H/1.1 200
OK load.js Show response
a.postrelease.com/serve/ 615 KB
163 KB 435ms
98ms Script
application/x-javascript 23.215.130.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://a.postrelease.com/serve/load.js?async=true
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.130.187 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-215-130-187.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 7e8e0dd52fdad574552c3e7f492becb949de12a2936ddae55844807b3e80e90d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date: Sun, 27 Aug 2023 14:24:02 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Aug 2023 15:34:12 GMT
Server: AmazonS3
x-amz-request-id: 0Q3DS20K3GAN26GY
ETag: "db20caff20c655b418416921f457ce0c"
x-amz-server-side-encryption: AES256
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: public, max-age=3600
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
x-amz-id-2: x1cWTcR/b+PnIpBPnnZZwOJ76UhDlHBbYejkVeQDFsFCv9qUi+gjo7T68QI7mA5BQkQsoU+S3u4=

GET
H2 200 sfp.js Show response
native.sharethrough.com/assets/ 600 KB
114 KB 243ms
72ms Script
application/javascript 108.156.184.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/sfp.js
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.184.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-184-115.cmh68.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf442222f0ea6f2b4cc735cef3a9548366ad6dbed5805af0d427b4db1fef9ef8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 13:59:45 GMT
content-encoding: gzip
via: 1.1 5bbf9ff531c5eebbeb82768a75b80422.cloudfront.net (CloudFront)
last-modified: Sat, 26 Aug 2023 13:59:43 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P2
age: 1458
x-amz-server-side-encryption: AES256
etag: W/"5177550da926dffbd2fc1074eb961f7d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: _JgqRYjLB0KQBy4K8wdI2KdNgsv-n7MlAtbz4Gqu-fLrL1Kx53Z0gQ==
expires: Sat, 26 Aug 2023 14:59:41 GMT

GET
H2 200 Windows-11-UX-Pack-846x1024.jpg
windowsxlive.net/wp-content/uploads/2021/08/ 147 KB
147 KB 129ms
59ms Image
image/jpeg 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/wp-content/uploads/2021/08/Windows-11-UX-Pack-846x1024.jpg
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: e15f917b9b117ebc51b92dc361965c9d72897798571430d8f0ee775bbb373a1e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
last-modified: Wed, 04 Aug 2021 08:45:22 GMT
server: Apache
accept-ranges: bytes
content-length: 150036
content-type: image/jpeg

GET
H2 200 cuxp-3-862x1024.jpg
windowsxlive.net/wp-content/uploads/2015/10/ 155 KB
155 KB 52ms
51ms Image
image/jpeg 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/wp-content/uploads/2015/10/cuxp-3-862x1024.jpg
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 96cba0d12c5459510c043c454746be86a91aa00bc0567428e1904e99aaf72864

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
content-length: 158771
content-type: image/jpeg

GET
H2 200 10tp6-1000x288.jpg
windowsxlive.net/wp-content/uploads/2014/10/ 64 KB
65 KB 59ms
56ms Image
image/jpeg 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/wp-content/uploads/2014/10/10tp6-1000x288.jpg
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 17945a4908b1b8a69172a6babc6fc3787422e230253b5fd44b0edcc414505e2d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
content-length: 66010
content-type: image/jpeg

GET
H2 200 logo.png
windowsxlive.net/images/ 43 KB
43 KB 58ms
49ms Image
image/png 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/images/logo.png
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 1fb34e7eb4868771d4507dcb23bbc90a807676ff3c459cbb7ed1ba6a8ca28d1f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
content-length: 43905
content-type: image/png

GET
H2 200 facebook.png
windowsxlive.net/images/ 1018 B
1 KB 58ms
50ms Image
image/png 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/images/facebook.png
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 77f5a108d4e15bf7e5a3dd1dcd877cab841f84f8424626c6ce33ff97a36b7a4d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
content-length: 1018
content-type: image/png

GET
H2 200 twitter.png
windowsxlive.net/images/ 1 KB
1 KB 58ms
49ms Image
image/png 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/images/twitter.png
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 8265df6f17eaef70b04915e4f6c759172d87c9e495d93ebc421d0717d83a1d16

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
content-length: 1115
content-type: image/png

GET post-widget.js
w.po.st/share/script/ 0
0

GET
H2 200 wpajans_dedect.css
windowsxlive.net/wp-content/plugins/wp-adblock-dedect/css/ 2 KB
858 B 52ms
51ms Stylesheet
text/css 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/wp-adblock-dedect/css/wpajans_dedect.css?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 6d49b77aafce0365a34a91dd855d678f5beb1e1c1f4e9cf142c9c9a4421a51da

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:02 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 826

GET
H2 200 comment_count.js Show response
windowsxlive.net/wp-content/plugins/disqus-comment-system/public/js/ 889 B
518 B 57ms
51ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.23
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Wed, 03 May 2023 13:56:40 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 440

GET
H2 200 detectmobilebrowser.js Show response
windowsxlive.net/wp-content/plugins/mystickymenu/js/ 2 KB
1 KB 62ms
57ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/mystickymenu/js/detectmobilebrowser.js?ver=2.6.2
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: f6072019ba53a652c426b2621fb6e94a4cbc3fba6f5c0a7106a1960156e2e83f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Wed, 03 May 2023 13:56:42 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1381

GET
H2 200 mystickymenu.min.js Show response
windowsxlive.net/wp-content/plugins/mystickymenu/js/ 4 KB
2 KB 59ms
54ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/mystickymenu/js/mystickymenu.min.js?ver=2.6.2
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 65b978e80fdf031da25da84fd0f3e56d5d3282a2c3c07d1436e8cf1bfce4c449

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Wed, 03 May 2023 13:56:42 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1584

GET
H2 200 skip-link-focus-fix.js Show response
windowsxlive.net/wp-content/themes/twentysixteen/js/ 1 KB
619 B 61ms
56ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/themes/twentysixteen/js/skip-link-focus-fix.js?ver=20150825
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 6d4083520c18bfdcdffb319248525ebf8f1a547326e10c02e6a0ed0b1722ae9a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 587

GET
H2 200 functions.js Show response
windowsxlive.net/wp-content/themes/twentysixteen/js/ 7 KB
2 KB 63ms
58ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/themes/twentysixteen/js/functions.js?ver=20150825
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 00c7226270ee70dc934c77933c17e8bb18e425b207afcf2253fdf829297f703d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2259

GET
H2 200 frontend.min.js Show response
windowsxlive.net/wp-content/plugins/q2w3-fixed-widget/js/ 23 KB
7 KB 56ms
55ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/q2w3-fixed-widget/js/frontend.min.js?ver=6.2.3
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: a69c12ccd186a899db79fce802b46c08e71f69c2c422be2666ed8565e3add026

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Wed, 03 May 2023 13:56:40 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 7446

GET
H2 200 dedect.js Show response
windowsxlive.net/wp-content/plugins/wp-adblock-dedect/js/ 7 KB
2 KB 55ms
54ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-content/plugins/wp-adblock-dedect/js/dedect.js?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 65acd116fab8d8d54d31dad36101083b89a6ac3871f37fd99dc702cf8b4a5b6f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 2251

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 4 KB
3 KB 390ms
48ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be7df9413f1250349464bbfde8a9c6de99868c84a13772ceef3e7526125b0e33

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 26 Aug 2023 05:42:04 GMT
server: cloudflare
age: 2499
etag: W/"102c-603ccebc79397"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7fd4f9d4e8d9dac1-MIA
expires: Sun, 27 Aug 2023 14:42:24 GMT

GET
BLOB 200
OK e937a3dd-03ee-493e-a632-0b0a58a8cc2d
https://windowsxlive.saftawy.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://windowsxlive.saftawy.com/e937a3dd-03ee-493e-a632-0b0a58a8cc2d
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 400ms
63ms Script
text/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 27 Aug 2023 12:27:56 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6967
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 27 Aug 2023 14:27:56 GMT

GET
H2 200 t Show response
jadserve.postrelease.com/ 268 B
719 B 346ms
67ms Script
text/javascript 34.230.226.68
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ntv_mvi
Requested by: Host: a.postrelease.com
URL: https://a.postrelease.com/serve/load.js?async=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.230.226.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-230-226-68.compute-1.amazonaws.com
Software: nginx/1.12.2 /
Resource Hash: f24d352fc8e0fbbfd349ef49e86d9317834abb3494be70b4513660803ff66c67

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
server: nginx/1.12.2
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 190
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
683 B 105ms
105ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0ff4fe886c21f09a3ba144b93e3eb818a5152eaac69c25fce50a31677078c533

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 27 Aug 2023 14:01:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 27 Aug 2023 14:24:03 GMT

GET
H2 200 10_img0-e1418979046526.jpg
windowsxlive.net/wp-content/uploads/2014/12/ 18 KB
18 KB 60ms
51ms Image
image/jpeg 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://windowsxlive.net/wp-content/uploads/2014/12/10_img0-e1418979046526.jpg
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: ad5b30a375e95ccde57c84c338686771c5e0dd575d7f75f040ef111524f0054e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Fri, 01 May 2020 10:07:02 GMT
server: Apache
accept-ranges: bytes
content-length: 18314
content-type: image/jpeg

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
31 KB 404ms
73ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Merriweather%3A400%2C700%2C900%2C400italic%2C700italic%2C900italic%7CMontserrat%3A400%2C700%7CInconsolata%3A400&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://windowsxlive.saftawy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 01:38:33 GMT
x-content-type-options: nosniff
age: 132330
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 01:38:33 GMT

GET
H2 200 u-440qyriQwlOrhSvowK_l5-fCZM.woff2
fonts.gstatic.com/s/merriweather/v30/ 20 KB
20 KB 513ms
182ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/merriweather/v30/u-440qyriQwlOrhSvowK_l5-fCZM.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c2d662e92bcbf1a5970b97040f901031295e79a96314db8302f549003022087

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://windowsxlive.saftawy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 20:33:09 GMT
x-content-type-options: nosniff
age: 323454
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20028
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 16:41:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 22 Aug 2024 20:33:09 GMT

GET
H2 200 u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2
fonts.gstatic.com/s/merriweather/v30/ 19 KB
19 KB 482ms
151ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

273c8613cdd2852dd5318f224d804ae6d2fc717c48d3f1dab587b6d396fb4fc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://windowsxlive.saftawy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 01:14:49 GMT
x-content-type-options: nosniff
age: 133754
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19740
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 15:48:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 01:14:49 GMT

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer
Origin: https://windowsxlive.saftawy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 0e05ca091043afb329dd72162dce2d12
secure.gravatar.com/avatar/ 1 KB
1 KB 299ms
34ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/0e05ca091043afb329dd72162dce2d12?s=49&d=mm&r=g
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: c6d56f8cdef052a7d17726f28428d67ba5fc76cd473b8b3198c7ae4bca139122

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-nc: HIT mia 1
date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="0e05ca091043afb329dd72162dce2d12.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/0e05ca091043afb329dd72162dce2d12?s=49&d=mm&r=g>; rel="canonical"
content-length: 1124
expires: Sun, 27 Aug 2023 14:29:03 GMT

GET
H/1.1 200
OK count.js Show response
windowsxslive.disqus.com/ 1 KB
2 KB 290ms
33ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://windowsxslive.disqus.com/count.js

Requested by

Host: windowsxlive.net
URL: https://windowsxlive.net/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.23

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date: Sun, 27 Aug 2023 14:24:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
X-Amz-Cf-Pop: DFW3-C1
Age: 196
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Fri, 25 Aug 2023 23:39:55 GMT
Server: nginx
ETag: "64e93bcb-367"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: YhA1iSR850R3koAImdFZu0M9khG7m4621xbpPQYrV5G1rleiVD2N7w==

GET
H/1.1 200
OK count-data.js Show response
windowsxslive.disqus.com/ 396 B
977 B 68ms
68ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://windowsxslive.disqus.com/count-data.js?1=1083%20https%3A%2F%2Fwindowsxlive.net%2F%3Fp%3D1083&1=871%20https%3A%2F%2Fwindowsxlive.net%2F%3Fp%3D871&1=961%20https%3A%2F%2Fwindowsxlive.net%2F%3Fp%3D961

Requested by

Host: windowsxslive.disqus.com
URL: https://windowsxslive.disqus.com/count.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

790fb5cd8aa82cc66e398d7034ee249a1ff0844d7f8967c08e72c925d2475127

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date: Sun, 27 Aug 2023 14:24:03 GMT
Strict-Transport-Security: max-age=300; includeSubdomains
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, max-age=600
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 396
X-XSS-Protection: 1; mode=block

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1885.003-3.027/ 187 KB
57 KB 46ms
46ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1885.003-3.027/ice.js
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7d11c07f9cfce0d8b6e409e045a32b0cb35c252351793e8923d92ac299a3edc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 23 Aug 2023 10:44:18 GMT
server: cloudflare
age: 12885
etag: W/"2ede7-60394cb287679"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 7fd4f9d53948dac1-MIA
expires: Tue, 26 Sep 2023 10:49:18 GMT

GET
H2 200 wp-emoji-release.min.js Show response
windowsxlive.net/wp-includes/js/ 18 KB
5 KB 57ms
57ms Script
application/javascript 108.167.181.192
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://windowsxlive.net/wp-includes/js/wp-emoji-release.min.js?ver=b83f79ee4c56df548cbba7f349d0a40b
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.167.181.192 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: fall-pro.com
Software: Apache /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
last-modified: Wed, 03 May 2023 14:06:38 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 5344

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
229 B 77ms
77ms XHR
text/plain 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1360079528&t=pageview&_s=1&dl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ul=en-us&de=UTF-8&dt=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1106201445&gjid=335148294&cid=767488006.1693146243&tid=UA-114055-3&_gid=685388684.1693146243&_r=1&_slc=1&z=1255232420

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

ca4342c70b92db9a83a50027c679aba826a512977181599ea7df321068f28ff7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 54F6 0
43 B 72ms
56ms Document
text/plain 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=8259&wsid=0&pdom=windowsxlive.saftawy.com&purl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1885.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 7fd4f9d60a61dac1-MIA
content-length: 0
date: Sun, 27 Aug 2023 14:24:03 GMT
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 0
33 B 70ms
60ms Script
text/plain 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=8259&wsid=0&pdom=windowsxlive.saftawy.com&purl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1885.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7fd4f9d60a63dac1-MIA
content-length: 0

GET
H2 200 gsd Show response
router.infolinks.com/ 0
33 B 67ms
59ms Script
text/plain 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=8259&wsid=0&pdom=windowsxlive.saftawy.com&purl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&jsv=1885.003-3.027&_cb=16931462434940
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1885.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7fd4f9d60a68dac1-MIA
content-length: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
353 B 189ms
67ms XHR
text/plain 2607:f8b0:4004:c0b::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-114055-3&cid=767488006.1693146243&jid=1106201445&gjid=335148294&_gid=685388684.1693146243&_u=IEBAAEAAAAAAACAAI~&z=220502206

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::9b Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 27 Aug 2023 14:24:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 221 KB
79 KB 288ms
121ms Script
application/javascript 2607:f8b0:4020:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q1821CHBT3&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2008 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fd0a9db3fc70f81152fd134ec8cd6e91b9074759d33232e3d301fd40cb3b2b96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 80722
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 27 Aug 2023 14:24:03 GMT

GET
H2 200 geocc.js Show response
g.pcmag.com/ 184 B
280 B 353ms
109ms Script
application/javascript 2600:1400:9000::172c:edbb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://g.pcmag.com/geocc.js
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:9000::172c:edbb New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 03abb79e0dbe50a1e23e9eca45094fefb296018f5ae85daa2e7cbe2c8099cedb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
alt-svc: h3=":443"; ma=93600
content-length: 184
content-type: application/javascript

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 77ms
76ms XHR
text/plain 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1360079528&t=pageview&_s=1&dl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ul=en-us&de=UTF-8&dt=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KEDAAEABAAAAACAAI~&jid=1562107263&gjid=1333396687&cid=767488006.1693146243&tid=UA-46557023-8&_gid=685388684.1693146243&_r=1&_slc=1&z=1152793215

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 4 KB
2 KB 205ms
62ms Script
application/javascript 3.160.5.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.160.5.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-160-5-103.cmh68.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 09:43:52 GMT
content-encoding: gzip
via: 1.1 9bb4d05ab08e4eaa205fa572ca4c835c.cloudfront.net (CloudFront)
last-modified: Fri, 21 Jul 2023 22:21:17 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P4
age: 16812
x-amz-server-side-encryption: AES256
etag: W/"a06e7a176f40dc26aa5e9567ac9d2d5e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: wUOuITqKcfHSjGl7J7HxKNqpGDsV69AC8hS5ZHrFrz91U-ziqgXzGw==

GET
H2 200 z0WVjCBSEeGLoxIxOQVEwQ.min.js Show response
cdn.static.zdbb.net/js/ 153 KB
43 KB 92ms
64ms Script
application/javascript 23.43.85.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.85.18 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-43-85-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8235338c85d9a067c5cd68932d0254970b2eef016c95e52c585950b74a91f428

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-amz-version-id: JNXL6n5E_uuPT5Qf.KiKCkK1ga62isvT
content-encoding: gzip
date: Sun, 27 Aug 2023 14:24:03 GMT
last-modified: Thu, 17 Aug 2023 08:35:03 GMT
x-amz-request-id: 3E7AVPH9VB5M9FW3
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 43582
x-amz-id-2: s//ag9q8JUSZaH8GKVwg3Y7CVb2lExVkvHNRfqVDT+mLsAUh4D8KKA436DvRB4bzFjUWo91B+70=
expires: Mon, 28 Aug 2023 14:24:03 GMT

GET
H2

200

v60.js Show response
cdn-gl.imrworldwide.com/
Redirect Chain

https://secure-us.imrworldwide.com/v60.js
https://cdn-gl.imrworldwide.com/v60.js

21 KB
7 KB

238ms
66ms

Script
application/javascript

2600:9000:25f5:8c00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/v60.js
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Server: 2600:9000:25f5:8c00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 117ed873640b992e38f34a0a761dd3e1cda6b3c24c9507bb3adc0323039f8ff1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 09:45:48 GMT
x-amz-version-id: PmT0ztgo6pW7kPCi5f5AnKDRXRQLwscI
content-encoding: gzip
last-modified: Mon, 25 Jul 2022 13:33:52 GMT
server: AmazonS3
via: 1.1 d8873faffc00aa55cd5d25bc17b554b0.cloudfront.net (CloudFront)
x-amz-cf-pop: CMH68-P5
etag: W/"3bad78b036ef952c6ace672b2251b459"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
age: 16697
x-amz-cf-id: MMWYlA7TyvnjQ7HxO1GgxnlrzwlnOvai2WWCscPvpMQhXREakFbHzQ==

Redirect headers

location: https://cdn-gl.imrworldwide.com:443/v60.js
date: Sun, 27 Aug 2023 14:24:03 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2 200 nsgpt.jsonp Show response
ns.zdbb.net/ 416 B
536 B 143ms
118ms Script
application/javascript 23.43.85.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ns.zdbb.net/nsgpt.jsonp?u=https%3A%2F%2Fwindowsxlive.saftawy.com%2F
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.85.18 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-43-85-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d957204c168f813d6801b41dfb5aab96c2bd93cd246ffec3d8e46b68fb555ec6

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: max-age=55
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 276
expires: Sun, 27 Aug 2023 14:24:58 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 97 KB
29 KB 312ms
121ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

82c739bf372e6d8f0df0b257208d5d9c119172b65d768eaf0faf4d481e23c47b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28756
x-xss-protection: 0
server: cafe
etag: 744 / 19596 / m202308220101 / config-hash: 7028521147000579048
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:03 GMT

GET
H2 200 /
gurgle.zdbb.net/ 43 B
260 B 187ms
59ms Image
image/gif 3.212.40.172
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gurgle.zdbb.net/?domain=netshelter.net
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.40.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-40-172.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-origin: https://windowsxlive.saftawy.com
date: Sun, 27 Aug 2023 14:24:03 GMT
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 43
access-control-allow-methods: GET, OPTIONS
content-type: image/gif

GET
H2 200 check_c Show response
zdbb.net/ 0
390 B 200ms
57ms XHR
text/plain 54.237.107.196
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://zdbb.net/check_c
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.237.107.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-237-107-196.compute-1.amazonaws.com
Software: Ziff Davis BuyerBase /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:03 GMT
server: Ziff Davis BuyerBase
p3p: CP="ALL DSP COR NID"
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 0
expires: 0

GET
H2 200 info Show response
gurgle.zdbb.net/ 444 B
665 B 83ms
62ms XHR
application/json 3.212.40.172
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://gurgle.zdbb.net/info?url=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&fp=0&lcl_id=
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.40.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-40-172.compute-1.amazonaws.com
Software: /
Resource Hash: c9e25231a4b17a1057bcb96e3289b66e21755d8467c301617240b068b6ca7b51

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-origin: https://windowsxlive.saftawy.com
date: Sun, 27 Aug 2023 14:24:03 GMT
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 444
access-control-allow-methods: GET, OPTIONS
content-type: application/json

GET

pixel
ps.eyeota.net/
Redirect Chain

https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?additionalInformation=&cms_page_id=&local_uid=&referrer=&zd_pageview_id=e63eada2-6e88-426b-80e5-7cb3e608ebcd&zd_session_id=5e26014c-637f-45c6-b5f7-bfcc6ad3...
https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?additionalInformation=&cms_page_id=&local_uid=&referrer=&zd_pageview_id=e63eada2-6e88-426b-80e5-7cb3e608ebcd&zd_session_id=5e26014c-637f-45c6-b5f7-bfcc6ad3...
https://cm.g.doubleclick.net/pixel?google_nid=ziffdavis_dmp&google_cm&google_hm=NTk2YzFiMjQ4N2I1NDg4ODgzOWE5MWEwNzUwZjY2MmI=
https://cm.g.doubleclick.net/pixel?google_nid=ziffdavis_dmp&google_cm=&google_hm=NTk2YzFiMjQ4N2I1NDg4ODgzOWE5MWEwNzUwZjY2MmI=&google_tc=
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?google_gid=CAESEMn9RoxMb5CvX1tSPT2UVs0&google_cver=1
https://aa.agkn.com/adscores/g.pixel?sid=9212302198
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=neusbftgslopjfixorwbst&tpc=hf%2B2givALZlA2MyUkBwwM91PbwUbNV1FPqmISYjX2i0%3D
https://stags.bluekai.com/site/31875?limit=0&id=596c1b2487b54888839a91a0750f662b&redir=https%3A//zdbb.net/l/qI109lRAEeGCiBIxORcFRw/%3Ftp%3Dbkcsbftodcapjfixorcfrw%26tpc%3D%24_BK_UUID
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=bkcsbftodcapjfixorcfrw&tpc=$_BK_UUID
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pexu87e&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=pexu87e&ttd_tpi=1
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=lk45j3o5TTDlkj35h3g4&tpc=b63acc23-5e25-44ec-82bb-fa25cc39cfd3
https://match.prod.bidr.io/cookie-sync/spiceworks2?buyer_user_id=596c1b2487b54888839a91a0750f662b
https://match.prod.bidr.io/cookie-sync/spiceworks2?buyer_user_id=596c1b2487b54888839a91a0750f662b&_bee_ppp=1
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=kh4u2bm23bbewk4h35&tpc=AAAyoU7J1rkAACYsVV_yHA
https://dpm.demdex.net/ibs:dpid=266306&dpuuid=596c1b2487b54888839a91a0750f662b&redir=https%3A//zdbb.net/l/qI109lRAEeGCiBIxORcFRw/%3Ftp%3Daamipowqlssjirtmmlknrp%26tpc%3D%24%7BDD_UUID%7D
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=266306&dpuuid=596c1b2487b54888839a91a0750f662b&redir=https%3A//zdbb.net/l/qI109lRAEeGCiBIxORcFRw/%3Ftp%3Daamipowqlssjirtmmlknrp%26tpc%3D%24%7BD...
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=aamipowqlssjirtmmlknrp&tpc=16517465780325121254070302540021926316
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fzdbb.net%2Fl%2FqI109lRAEeGCiBIxORcFRw%2F%3Ftp%3Dpubgwejkldsfjdflkslpoww%26tpc%3D%23PM_USER_ID
https://zdbb.net/l/qI109lRAEeGCiBIxORcFRw/?tp=pubgwejkldsfjdflkslpoww&tpc=6230F9F1-7335-4158-84FF-01580FA7F598
https://ps.eyeota.net/pixel?pid=mla6m40&t=gif

0
0

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=8&c2=6036316&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1693146243849&ns_c=UTF-8&c3=1&c7=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c8=Windows%20X%27s%20Live%20%E2%80...
https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1693146243849&ns_c=UTF-8&c3=1&c7=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c8=Windows%20X%27s%20Live%20%E2%8...

0
223 B

75ms
75ms

Image
text/plain

3.160.5.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1693146243849&ns_c=UTF-8&c3=1&c7=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c8=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&c9=
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Server: 3.160.5.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-160-5-103.cmh68.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:03 GMT
via: 1.1 9bb4d05ab08e4eaa205fa572ca4c835c.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: CMH68-P4
x-amz-cf-id: GYce7D1Tk0zdLdph0Mlyipijh5QppMHCToavY6CLHIuN2mRn7gOmSg==
x-cache: Miss from cloudfront

Redirect headers

date: Sun, 27 Aug 2023 14:24:03 GMT
via: 1.1 9bb4d05ab08e4eaa205fa572ca4c835c.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: CMH68-P4
x-cache: Miss from cloudfront
location: /b2?c1=8&c2=6036316&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1693146243849&ns_c=UTF-8&c3=1&c7=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c8=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&c9=
content-length: 0
x-amz-cf-id: AfQPryTSsFNJ1CBRyXRkxvQDpnD79f_rNq_X4MvpB6-L46yGdKsx3w==

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 76ms
76ms Ping
text/plain 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-Q1821CHBT3&gtm=45je38n0&_p=1360079528&ul=en-us&sr=1600x1200&cid=767488006.1693146243&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&dt=Windows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&sid=1693146243&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Q1821CHBT3&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/ 403 KB
127 KB 75ms
74ms Script
text/javascript 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8165d8e2771d30c1a2baf2e6ebb58ce49c3b9dc575676b6f1aa7afeb2e5efe86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:23:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 39
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 129871
x-xss-protection: 0
server: cafe
etag: 10423821264569162327
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 26 Aug 2024 14:23:25 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 46 B
74 B 245ms
99ms XHR
application/json 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=windowsxlive.saftawy.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

067115f5883c4d1dc3fed1a8a58b10113d71abfe7284c74750b04e3a3a0718f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50
x-xss-protection: 0
expires: Sun, 27 Aug 2023 14:24:04 GMT

GET
H2 200 tag.js Show response
native.sharethrough.com/assets/ 600 KB
114 KB 67ms
66ms Script
application/javascript 108.156.184.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://native.sharethrough.com/assets/tag.js
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.184.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-184-115.cmh68.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf442222f0ea6f2b4cc735cef3a9548366ad6dbed5805af0d427b4db1fef9ef8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:05:31 GMT
content-encoding: gzip
via: 1.1 5bbf9ff531c5eebbeb82768a75b80422.cloudfront.net (CloudFront)
last-modified: Sat, 26 Aug 2023 13:59:43 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P2
age: 1141
x-amz-server-side-encryption: AES256
etag: W/"5177550da926dffbd2fc1074eb961f7d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: ydQwNdmtt80HRzq1DMCk9UKHvJEhn5k_IP8DbXjw8GEtGKA0nKG36Q==
expires: Sat, 26 Aug 2023 14:59:41 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 799 B
3 KB 363ms
130ms XHR
application/json 2602:803:c002:200::42
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11576&site_id=142210&zone_id=661236&size_id=2%3B2%3B15%3B9%3B15&alt_size_ids=1%3B55%2C57%3B16%3B8%3B16&rf=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&tg_i.site=windowsxlive.net&tg_i.pos=atf%3Batf%3Batf%3Batf%3Bbtf&tg_i.adunit=homepage&tk_flint=pbjs_lite_v2.39.0&x_source.tid=f59a5453-1e61-478d-bbd5-78ca8b7626dc%3B247d56be-25fb-47d4-9eab-bc5ae617e016%3Bca620f84-c004-4e88-9bd4-f09d03d42569%3Bebadc2d5-5c85-476d-b58f-0afafcdaf22b%3B3320d934-0c8a-431d-a841-98bc72f4ed7e&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=5&rand=0.9302971329114222
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 016d9a2e1ac4b7f5846d5d9443f34ec3f1809055bdbe9b10f2df20c4184a3305

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
as-sec.casalemedia.com/ 36 B
559 B 167ms
72ms XHR
application/json 104.18.39.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=230475&v=7.2&r=%7B%22id%22%3A%227855b5783dcf3c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%228edb51dacec1df%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%229604632115098e%22%2C%22banner%22%3A%7B%22w%22%3A468%2C%22h%22%3A60%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22468x60%22%7D%7D%2C%7B%22id%22%3A%2210c4a33a92a0a79%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%2211bd021233ce91e%22%2C%22banner%22%3A%7B%22w%22%3A997%2C%22h%22%3A123%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22997x123%22%7D%7D%2C%7B%22id%22%3A%22123fdd1a8cf81da%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22id%22%3A%221339f51b7654a55%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A180%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22970x180%22%7D%7D%2C%7B%22id%22%3A%2214e68245c1548e4%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22id%22%3A%22157aa0a14baf20f%22%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22id%22%3A%2216c54a08b2d1446%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22id%22%3A%2217a4334a37b3781%22%2C%22banner%22%3A%7B%22w%22%3A120%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22120x600%22%7D%7D%2C%7B%22id%22%3A%2218ce0cc15eeb669%22%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22160x600%22%7D%7D%2C%7B%22id%22%3A%22195fbeb86b020c5%22%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22id%22%3A%222039576d51cab95%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230475%22%2C%22sid%22%3A%22300x250%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwindowsxlive.saftawy.com%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%7D&ac=j&sd=1&
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.39.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd560776866989d49ed110649053e185fe1917d62b8636ed13ac8ac81304fdb9

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=opuAZ1X2t8ZNK2RKmjC602Su7X6KSyIMpwuR5BFN6yTJOCoYtU80uGypvMYaZdFLqzH4Qgn2%2FRMx7gtOV741ucnY59ZEXKAGTlZesA%2FgiIP3W7yHTcZ%2F536i2VxPmQIEp6ksh%2Fd0Das%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7fd4f9db7f368dc7-MIA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

GET
H2 200 arj Show response
ziffdavis-d.openx.net/w/1.0/ 173 B
597 B 190ms
89ms XHR
application/json 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ziffdavis-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=600&tws=1600x1200&be=1&bc=hb_pb_2.1.9&dddid=f59a5453-1e61-478d-bbd5-78ca8b7626dc%2C247d56be-25fb-47d4-9eab-bc5ae617e016%2Cca620f84-c004-4e88-9bd4-f09d03d42569%2Cebadc2d5-5c85-476d-b58f-0afafcdaf22b%2C3320d934-0c8a-431d-a841-98bc72f4ed7e&nocache=1693146244284&aus=728x90%2C468x60%7C728x90%2C997x123%2C970x250%2C970x180%2C970x90%7C336x280%2C300x250%7C120x600%2C160x600%7C336x280%2C300x250&divIds=nsgpt-leaderboard-1%2Cnsgpt-billboard-1%2Cnsgpt-largerectangle-1%2Cnsgpt-skyscraper-1%2Cnsgpt-largerectangle-2&auid=540322722%2C540322722%2C540322722%2C540322722%2C540322722&
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 6da6b8a9d8949e69f28ce7440ed762ef13ce09b2dc2ba5914eac2b77307ec9df

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 598 B
1 KB 392ms
245ms XHR
application/json 68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31c8024e36419f969589a6b1600a32ba2533ddc8827016158f16fac75897fbb7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://windowsxlive.saftawy.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
content-encoding: gzip
an-x-request-uuid: 65f772eb-d4f0-4b7d-b67f-e8cc5191c5bb
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://windowsxlive.saftawy.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.74; 38.132.118.74; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 55 B
296 B 223ms
103ms XHR
application/json 34.197.182.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=7529&slot=%7Bid:nsgpt-leaderboard-1,ss:%5B728.90,468.60%5D,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-native-1,s:1,1.fluid,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-billboard-1,ss:%5B728.90,997.123,970.250,970.180,970.90%5D,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-largerectangle-1,ss:%5B336.280,300.250%5D,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-skyscraper-1,ss:%5B120.600,160.600%5D,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-largerectangle-2,ss:%5B336.280,300.250%5D,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-footer,s:1.1,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-stitials,s:1.1,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-inpage,s:1.1,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-skin,s:1.1,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-inline,s:1.1,p:/4585/ns.windowsxlive/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-masthead,s:1.1,p:/4585/ns.windowsxlive/homepage,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=11a343a5-7807-e722-56e6-a3142e10ebaa&url=https%253A%252F%252Fwindowsxlive.saftawy.com%252F
Requested by: Host: cdn.nsstatic.net
URL: https://cdn.nsstatic.net/ns/windowsxlive.net.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.182.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-182-56.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5fa7e3cdf66d3191e10c92b08d49b749357c43031cfc90e01345d0e4d71133a9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:04 GMT
server: nginx
x-server-name: app13.va.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://windowsxlive.saftawy.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *

GET
H3 200 css2
fonts.googleapis.com/ 2 KB
587 B 95ms
95ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0ff4fe886c21f09a3ba144b93e3eb818a5152eaac69c25fce50a31677078c533

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 27 Aug 2023 14:24:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 27 Aug 2023 14:03:19 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 27 Aug 2023 14:24:04 GMT

GET
H2 200 match Show response
bee.imrworldwide.com/v1/clients/ 39 B
499 B 296ms
84ms XHR
application/json 108.156.184.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bee.imrworldwide.com/v1/clients/match?client_id=ziffdavis&url=https://windowsxlive.saftawy.com/

Requested by

Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.156.184.25 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-156-184-25.cmh68.r.cloudfront.net

Software

Resource Hash

0210bcf8c6f9fb41e1db722e8ec3c318101342f5922c59331321c993df1720d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=25920000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=25920000; includeSubDomains
via: 1.1 b34c59219d5e9dc7c1b640b37c9a84f2.cloudfront.net (CloudFront)
x-amz-cf-pop: CMH68-P2
x-frame-options: DENY
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-cache: Miss from cloudfront
access-control-allow-credentials: true
content-length: 63
x-xss-protection: 1; mode=block
x-amz-cf-id: i4ZNZkJNhFOYxXrcbpbDYFlofwRpCH36iJQFhaWHHv-4TvbG9Sn1IQ==

GET
H2 200 storageframe.html Show response
secure-us.imrworldwide.com/ Frame 8B64 11 KB
4 KB 60ms
59ms Document
text/html 52.204.12.229
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-us.imrworldwide.com/storageframe.html
Requested by: Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.12.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-12-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-length: 3489
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:04 GMT
etag: "64d4f907-da1"
last-modified: Thu, 10 Aug 2023 14:49:43 GMT
server: nginx

GET
H2

200

m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain

https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1693146244766&ci=ziffdavis&js=1&cg=0&ts=infolinks_main.js&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&sr=1...
https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1693146244766&ci=ziffdavis&js=1&cg=0&ts=infolinks_main.js&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&sr=1...

44 B
424 B

59ms
59ms

Image
image/gif

52.204.12.229
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1693146244766&ci=ziffdavis&js=1&cg=0&ts=infolinks_main.js&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&sr=1600x1200&id=lstrg-1c77853b696b264b2aeeb9203ca76be0&tz=-10&ja=1
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Server: 52.204.12.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-12-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
server: nginx
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:04 GMT
server: nginx
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
location: https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1693146244766&ci=ziffdavis&js=1&cg=0&ts=infolinks_main.js&vn=6.0.108&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&sr=1600x1200&id=lstrg-1c77853b696b264b2aeeb9203ca76be0&tz=-10&ja=1
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 0
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 281 KB
71 KB 987ms
986ms Fetch
text/plain 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2210391038026492&correlator=2962143083490593&output=ldjh&gdfp_req=1&vrg=202308220101&ptt=17&impl=fifs&iu_parts=4585%2Cns.windowsxlive%2Chomepage&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C468x60%2C320x50%7C1x1%2C728x90%7C997x123%7C970x250%7C970x180%7C970x90%2C336x280%7C300x250%2C120x600%7C160x600%2C336x280%7C300x250%2C1x1%2C1x1%2C1x1%2C1x1%2C1x1%2C120x30&fluid=0%2Cheight%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ifi=1&sfv=1-0-40&ists=62&eri=4&sc=1&cookie_enabled=1&abxe=1&dt=1693146244781&adxs=436%2C170%2C247%2C1115%2C1213%2C1115%2C0%2C0%2C0%2C0%2C0%2C0&adys=21%2C63%2C71%2C166%2C871%2C1773%2C1200%2C1200%2C1200%2C1200%2C1200%2C1170&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C0%7C1%7C2%7C3%7C4%7C5%7C6%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&vis=1&psz=1260x42%7C882x6888%7C882x6888%7C315x306%7C315x0%7C315x8%7C1600x7133%7C1600x7133%7C1600x7133%7C1600x7133%7C1600x7133%7C1600x7133&msz=1145x0%7C882x0%7C882x16%7C315x0%7C315x0%7C315x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C120x-1&fws=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C512&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ga_vid=767488006.1693146243&ga_sid=1693146245&ga_hid=1360079528&ga_fc=true&dlt=1693146242339&idt=1915&prev_scp=ad_group%3Dad_ex8%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%26vw%3D40%2C50%2C60%2C70%7Cad_group%3Dad_opt%26sharethrough%3Dtrue%26strnativekey%3D32f5c3e3%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%26vw%3D40%2C50%2C60%2C70%7Cad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%7Cad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%7Cad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%7Cad_group%3Dad_ex3%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Dbtf%26pos%3Dbtf%7Cad_group%3Dad_opt%26OOP_type%3Dfooter%26rfr%3Dfalse%26OOF%3Dfalse%7Cad_group%3Dad_ex7%26OOP_type%3Dstitials%26rfr%3Dfalse%26OOF%3Dfalse%7Cad_group%3Dad_opt%26OOP_type%3Dinpage%26rfr%3Dfalse%26OOF%3Dfalse%7Cad_group%3Dad_opt%26OOP_type%3Dskin%26rfr%3Dfalse%26OOF%3Dfalse%7Cad_group%3Dad_opt%26OOP_type%3Dinline%26rfr%3Dfalse%26OOF%3Dfalse%7Cad_group%3Dad_opt%26OOP_type%3Dmasthead%26rfr%3Dfalse%26OOF%3Dfalse&cust_params=url%3D%252F%26ref%3D%26zcp%3D521d3c776429a47113532%26cpid%3D0d085bb183cca34b4e0b3f823e8300eb%26mop%3Dy%26amznslots%3D%26zdid%3D0d085bb183cca34b4e0b3f823e8300eb%26zc%3D231012a6-33d9-4298-8078-6011c54db5d4%26p%3D1100034%252C900492%252C900111%252C6929%252C900115%252C6816%252C6817%252C900002%252C6947%252C900387%252C6823%252C900263%252C6825%252C6953%252C1100077%252C6831%252C6833%252C6834%252C1100095%252C6848%252C1100482%252C900163%252C900171%252C6867%252C900189%252C1200482%252C6886%252C900455%252C900331%252C1100015%252C900207%26zdbb%3D%26pageviewid%3De63eada2-6e88-426b-80e5-7cb3e608ebcd%26s%3D%26p2%3D1100034%252C900492%252C900111%252C6929%252C900115%252C6816%252C6817%252C900002%252C6947%252C900387%252C6823%252C900263%252C6825%252C6953%252C1100077%252C6831%252C6833%252C6834%252C1100095%252C6848%252C1100482%252C900163%252C900171%252C6867%252C900189%252C1200482%252C6886%252C900455%252C900331%252C1100015%252C900207%26fpid%3D596c1b2487b54888839a91a0750f662b&adks=4124475763%2C4085663102%2C2756064699%2C2801519046%2C2637283532%2C2801519047%2C2189608746%2C2825977339%2C3361569483%2C2908167795%2C3360219841%2C3362755678&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93be5534e8e441b4f97f735ce3f72e6567660d1768eaebc07a13e38804e51c3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:05 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73084
x-xss-protection: 0
google-lineitem-id: -1,-2,-1,-1,44261492,-1,-2,-2,5720593337,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-2,-1,-1,54414788972,-1,-2,-2,138434176904,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://windowsxlive.saftawy.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4BB5 6 KB
3 KB 447ms
97ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:05 GMT
expires: Mon, 26 Aug 2024 14:24:05 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 config250.js Show response
cdn-gl.imrworldwide.com/conf/ 12 KB
5 KB 66ms
65ms Script
application/javascript 2600:9000:25f5:8c00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/conf/config250.js
Requested by: Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f5:8c00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 700d989c1b35e57320c279cff1f2b11dd2b54518bd3992d0bf18640550d884d0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:22:06 GMT
x-amz-version-id: la52iPMA1EKGPxFceO2gR7Q0cLOpgjPd
content-encoding: gzip
last-modified: Sun, 27 Aug 2023 13:22:21 GMT
server: AmazonS3
via: 1.1 d8873faffc00aa55cd5d25bc17b554b0.cloudfront.net (CloudFront)
x-amz-cf-pop: CMH68-P5
etag: W/"19f4072673183f2db0ee58d0e5fd7f8e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400,s-maxage=86400
age: 119
x-amz-cf-id: haEQZ3-_Dl7eqI28CrnDFUTsvlLRaft8Cd51OA3UllQzGv-7aWrGew==

GET
H2 200 nlsSDK600.bundle.min.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 199 KB
56 KB 74ms
74ms Script
application/javascript 2600:9000:25f5:8c00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/config250.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f5:8c00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 767a456e2a3d977102a5a4224d43f77ca39d3e196d21ba98e3849eb5061d1e5c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-amz-version-id: Q5MDLoP5K3xFBtVyePaeQTJE.ZmI4Roy
content-encoding: gzip
via: 1.1 d8873faffc00aa55cd5d25bc17b554b0.cloudfront.net (CloudFront)
date: Sun, 27 Aug 2023 13:40:07 GMT
x-amz-cf-pop: CMH68-P5
age: 2639
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: INTELLIGENT_TIERING
last-modified: Tue, 01 Aug 2023 15:37:58 GMT
server: AmazonS3
etag: W/"f43d226b4110956140ab2e00da92026d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-id: zDMK2O3TKygSUymUaXKhu_aFVu-TN8fqIyxJciTIMwMBK46xiCCO6A==

GET
H2 200 ls.html Show response
cdn-gl.imrworldwide.com/novms/html/ Frame 9EC0 12 KB
4 KB 65ms
65ms Document
text/html 2600:9000:25f5:8c00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f5:8c00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 1316
cache-control: max-age=86400
content-encoding: gzip
content-type: text/html
date: Sun, 27 Aug 2023 14:02:10 GMT
etag: W/"7fa83dfc7b78314b137e2eb13834daa7"
last-modified: Tue, 01 Aug 2023 15:37:57 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 d8873faffc00aa55cd5d25bc17b554b0.cloudfront.net (CloudFront)
x-amz-cf-id: MSqgZv6qjEWGdHklaQk_tcUviCLTLsslqsjtsSYhqpIY9mvFB9NQWQ==
x-amz-cf-pop: CMH68-P5
x-amz-server-side-encryption: AES256
x-amz-version-id: Au7fEiQYXrwp6aCgYjEnL0zIkXNw87j8
x-cache: Hit from cloudfront

GET
H2 200 gn
secure-us.imrworldwide.com/cgi-bin/ Frame 9EC0 44 B
424 B 64ms
63ms Image
image/gif 52.204.12.229
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/gn?prd=session&c9=devid,&c13=asid,NA&sessionId=9wgixs4lne8uceb5vwr9yffkq55wf1693146245&c16=sdkv,bj.6.0.0&uoo=&fp_id=ul8jyvo2oqmb9my4o2ia8amcogd611693146245&fp_cr_tm=1693146245176&fp_acc_tm=1693146245176&fp_emm_tm=1693146245176&ve_id=&c30=bldv,6.0.0.663&uid2=&uid2_token=&hem_sha256=&hem_sha1=&hem_md5=&hem_unknown=&retry=0
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.12.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-12-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn-gl.imrworldwide.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:05 GMT
server: nginx
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 /
9wgixs4lne8uceb5vwr9yffkq55wf1693146245.nuid.imrworldwide.com/ Frame 9EC0 35 B
351 B 266ms
64ms Image
image/gif 2600:9000:24fd:a800:1d:667e:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9wgixs4lne8uceb5vwr9yffkq55wf1693146245.nuid.imrworldwide.com/
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:a800:1d:667e:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn-gl.imrworldwide.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 10:35:45 GMT
via: 1.1 ea282d6e9982c684c0e1bd42f4c43f3a.cloudfront.net (CloudFront)
last-modified: Tue, 11 Sep 2018 17:05:20 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P2
age: 13701
etag: "c2196de8ba412c60c22ab491af7b1409"
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 35
x-amz-cf-id: P-9ijurjPpuhVPfMNZ3P3bcLREgFK7-ufp2eCM2XQKA-SQrpTKdnBg==

GET
H2 200 container.html Show response
63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C9D2 6 KB
3 KB 79ms
78ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:05 GMT
expires: Mon, 26 Aug 2024 14:24:05 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 913D 6 KB
3 KB 73ms
72ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:05 GMT
expires: Mon, 26 Aug 2024 14:24:05 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 396D 47 KB
13 KB 230ms
113ms Script
application/javascript 34.197.182.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=160x600&pubId=25294052&chanId=188820212&placementId=44261492&pubCreative=54414788972&pubOrder=129093572&cb=549555660&adsafe_par&impId=
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.182.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-182-56.compute-1.amazonaws.com
Software: /
Resource Hash: 19dcd5c7ba1ff7d65ade52ad1079bd7db75a7832c2412f72df3c2ed2eda2e0ab

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5F36 0
0 106ms
104ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv133HKmtWbJVY2NcnUyJ-nD7Xg6RgZTd1c-vG0hQg1fmTZpew9iqBiBHXg8spp5f-fUqVOexX7hSsHHCs96py1KuiQ374fnsE8XIxkqnzEqKnyyKHfWDyJyAukGvGaB82tFCwHg4zKP2Z633SyLfQyXyfdCjpOpdqFeldNs7HB9X1lMSqLR_mGFHbbwHI0nJrzwBmyp0pK6U9YNih6qsiOr-gvrz9yB2-YjrIFrINaPfAP0WjSNkdNGDMoSPKO5so3YxzE60TqumZnYCJZeD8n-FhlVrmKVEaYCEnjyDb4szHrTZBhh3DFSJj3bvC3iv431Cgbu97-st0KndGtf4o_s20v154&sai=AMfl-YTW4vczyzL8VtJVJgQgDHqRPGA6q9rQubzwpJXWWnVQ-7qW05DVcL7ecCo9m5BDXOKMm23wansml48y4llwBLCxfr69y0eWdyqTTg96qo5Ovu3T03yhdbDt9AV7MA&sig=Cg0ArKJSzEgY0VeXl6ghEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET cmedianet
search.keywordblocks.com/ Frame 5F36 0
0

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5F36 181 KB
57 KB 305ms
133ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692792373905140"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 container.html Show response
63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 54C2 6 KB
3 KB 83ms
74ms Document
text/html 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:05 GMT
expires: Mon, 26 Aug 2024 14:24:05 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame ADCA 624 B
285 B 291ms
107ms Document
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSckNwEEMnO-vAEGMLC4O0BMAE&v=APEucNVBBv70yisfPqz5c9rEw_JqQC_CXpCAsC3B6QEpSzAiGGV0iQ6-eLQJV7ebiRRPtk5HodvrmMxkp8EAsA71g6HFz2C_nQ

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame C9D2 86 KB
30 KB 291ms
112ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C9D2 42 B
173 B 286ms
107ms Image
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CNxQ8TX5ltJvZr4eZLWrrLynr3Zu3QQRHzV4Ng6bdvzDoM2KXaGCAkz1kelChEkII2hs3VsqGBDAsYMhf5qJc5aSQURmdngk82z2H2PJfklSWb8xY

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C9D2 0
56 B 286ms
108ms Image
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1398298571471615481&x=1&ct=76

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame C9D2 3 KB
1 KB 337ms
149ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:14:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 584
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:14:22 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame C9D2 20 KB
8 KB 263ms
75ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:18:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:18:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C9D2 0
0 282ms
104ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRcb-NvQLTHvdfJfd7rWaxBc-pdha9-2wHB0E6i2kcdsVvGi3b-aa6cHwcfRRwfDYBRvM08ttGywJn1u9Avjk5CRpZosg
Requested by: Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C9D2 181 KB
57 KB 349ms
249ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692792373905140"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
DATA 200
OK truncated
/ Frame 14CE 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3c15124d07031d5c46efa225e58e4a29c8772f120464c52be5652a24dbc2764

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012307272333000/ Frame 2B53 222 KB
61 KB 375ms
199ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307272333000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca0b13088e4cc740b37d30f2a5dd83dba46709641f40678950fc0a8f41c9c14c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 26 Aug 2023 06:53:06 GMT
age: 113460
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62092
x-xss-protection: 0
server: sffe
etag: "72571316e23440c4"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Aug 2024 06:53:06 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012307272333000/v0/ Frame 2B53 15 KB
6 KB 250ms
74ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307272333000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fdd9957f328674a49573806215c9fe67a6f827515607cf8d7db980fc94b771c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 26 Aug 2023 20:31:28 GMT
age: 64358
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5267
x-xss-protection: 0
server: sffe
etag: "85c6144a0af9a6d8"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Aug 2024 20:31:28 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012307272333000/v0/ Frame 2B53 94 KB
28 KB 260ms
85ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307272333000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a68a7aaf623132b6e47f6d9753c49336cc812251cc91a1b82280aca86144b29a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 26 Aug 2023 16:17:16 GMT
age: 79610
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29055
x-xss-protection: 0
server: sffe
etag: "34be4077024c0aa5"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Aug 2024 16:17:16 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012307272333000/v0/ Frame 2B53 5 KB
2 KB 347ms
172ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307272333000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b70f0a80bac892e1e492a9ee5cee527ea2a9a2ff162614ff7a3acc78b2e83db0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 26 Aug 2023 16:34:17 GMT
age: 78589
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1908
x-xss-protection: 0
server: sffe
etag: "a56399b21b8bf15b"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Aug 2024 16:34:17 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012307272333000/v0/ Frame 2B53 40 KB
13 KB 349ms
174ms Script
text/javascript 2607:f8b0:4020:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012307272333000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

485567ada85d2d82f3c23210e6082009fcd03700751bf61a07a56a256b1e8918

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sat, 26 Aug 2023 23:21:41 GMT
age: 54145
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13018
x-xss-protection: 0
server: sffe
etag: "62ea6ad255afcfa9"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 25 Aug 2024 23:21:41 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 2B53 14 KB
1 KB 98ms
97ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 27 Aug 2023 14:01:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2B53 2 KB
3 KB 293ms
148ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 01:34:36 GMT
x-content-type-options: nosniff
server: cafe
age: 46170
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Mon, 28 Aug 2023 01:34:36 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2B53 295 B
424 B 292ms
148ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 01:11:47 GMT
x-content-type-options: nosniff
server: cafe
age: 47539
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Mon, 28 Aug 2023 01:11:47 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2B53 0
0 234ms
100ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQrFTSyMZqUd7tYjLl-lQCCHsLUdV11b2iFmqNrmXYGYlbuCBT95evNDrUvn2_LnxsyPw57qnkoefYX-7JZdhcAy-oaLw
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 2B53 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9608d5785c54026a0793d2acc25210e74ba4bea031b4ed68b429c2880d311be4

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 913D 2 KB
566 B 97ms
96ms Stylesheet
text/css 2607:f8b0:4020:805::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::200a Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4f393315ffc75417c9c350e709bbcca2d2e9d5640fa0925b32088ff1ed6c84f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 27 Aug 2023 12:53:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 913D 2 KB
972 B 267ms
150ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:19:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:19:29 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 913D 23 KB
9 KB 273ms
159ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:19:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 293
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9067
x-xss-protection: 0
server: cafe
etag: 16184311534176170479
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:19:13 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 913D 3 KB
1 KB 272ms
158ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:14:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 584
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:14:22 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0500 1 KB
1001 B 176ms
72ms Document
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 46577
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 01:27:49 GMT
etag: 48472445140208031
expires: Mon, 28 Aug 2023 01:27:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 913D 20 KB
8 KB 197ms
87ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:18:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:18:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 913D 0
0 208ms
111ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRggpXmy8H2LTCQg4t817aG5jJ3JAazcqdWbURi1qg7voNwWd8UjjxStGEDId7sce1TgR5yiSuyG2J7WKdjZShxkbWPrQ
Requested by: Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 913D 181 KB
57 KB 333ms
311ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692792373905140"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 e822d7071992e030a786d1a51b1f59a7.js Show response
www.gstatic.com/mysidia/ Frame 913D 35 KB
15 KB 240ms
72ms Script
text/javascript 2607:f8b0:4020:807::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/e822d7071992e030a786d1a51b1f59a7.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0cbbfe7e06fd7a9274bcdf96bde690f294cdef1ba01f2f20c9a9bd09eb1502b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 01:19:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133454
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14926
x-xss-protection: 0
last-modified: Tue, 22 Aug 2023 21:43:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Fri, 24 Nov 2023 01:19:52 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 913D 92 KB
92 KB 254ms
73ms Image
image/jpeg 2607:f8b0:4020:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQPdnJLvbGeAzTs-Lnt72kRjCO0tDd4PTwSSRhEAycekV-87qg0r6UBJufySA&usqp=CAI

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9b840d6615c475d0852e462df613b941d822540a56510881b5edae1b5bb97f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 10:57:43 GMT
x-content-type-options: nosniff
age: 271583
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94148
x-xss-protection: 0
last-modified: Thu, 21 Mar 2024 20:23:13 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 23 Aug 2024 10:57:43 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 913D 42 KB
42 KB 258ms
75ms Image
image/jpeg 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcSC6BACNqKkVPqA3wZ32w1c7z5p9dCoZyaWJX0OPOnPEbd1USs&usqp=CAI

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d03a659e72c02fe9b403fb3df9d0921880bec3cb4aa433bf29a40e082cc6fe38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 10:54:41 GMT
x-content-type-options: nosniff
age: 98965
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42941
x-xss-protection: 0
last-modified: Sun, 16 Apr 2023 09:38:47 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sun, 25 Aug 2024 10:54:41 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 913D 67 KB
67 KB 275ms
84ms Image
image/jpeg 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcTtnV4XTNBpbHNjEGBU-ogdyXQeAMu4h7GWy-o6_unO9Fn7x8YT9Gq6L9qlsA&usqp=CAI

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e1a9b64ef61d81d14debbd19b42547879aa635d37a69e03807a85a82d44c20b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Fri, 25 Aug 2023 20:05:28 GMT
x-content-type-options: nosniff
age: 152318
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68790
x-xss-protection: 0
last-modified: Fri, 04 Nov 2022 05:11:56 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 24 Aug 2024 20:05:28 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 913D 10 KB
11 KB 265ms
74ms Image
image/jpeg 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcS1Krlwwo2FzF9d88LDvNp5Gp9HtcZeIYD3Jdxtq-hYKKhwBql7aCs05_v2FA&usqp=CAI

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fac391178b8132bb5fb1b8e7096b26add5f1bb2fbb73a3a14c145e0b746fe34b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Fri, 25 Aug 2023 20:12:07 GMT
x-content-type-options: nosniff
age: 151919
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10571
x-xss-protection: 0
last-modified: Sat, 12 Nov 2022 10:04:22 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 24 Aug 2024 20:12:07 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 913D 11 KB
12 KB 266ms
75ms Image
image/png 2607:f8b0:4020:805::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSzr_vIt-L9UV11mttRPraFB7qdoe_zAyPKpodGrbu8jxX7BuJ8&usqp=CAI

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:805::200e Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bad66a0d8415b5c7060c7bee51dd8d81972fb48c520142af34eff6c721b95516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 10:22:49 GMT
x-content-type-options: nosniff
age: 273677
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11600
x-xss-protection: 0
last-modified: Thu, 17 Jun 2021 20:38:18 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 23 Aug 2024 10:22:49 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1A01 624 B
577 B 131ms
104ms Document
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN2JswIQ7J7MAhir6a7zATAB&v=APEucNVMP3buThg4DqNbL9BG_GwV7J-_H6LGaGH4RflEzEdFX8VaJBKAf6p1G0RSjYxRAhL6MGFqXt3Fw3gzSvahucCXDS1Tcg

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 54C2 86 KB
30 KB 225ms
199ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30167
x-xss-protection: 0
server: cafe
etag: 12949109546734229676
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54C2 42 B
107 B 134ms
109ms Image
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AoqcZqoLxZ56nSKDN9ZIQaI0iAzEhb-Z24US01wbZB1KRhOPH2xH1mGwWmzLnqgT4mQEYvwKTndmy2CrbKkodpsIZwOn3bpk7Y4VSyrnChsko01N0

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54C2 0
58 B 133ms
108ms Image
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=12706996704164635181&x=1&ct=77

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 54C2 3 KB
1 KB 201ms
165ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/window_focus_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:14:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 584
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:14:22 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/ Frame 54C2 20 KB
8 KB 131ms
96ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230823/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:18:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 353
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8273
x-xss-protection: 0
server: cafe
etag: 16365778639179992903
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:18:13 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 54C2 0
0 129ms
105ms Image
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQelxul4LDMmc8oLKBhta8MwJ534YzvHTg0frKyo3WIRs83dZy0y_8kfq6OWxnnkzHySISxOOvy7sp9P4MJ5RWOXD8cEg
Requested by: Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 54C2 181 KB
57 KB 304ms
304ms Script
text/javascript 2607:f8b0:4020:804::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:804::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1692792373905140"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:06 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 2B53 33 KB
33 KB 76ms
71ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://windowsxlive.saftawy.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 01:29:39 GMT
x-content-type-options: nosniff
age: 132867
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 01:29:39 GMT

GET
H2 200 main.19.8.439.js Show response
static.adsafeprotected.com/ Frame 396D 207 KB
65 KB 223ms
73ms Script
application/javascript 2600:9000:25f3:400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.439.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=160x600&pubId=25294052&chanId=188820212&placementId=44261492&pubCreative=54414788972&pubOrder=129093572&cb=549555660&adsafe_par&impId=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f3:400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: efc2b5f3cfb42ac86c11900be6091d645853af46ab4f01bfba7280c3ac37ae02

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 13:44:37 GMT
x-amz-version-id: jxULgCd28jZVPRI.j5D8yH73I4fVMdj5
content-encoding: gzip
via: 1.1 28541d1c5ba94fa4ae7d6f7a2c07f4f8.cloudfront.net (CloudFront)
x-amz-cf-pop: CMH68-P3
age: 1557570
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 08 Aug 2023 19:01:42 GMT
server: AmazonS3
etag: W/"f00fcc2e1b804b8a3edfbb8cb19bddaa"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: WCQf8tvVjz1kFBKI0J5_rBh-pD81I2mox9StFTU9hlxxmeh9HQximw==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESELC6JZQufca-T6OSGJ15CHo&google_cver=1&google_push=AXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGi...
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp&google_cver=1&googl...

170 B
188 B

99ms
93ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp&google_cver=1&google_gid=CAESELC6JZQufca-T6OSGJ15CHo&google_hm=UTc0NjQzMjY0NjE1NDgxNjUwNDc=

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRV8bQ7Ib7hrmFEQbTjrs11RMxs30phLcrZ-hCQFG8f4CZG8kpx9Wk3IQ6DC3dGimnbvRi3ORL9DHDCqq9W8UzJmB0CTgEp&google_cver=1&google_gid=CAESELC6JZQufca-T6OSGJ15CHo&google_hm=UTc0NjQzMjY0NjE1NDgxNjUwNDc=
Content-Type: text/html
Cache-Control: max-age=52982
Connection: keep-alive
Content-Length: 154

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmRJK-UywWo2qPUuXuUDt6fj_azqixUyH26xjhYCmuI...

170 B
188 B

95ms
94ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmRJK-UywWo2qPUuXuUDt6fj_azqixUyH26xjhYCmuIOFg4So3aP3W-7eZDPl36e0F8sjEF5VShehvOWgWvz2QDJMgzCKEL2

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:05 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-788-g55788f4#dev-temp-decrease-retargeting-updates-batch i-0da94c7f55bec3b76@us-east-1b@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmRJK-UywWo2qPUuXuUDt6fj_azqixUyH26xjhYCmuIOFg4So3aP3W-7eZDPl36e0F8sjEF5VShehvOWgWvz2QDJMgzCKEL2
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEE_9PctX8fWbxN4eZanoqPU&google_cver=1&google_push=AXcoOmS-kzkAW5Djhzu0Q1rWLvLsiK8HHcSS6OEyuWLsBU-2WMU_XSQopz-2leBqRT8C3uVBIZW-X5QZCMGR4X-MxRJbUZvVAAt_
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CC62689BB1534F359EF2A228B8FA6803&google_push=AXcoOmS-kzkAW5Djhzu0Q1rWLvLsiK8HHcSS6OEyuWLsBU-2WMU_XSQopz-2leBqRT8C3uVBIZW-X5QZCMGR4X-...

170 B
188 B

95ms
94ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CC62689BB1534F359EF2A228B8FA6803&google_push=AXcoOmS-kzkAW5Djhzu0Q1rWLvLsiK8HHcSS6OEyuWLsBU-2WMU_XSQopz-2leBqRT8C3uVBIZW-X5QZCMGR4X-MxRJbUZvVAAt_

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 27 Aug 2023 14:24:06 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=CC62689BB1534F359EF2A228B8FA6803&google_push=AXcoOmS-kzkAW5Djhzu0Q1rWLvLsiK8HHcSS6OEyuWLsBU-2WMU_XSQopz-2leBqRT8C3uVBIZW-X5QZCMGR4X-MxRJbUZvVAAt_
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 26 Aug 2023 14:24:06 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEJtpij3zmHcswjLc6OUqyqs&google_cver=1&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NY...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEJtpij3zmHcswjLc6OUqyqs&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NY...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NYGzWHqSjwWStlq9t&google_hm=eEtPdEx3QkhSQjNfV3dr...

170 B
188 B

105ms
99ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NYGzWHqSjwWStlq9t&google_hm=eEtPdEx3QkhSQjNfV3drNlN6MGI=

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRROd9wWa7aSKdINrQYynCHgfwESp8oVGvaaNIicgXdEpHfNQcqpJEGo09Df5Wxzlw8_K4JlmRsyU9NYGzWHqSjwWStlq9t&google_hm=eEtPdEx3QkhSQjNfV3drNlN6MGI=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

96ms
95ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmR77H8W-DJl2YSYZoXJ6-Qq1oy3112hUik6dvPvHuxTaaz5LRnsPQbMgawJ1ON2KCysZVhXxGrGKRhTks0C91FVNthcvlan

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmR77H8W-DJl2YSYZoXJ6-Qq1oy3112hUik6dvPvHuxTaaz5LRnsPQbMgawJ1ON2KCysZVhXxGrGKRhTks0C91FVNthcvlan
date: Sun, 27 Aug 2023 14:24:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEK3G7mHcYmmZ32RE6z3jdy4&google_cver=1&google_push=AXcoOmT0Y2hQXtAaCFsUpy_uuc8LqkU-KVcg5LdJkpuE90dTmwmYhp6LxRj7jsBODLdjFQN9P6BNsk...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmT0Y2hQXtAaCFsUpy_uuc8LqkU-KVcg5LdJkpuE90dTmwmYhp6LxRj7jsBODLdjFQN9P6BNski4oU0A3B-AQXz-cpffHlqO&google_hm=MjE2NTA2Nj...

170 B
188 B

106ms
99ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmT0Y2hQXtAaCFsUpy_uuc8LqkU-KVcg5LdJkpuE90dTmwmYhp6LxRj7jsBODLdjFQN9P6BNski4oU0A3B-AQXz-cpffHlqO&google_hm=MjE2NTA2NjkwNTQzMjMxMDAx

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AXcoOmT0Y2hQXtAaCFsUpy_uuc8LqkU-KVcg5LdJkpuE90dTmwmYhp6LxRj7jsBODLdjFQN9P6BNski4oU0A3B-AQXz-cpffHlqO&google_hm=MjE2NTA2NjkwNTQzMjMxMDAx
date: Sun, 27 Aug 2023 14:24:06 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0500
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEB1ShcsI5p11PZNIe26cFjA&google_cver=1&google_push=AXcoOmQv-llc0U4q4dfYXJkno4XrV8bVfTVxAu0kEkA6cJUI_fKre0rMARlVpsjVoReMHdzWBgEUXolpqCP3oeCGt18Yz9tOlPNf
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmQv-llc0U4q4dfYXJkno4XrV8bVfTVxAu0kEkA6cJUI_fKre0rMARlVpsjVoReMHdzWBgEUXolpqCP3oeCGt18Yz9tOlPNf&google_hm=cb2524cd04f0865c2d6...

170 B
188 B

96ms
95ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmQv-llc0U4q4dfYXJkno4XrV8bVfTVxAu0kEkA6cJUI_fKre0rMARlVpsjVoReMHdzWBgEUXolpqCP3oeCGt18Yz9tOlPNf&google_hm=cb2524cd04f0865c2d6fc3255a792a88

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AXcoOmQv-llc0U4q4dfYXJkno4XrV8bVfTVxAu0kEkA6cJUI_fKre0rMARlVpsjVoReMHdzWBgEUXolpqCP3oeCGt18Yz9tOlPNf&google_hm=cb2524cd04f0865c2d6fc3255a792a88
date: Sun, 27 Aug 2023 14:24:06 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0500 0
12 B 116ms
100ms Image
text/html 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LMX8vkdWk031pSFlimHtXg7F2EJHKwDo8oXV4KWMMfApMVWtfMZ6fJxz1pSSDkDotMS2Yp

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1A01
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1

43 B
764 B

70ms
68ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN2JswIQ7J7MAhir6a7zATAB&v=APEucNVMP3buThg4DqNbL9BG_GwV7J-_H6LGaGH4RflEzEdFX8VaJBKAf6p1G0RSjYxRAhL6MGFqXt3Fw3gzSvahucCXDS1Tcg
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1A01
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZOtchvwmdzIifd8VY0TdywAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1

43 B
764 B

72ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN2JswIQ7J7MAhir6a7zATAB&v=APEucNVMP3buThg4DqNbL9BG_GwV7J-_H6LGaGH4RflEzEdFX8VaJBKAf6p1G0RSjYxRAhL6MGFqXt3Fw3gzSvahucCXDS1Tcg
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 1A01
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1

43 B
839 B

93ms
92ms

Image
image/gif

68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN2JswIQ7J7MAhir6a7zATAB&v=APEucNVMP3buThg4DqNbL9BG_GwV7J-_H6LGaGH4RflEzEdFX8VaJBKAf6p1G0RSjYxRAhL6MGFqXt3Fw3gzSvahucCXDS1Tcg

Protocol

Server

68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
an-x-request-uuid: 92ed9855-4478-4c55-b11b-3a44f3e1d4d8
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.74; 38.132.118.74; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1A01
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D

170 B
188 B

96ms
96ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D

Requested by

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
an-x-request-uuid: ac562792-2c06-40c0-a8b9-f964df6261ac
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D
x-proxy-origin: 38.132.118.74; 38.132.118.74; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 913D 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a88c983cfdc75cee9ae18b2b8bf8defbe9561eba9c98210f375fb5ee50fffa4

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame ADCA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1

43 B
631 B

69ms
67ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSckNwEEMnO-vAEGMLC4O0BMAE&v=APEucNVBBv70yisfPqz5c9rEw_JqQC_CXpCAsC3B6QEpSzAiGGV0iQ6-eLQJV7ebiRRPtk5HodvrmMxkp8EAsA71g6HFz2C_nQ
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame ADCA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZOtchvwmdzIifd8VY0TdywAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1

43 B
631 B

72ms
66ms

Image
image/gif

192.40.39.223
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSckNwEEMnO-vAEGMLC4O0BMAE&v=APEucNVBBv70yisfPqz5c9rEw_JqQC_CXpCAsC3B6QEpSzAiGGV0iQ6-eLQJV7ebiRRPtk5HodvrmMxkp8EAsA71g6HFz2C_nQ
Protocol: HTTP/1.1
Server: 192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECQ2SBet4ejwfpTZcqsVOLc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame ADCA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1

43 B
839 B

69ms
68ms

Image
image/gif

68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSckNwEEMnO-vAEGMLC4O0BMAE&v=APEucNVBBv70yisfPqz5c9rEw_JqQC_CXpCAsC3B6QEpSzAiGGV0iQ6-eLQJV7ebiRRPtk5HodvrmMxkp8EAsA71g6HFz2C_nQ

Protocol

Server

68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
an-x-request-uuid: 6a0939eb-af86-41c9-9abb-c95aeb93c6dd
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 38.132.118.74; 38.132.118.74; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEA3PpGw0mhPK41Rs4Uql1xc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ADCA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D

170 B
188 B

96ms
95ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D

Requested by

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
an-x-request-uuid: b01ee16e-d756-4cc8-9f32-1b3ca5f035cc
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjM4OTY0NjA0OTQzNzE0NDA0MA%3D%3D
x-proxy-origin: 38.132.118.74; 38.132.118.74; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 5F36 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30c115ca04d30ca0b431acb2849d869c2c43f64ebba1c2daca82c4da7d6b4510

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5F36 0
0 108ms
104ms Fetch
image/gif 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvG-FZqaDjX0hObdBUDr7htKoRjx5X0ybngutuQUvMsiwc5EI543YD02ZNCTiEwcpQ0jTG9eDqHx3PdSUwRbgo93uM043UuyfpMPpUwJFACeT2vQdFC7ygvTXb3o0nciZxvzcxcPL2cv57aaGReL4JpFL62TKSNppIZraA3MU2_6jGMoYWJMz4JHuFSBGkaEU2UTNpcmLxcW7bldvVQdmNjTauxLz35yD8esDpzfNc5K3L1_RsyMzfuFDehJ8s8T77rrXUKzMbmWru0fjPO4s4ToqFexVOIp-aauyc9onjtYJYN9sTXANDTJhFp6jLn4Xo5_4-JtS_tsuZ1JgzOE0S00Xz0b97y6g&sai=AMfl-YT3Wm7QH-8t-mN6Wsldc5jGlUuuH-wZWZeKfMQibcC0LHLqbuNLhgCMA6tOVOihNu14wNFv7vDV9NKQ80fRngctcQY78ZfQDv2o-XNNJqzBtweEoYpywektm7-KUQ&sig=Cg0ArKJSzJLVY2riGSLaEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Aug 2023 14:24:06 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C9D2 0
56 B 107ms
103ms Ping
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1893522312939&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C9D2 0
47 B 105ms
103ms Ping
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1893522312939&version=m202307240101&ct=76&x=1&cor=1398298571471615500

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C9D2 88 KB
37 KB 136ms
134ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BazKnbCwYXC850TLS_TtOnp80vRCW6kFIJvFx5AuzKiVho_od5N3Duy7l3Wo_6uWZhq90NwGHQrM8uCoxGSXsJCPTp-A&cry=1&dbm_d=AKAmf-A3ykh931pEDJbGwwvpI95IRXZ3U0hMsMsIw87wKQXNfO980gBCVanqGH44FpJYIwSwTzvfZC386dbmbmqQFUbWTVu6QQjAncq81Ann-lTpOTpeR6blfQp8fjToXU-21hP3FRqC8xIFsOm5fGljQ6zIaOvNfDMrUC-nkz_WA1kB-D-7ukKjOmrhGDp8uMjyFvqmlRNh958wvgzAxNE9GFhe0YrRXKXfyFKaq1zvwGOoKajHgxGAPCJRXLi3_zDgIvPN0BWx3b6ilBzS1qDWZ9Ne3bJe7c2jG6pmAOHAWAvju3JyuBKupqLmV2OKGnwNlnBHOVU37csewupqjCwBjGUOAe2m7m2q8qn1uGa5UV65hQiRRY-oPEZ52CfBm0ruSkbtD_LX2gtssFnth0FXfU8FUgPy5WWFWintGITqH7PeAlSrK5invYcaYujBXg_kGjPIe6zkUH3ob_s292A0NgtEMZlPFrD3luAelhxL0r1xWicyu8zDYZAA8EDw-XDCJtf1XfueUx9snll4CSSq8x63qhl0wba4qFHRoCda4Dgsg9Vi8oIAY1XxVadq2gLmsBh1EPWbraXarLml7gVciPdwYKvXRO6XLAGx7Dz0lQ0OteNR9urF1y9ez19-BHxpu9ebxnRW7775cnIq8l7Xsz_p5yKkQBw5k6RV6UY3_3hZ70iTbC-sGkASn4ERCZATEMBE_Ev7EbUqZIu_Zbyt2TdFNx_XKLyDYRMJ7XRSwp9McEeSfB9-JAUqpHCwiZdgGj193ddDTkd4CB6-WRmDLLTv5oZInHIJv6f2UTLlN83O_PcqpEvbAhwuo4_blnojY1PlTeR7IOu27RGBDwZMVDyPWAfjmSQG28wfjfUN2_-rurfPbeJBXLbqbQN3aBtdQi_Z0EyXgQnIAAaQNlT8LYnH93JgmAU2SKQ6_hfo_1lX1j_bCbvHrbWs3fa0xuqDwQN8bIXmy7nl6P7i2X_hbfKUs6vamyZwA5Gr1bS0ZaGK2J3VxH_eB14wwQ06Ulxl0kgxRgTbo4FHZvJ5H8oNfaHKyJCMViI_OsHx-3OvFLsp-iCNU8mSgXka8Rqz-adyzuuKvNDtGNbsi_lOu38nml92lLJy3Fdo5lLKW19MUpo7g3mHP4Rdvc5CE0fWu3iiKFMqD15GrgXcID9aaZi4oHUSL44epKibQlEYGbt_PaNX4qoygIv_nbm2XiGqVKMYEKU66pxMkEMVSzfb1B8cRuswjPBVDSDog_QGvcxRsaemBZN-LOZGstnN6YRNGzPUSZ5qgS9eEkOvRqUisCc5vwB6hRzLW5pOoeeBeqrD65hCElctUSp2QrQMhCN-ftruzM0YVsgloLAw8lJ27XGMdwWtWDxQ7eoaE4MyRrWrrYUXE5aUWUkwSf0hhrWQy__ic6EiR9UC6UTEDnkz2AmYYbKPmjuhTim2FMD9SOkgeLFbRQGKmI8eCZw635xcyIrMi5g_yfJNk7eVAr5kL-1lVIJC5fhsxqZm62myNYrgNC3S3RWETtwwd67eW6McV6U8Bn8ENetn6i9cJNABiGq4avezAE8p8eXLIugAmE8zFsncTr-ZKczUdMfEzZADS4cp9WoB4HA43DETmTIrzikcDlHccwkhXgIOdsNucd8HNULqWATPVqqxmmMZyPy2hDqNJayNQKUG6Lh-ou3cl9k3M_kBEk99SVoE737KXJ2ltkwIPI4_L-PPRbOkJZUrpuZJWoeGKvUtcOZ_KZSesy44faQa9QXMUTLcZa-0d0IgxpT5-tlMraNV66B_Z0pLLSonmY9EapfP0ScZLgp9kV2HGV0WnsFPVpI6mgJIwb6Hlwre2etGkQkDmo3HZE2KouVrsGl8XWBz5ZVKlSq5fSQhyXLs9DJlBh8wMGIHPMsAwuPW0JXPr3qJaGRJICFqgCv3SWSHk_1bPQ7XLlSpM98bJXpjkrL6CiXnuhU7aBsI6M__6BlZvbblA956h_L2ORlx5lQ21uf5CDyaSavA78mz4WZFT25aOvkb40PGtw3KSn3WbSxASF9PKjbv-hAhBZ2sHjU_V9TaqVo1OCYs3uTIXjWaVYXUoTJM9OuLYrThsMK6VY8Zb6sh4jD1qmw0tOw_KampYlAzNVgiKsGkZrcRNNyTUBjR7EVuELoU4Lx2DXsqt8RwN8FPsRDXq9RpfoTCY3JVDfWvgiQLJGn1Qw_jM8ZaHvv1NBO-ditZFxrakOsYD1cWSWQ9GIeE06WoOZCFzlRISCTOa3MmMTLTIXoDr56AR9mTR1tYtBvReP1R47nUzD70ZnZqg8wJddCCWVA4RejNu8PJ0BNL50hO8M9uQMgy0fm2U0kvdIwdYcv0V_QBBydl3vqRJFOZDK6UlesqYEkKpkHCEoTzPFlNBZ8_Q7cnLDL8ZXkXCMa8XxNj35BmzFQSmgl9SepwEvmy-rXFh-4n5MoHR0NCp3hFHFsNiVWFYveSnVazxyJ8fEz4pBmr53BIFo4ITBG7dvJbr8p8PAGAAojpcnTAPqIiNW3rRAyLVW7f8bNxj_a_kvXm91M0Ti86Zx4hQT7zr2Zj2GpQc9vMF1DtNCrb4947asJJghYMI7YcSVc9galeOwhmz3iwoVCXNTAbfpcmRE_YDwkgbd8Z0cYG8i5Z_K0kV2OwJkPQLLm6KkH9oiKmFBNm-mRoC4SqjtaWmQDoQypmFHaWGMbOQ5Xm0y_esDOuybQox9zMbBjSUSNNTOBgw2QUgv2FyfWJOMHzXB57WoxDQzBK2z3oyU887ezw7Ous4Tr69-9cj-4QoncC5r5OPdkbg81WoVDr0yX5i0-m9-I4mBsrAsv_L95oXlys5SWTgSPBL6YB9UZlVyZQn-SONipfy74gge4v1DnhrpF_IVhMXQQG33sQjbmJf2-U3-m4eGZ16OPhMl1nGZue7iM8I5ODGTbdwSHHs6k3sDhE8FtNLXMEfZSnRac6tckUxhK2jMnRLZ1vrBuiLxsC23EqA13v7YSiZUGHCzBP0VZjxg2jI0QpqhmaTQ0y7sgBUtKi1-4oy1BJY-8owiXM3izSTMF3ELslSNCFrwO_WwE5pBm7LAye3BjSNFpeO96hRTAyNVp86S4dv1-ZaC00Yntx4B8ltPJYXqp6uyzUXqbENg16-zkca6eFY8n5l3AaqcwKSyQoobiwf97pojHIZ7oEZ2bExjYN9qGY928jshOHAlK6PpaXtWQxPfMX8Ca1pem9GC7ZRdxWo-Bw0YLa8QmoIKLe9eEcA-SQ9gbnAPa3mHUCJufiX2MlK_9aJN5yoD3tUEtTlT8w_d9dupdCjymzoBC1eiHAOsnIq1eUl6BZSPrtVs6e5UqLee_HOZG4bTop7D8g4d4JmpIGvs5HDnjnaXsgDY0QG502BnKS4DFnyj2w5nNFAZOZJB6LMR0I__9etX0kjO1r066f0Ot9R88da0okwhdqE2LBg7BcjFujcIt7iXX1NarcFQJD&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ds=l&xdt=1&iif=1&cor=1398298571471615500&adk=1964084972&idt=378&cac=0&dtd=32

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

046056e1f1697fc205d4938137b935a6f05f378791015844d7adf1425cf21430

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37501
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54C2 0
56 B 103ms
101ms Ping
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8999221497232&version=m202307240101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54C2 0
56 B 103ms
103ms Ping
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8999221497232&version=m202307240101&ct=77&x=1&cor=12706996704164635000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 54C2 29 KB
17 KB 177ms
177ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A6vywtHB97-BRPW6mKQ9ZflJUQ2Rf6Jif75Obf4jE2OnGONM46d66VcYGvC6uGMoxFcFgFQSEoXZYc-1Z5VYiGov84_9Ac_hyB1sYTsRIxRiM2rEwJR4o1zyzryiWl-j1GwLoDFgD4MLIkTWWEmqpMmPUpLs70wS7L7ATvtWiMkNOzBQA&dbm_d=AKAmf-BcxhYTp1gyBaBZw_qH3WGgkhPguk7mvTzcfi_Xu-_dfWaZnmZryGaGj9eYzggzHP2ut0i1pzXIkTHr0R4lWut0r42HK3zgV8Cpp_VDb0YPk-mphZY_vV2n3ertLs8GXuhpN-4C2WLIrG7E7k6ffs_qXfWm_Zs-met78hKbhk-tTijJtv0QYh_Zr8Lbnfv-1YBSQeuMU2-CavvplzZiU2j5gvois6jEOJybwZqqkERE5U1R6XIrkxFVbxLaVUvWQtO-L41t_z2zprL7sv2h7Z6g3XfvkANeXXAnSB-ulRPbI2HfKlHZVQF_IRii9MCs3BJFGICdM_6hOxk2BMBRhMfsNzRmfI5U-uNJN9LYH9W-WjGkN1IPQX53H0d-dJ-ym8xgckE-2aPfqxZfvE6gXs5ebYkvjiOyZlTvwnNQRNLPU-MIl3IGLqF_L4hfj1NTLspYDG9U2KdeoLhkFZP09WpBfbQC75I0WQDwGc_k4XTmReZXfZJOqIyZ-mlTstvXhpTgjJMet73Nht3MywzquiM50s8499UfBOZJsOvM8XTEnD6Xkk-yP71YYAfO2lEkSqw6rfqc1kpXANK72bVqXO7lkFByECShVuVxeWiB8h2C7thkxikD2ndMlqyg4ZQf309rSVFuDrde4sIi6vNiPo3NqZBUZWC9U_y9YDJpPuwvSgKSuZpouSRuC1y2oPbPz9KTkY_EYPgw_zxgFLSWGraN8WL69G5a_Eg4e5ovvrBE-TCmMZcgL8FH_1jwBPEfJ_gbXIRb3EchzP5otus0bflc-a8UGakkmGuxkg8Y-wFWaPQa9o8nduQNr9p4YWgRfXbjioxKVm_yw9_GtGsclmrQ68RAkMvbFHP1WoSBbvB3R6aGW1OtTzwxARlEEJSY8tZuv2umg7SBBvhzT2Am9txJ3iGCGwE_2uhImA0bfZwT0gyhVFOZaB8kxhyiF_InjNLOmkV0lQN9FENEa4gahr4DHGjBMwYtDY0ry8PMA9D2oM4Fq5N_VIDQkyq7ySk_JEIEQBROCBsYMFylaRwGdsg7HvzSzAnxUlYkbysjIs8f7a2AHi--CfpM-RYuQWaZXxYeZF6LWPRj534XHVX5OGOP8j6V7rbyDxrrNYCnG3KwJQUQe-Cjwvw0ES1KMHhbWKNyZam9yiMK7KY-Tfk9prMwbjB-eAkl8CYQ42R2-C8tMsN0i_-m3Hb659YUKsOAGnWYEd1sbP_uUc2LDVOALKAe4WLhKUYjTHF4TxSjAYLJByHCgVOBdTIQwXhjds6FtRqH8tVm_zbjIj8TV4GUOBKv4v5duC5r2EHXHdu_jNmdlsHp7Y-xupkZW-Hn-R9qBh7I-qZ_Mw_okSk9BCZ5-D3LaLqJuld1ljCk1wDqS6aDeakcn5omJY81jOqnAOtH3IGq9Jn4-bRfPQ42s54ZVhBJFdnHpy_dAk5iHtu55tk3sx2If925g1CxK7nBcngu3EysG5qkCGUPHwWNKQoLwiq848YAaYfIPXEOVq11Xo34rcx9ZoauTtVu5fNGAZnYr8fw2K6urQAiK46tqj4n-FyLPQNBXc2hTaAYxmxZrJujh9vSHGps3V-KOWBS55MKqeyBNeiatGY9uHohiqfBrDcJDNjh6C1I_CuY8h3vm-w--YP2C2Nd-qP6ZfFmsUTSXCnVgf1yTgeT5mRpkiYCo6G3BvXnbZk68uk8Fc0c2L1XN8cB_u6Mrp6UVsbjz8GN1bCT306OMUfUH_WWvL_zcaUN_vEXl2PXhrhFKKlpk61QYRwhfSURIJubAqlglvXtvmu1pQ95g-2744guCSchN1zqawYoiai_-MXHINdoqlUYfw7VrqrJHA73EhVjmScAW6_hyR47uYulWKPSaQI3TrFMiPv-di9lAHMwCIEApG3YH3EhsJK0J0EmCseSs3X_2BAplU8wnIsL9tSLwwNUglDjyJW8l7l3sSaGwrmdk5tDCc509CkNwx45txnIsD8cMOtCit8Jg-_kOn8M-TfuVTQ_Tr_sYH3qI5gAUS_ai04l5D2QNnkW7imX_P6zWLU_XhXbNFy_0FZvuU9n8F9bcRCs_muERy6ZKDppIgpfyRunozc9XJ5ZUeCOwqPf3t3W7uLoVNFoLEa1Wf4gOUSqM0eGPbnpj-d4a6uknLgxLn3b4-GKMFb7DFfA3AqmNjByBHfIbeiOn5IpeLZ1FvDinn4UnFFToDRvO7TjeCM2lOT4pXUM2sr_7e0FOXBvnpCjQA0H6MIyPPIp7lgYr_lodw8LZiL_8EozXuKE55l1fsrSTqvxy5O3OflbKyBl0eJsfR6az2S_H6qRs9gcA8QlGSfSPCk1anz5qM0N_I1Yzd0Rxsn-hhz8nQWoAUAu0uCzQ6PEyQ5BzqDf3DUDdHBgzyX8eBS5ttFM2dnqfEFw-XpkIed8Z9fIcaQu6BJezOTry85BTzEtBPrqs8DgKPzSQyMoqqmmQHveAqAEgi7Yk65O90RfRGOJ3nPc_RUEgWfGHYMcLLRPjGtTY6tdlsj0lecSZkLlO_k_7p1qQA4rwAe2mxAjwEqTKJBpNb0tHcNOUf0sj2LBpStFntbMST-19Ui3IE-hSJ5ywOLQcVHm5XBPC5nGjhm1ulvtTjrrx01xfDO07peaHOF_XNw2YchRkTnCs28GfRkZE5FrDSoJArRSDd6WvzB5ec3rmalkNPgcz_l1JPllRZmNnaWyemu_4pWRButyGZ5s99ZIXdyQh37UzhCs85XAhFIZX3bUxifw0a4DtIWtyjoQBIuVVm6mWxwoQ4PeEjZoMXItrwBqKwFDsQQZ86WNgfcxW22enZvHMFDTDGAKDWgPrPaenMi_Jh5kCBNI8I6KrPt0lBkLF-mTKRyvrXWpkVPYreRuAi4rcuZiFvvYe5THb1VlnynlG63wFA6sMxpm7PWrkw1Xq-P9Tm1mGY8b-EAO1fy85LHXbFeyE-3hTZIDThNODG2RNUtykkUGq1cgEqCPcRLqlZMv77TBuJROvKw_WiSPUJJrFI3ZCoVKyVwpgjtqyenXftttIDM7UoIiqVUtPfFU2VIsaQHoiIgxrChKbEfIWxQUujsC2d_w_vZJBW8g8vIBnMC5gZ23VyYmz92NLwlmMYsdukpQEcPn-5pTfN8neD_bde55CMTKS-WJtn7o8QLZfCizSktr4BF24B99xRSzAr41qVFK0luMScDUiTY9_lG9aHK928tptxWvmVuPs7yxcN-3NBBA0zPLnfx3xAtV4eXTYu38VmqylLJlbcL5oZPVy4E0dp8mUc_D3PPymDDtmrryAflpwYDNu4gKenovtzREcwjgeXrdLdXAivNfM8EF2uSrh6MQZmkGEWo9pQTkmdSuC2QSCpc6MqpbIA_FoE-e0oLuXFK7fcODJDJYGthNG-nmQ5ly5hpumuMR58BoOpy0QiOXv3mQOb0l_qY9-gPbhTVICRQEg0XAD9LNKBbKtzJT8BmA8EX5kRhAw-OeT0t_gBEqAUI-yeONGE_stJRFYWoAMdDdDBjPpgO0RfYBakmjL8WsJsCj5c0Gew5LCnAFOwKzle-Dq5TLqAddJncKpftpxTuoFTDq4msjeOIvKh0PC_DJXzm85tpBJG_j9BD5pPkxkGimpqznpBopqWfzLB4D6El5XB515Fiz_RucAWzlX5TJCmrSDf5iC8eijxXN-eh7Ol69JCEbpszABkjSDjJ-7kb98sy-es3zA2BV6hrcx2Z1iU-ilUc1oSwXc4oG_Ctu6Q&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ds=l&xdt=1&iif=1&cor=12706996704164635000&adk=2857193498&idt=260&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22a85f78f1f3eef33148c79b6dc94b7814ea93700d2f2d15e7d2184c8a874d48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17570
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame DA51 91 KB
23 KB 72ms
71ms Script
application/javascript 2600:9000:25f3:400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f3:400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 17 May 2023 13:18:05 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 28541d1c5ba94fa4ae7d6f7a2c07f4f8.cloudfront.net (CloudFront)
x-amz-cf-pop: CMH68-P3
age: 8816762
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: fn0bqF9GTBSYZlvDddzPYn6iBYJEdkblbnSiDu9UK5otL5W2Et9AoA==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
216 B 81ms
81ms Image
image/gif 34.197.182.56
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=7529&campId=160x600&pubId=25294052&chanId=188820212&placementId=44261492&pubCreative=54414788972&pubOrder=129093572&cb=549555660&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&adsafe_type=abcedfq&adsafe_jsinfo=,id:86599826-8b18-de54-5519-a686e0871993,c:msHA6s,sl:outOfView,em:true,fr:true,thd:1,mn:jsserver-primary-67bdfc9f5d-f8hsm,rg:va,pt:1-5-15,wc:0.0.1600.1200,ac:1193.1227.160.600,am:i,cc:1193.1227.160.600,piv:0,obst:0,th:0,reas:l,mu:10000,br:c,bru:c,an:n,oam:0,scm:publ1.grpm1,mtim:387,mot:0,app:0,maw:0,fm:tO8Z6en+11%7C12%7C13%7C14%7C151%7C161%7C17*.7529%7C171%7C181%7C19%7C1a,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:413,oid:6105e5ba-44e5-11ee-a4dc-ba7dbc5a77cd,v:19.8.439,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.197.182.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-182-56.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:06 GMT
server: nginx
x-server-name: app26.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 2B53
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

133ms
126ms

Image
text/html

2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H3
Server: 2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Redirect headers

date: Sun, 27 Aug 2023 14:24:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2B53 2 KB
3 KB 91ms
89ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 01:34:36 GMT
x-content-type-options: nosniff
server: cafe
age: 46170
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Mon, 28 Aug 2023 01:34:36 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2B53 295 B
353 B 94ms
93ms Image
image/png 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 01:11:47 GMT
x-content-type-options: nosniff
server: cafe
age: 47539
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Mon, 28 Aug 2023 01:11:47 GMT

GET
H3 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 913D 20 KB
20 KB 95ms
95ms Font
font/woff2 2607:f8b0:4020:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2003 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 01:08:14 GMT
x-content-type-options: nosniff
age: 134152
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20784
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:21:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 01:08:14 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
216 B 401ms
119ms Image
image/gif 2600:1f13:800:7780:78aa:1966:9c24:9c12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=86599826-8b18-de54-5519-a686e0871993&tv=%7Bc:msHA8H,pingTime:-2,time:552,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:258,beZ:260,mfA:645,cmA:646,inA:646,inZ:651,prA:652,prZ:662,si:672,poA:673,poZ:703,cmZ:703,mfZ:703,loA:767,loZ:771,ltA:809,ltZ:809,mdA:260,mdZ:560%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:l,w:160,h:600,t:413%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:552,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:412,wc:0.0.1600.1200,ac:1193.1227.160.600,am:i,cc:1193.1227.160.600,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B163~0%5D,as:%5B163~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:tO8Z6en+11%7C12%7C13%7C14%7C151%7C161%7C17*.7529%7C171%7C181%7C19%7C1a,idMap:17*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:415,slid:%5Bgoogle_ads_iframe_/4585/ns.windowsxlive/homepage_4,google_ads_iframe_/4585/ns.windowsxlive/homepage_4__container__,nsgpt-skyscraper-1,text-11,secondary,content,page%5D,sinceFw:136,readyFired:true%7D&br=c
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:78aa:1966:9c24:9c12 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: nginx
x-server-name: dt08.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame C9D2 111 KB
39 KB 287ms
71ms Script
text/javascript 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Origin: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 01:15:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47345
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 28 Aug 2023 01:15:01 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230823/r20110914/elements/html/ Frame C9D2 11 KB
4 KB 93ms
89ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230823/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BazKnbCwYXC850TLS_TtOnp80vRCW6kFIJvFx5AuzKiVho_od5N3Duy7l3Wo_6uWZhq90NwGHQrM8uCoxGSXsJCPTp-A&cry=1&dbm_d=AKAmf-A3ykh931pEDJbGwwvpI95IRXZ3U0hMsMsIw87wKQXNfO980gBCVanqGH44FpJYIwSwTzvfZC386dbmbmqQFUbWTVu6QQjAncq81Ann-lTpOTpeR6blfQp8fjToXU-21hP3FRqC8xIFsOm5fGljQ6zIaOvNfDMrUC-nkz_WA1kB-D-7ukKjOmrhGDp8uMjyFvqmlRNh958wvgzAxNE9GFhe0YrRXKXfyFKaq1zvwGOoKajHgxGAPCJRXLi3_zDgIvPN0BWx3b6ilBzS1qDWZ9Ne3bJe7c2jG6pmAOHAWAvju3JyuBKupqLmV2OKGnwNlnBHOVU37csewupqjCwBjGUOAe2m7m2q8qn1uGa5UV65hQiRRY-oPEZ52CfBm0ruSkbtD_LX2gtssFnth0FXfU8FUgPy5WWFWintGITqH7PeAlSrK5invYcaYujBXg_kGjPIe6zkUH3ob_s292A0NgtEMZlPFrD3luAelhxL0r1xWicyu8zDYZAA8EDw-XDCJtf1XfueUx9snll4CSSq8x63qhl0wba4qFHRoCda4Dgsg9Vi8oIAY1XxVadq2gLmsBh1EPWbraXarLml7gVciPdwYKvXRO6XLAGx7Dz0lQ0OteNR9urF1y9ez19-BHxpu9ebxnRW7775cnIq8l7Xsz_p5yKkQBw5k6RV6UY3_3hZ70iTbC-sGkASn4ERCZATEMBE_Ev7EbUqZIu_Zbyt2TdFNx_XKLyDYRMJ7XRSwp9McEeSfB9-JAUqpHCwiZdgGj193ddDTkd4CB6-WRmDLLTv5oZInHIJv6f2UTLlN83O_PcqpEvbAhwuo4_blnojY1PlTeR7IOu27RGBDwZMVDyPWAfjmSQG28wfjfUN2_-rurfPbeJBXLbqbQN3aBtdQi_Z0EyXgQnIAAaQNlT8LYnH93JgmAU2SKQ6_hfo_1lX1j_bCbvHrbWs3fa0xuqDwQN8bIXmy7nl6P7i2X_hbfKUs6vamyZwA5Gr1bS0ZaGK2J3VxH_eB14wwQ06Ulxl0kgxRgTbo4FHZvJ5H8oNfaHKyJCMViI_OsHx-3OvFLsp-iCNU8mSgXka8Rqz-adyzuuKvNDtGNbsi_lOu38nml92lLJy3Fdo5lLKW19MUpo7g3mHP4Rdvc5CE0fWu3iiKFMqD15GrgXcID9aaZi4oHUSL44epKibQlEYGbt_PaNX4qoygIv_nbm2XiGqVKMYEKU66pxMkEMVSzfb1B8cRuswjPBVDSDog_QGvcxRsaemBZN-LOZGstnN6YRNGzPUSZ5qgS9eEkOvRqUisCc5vwB6hRzLW5pOoeeBeqrD65hCElctUSp2QrQMhCN-ftruzM0YVsgloLAw8lJ27XGMdwWtWDxQ7eoaE4MyRrWrrYUXE5aUWUkwSf0hhrWQy__ic6EiR9UC6UTEDnkz2AmYYbKPmjuhTim2FMD9SOkgeLFbRQGKmI8eCZw635xcyIrMi5g_yfJNk7eVAr5kL-1lVIJC5fhsxqZm62myNYrgNC3S3RWETtwwd67eW6McV6U8Bn8ENetn6i9cJNABiGq4avezAE8p8eXLIugAmE8zFsncTr-ZKczUdMfEzZADS4cp9WoB4HA43DETmTIrzikcDlHccwkhXgIOdsNucd8HNULqWATPVqqxmmMZyPy2hDqNJayNQKUG6Lh-ou3cl9k3M_kBEk99SVoE737KXJ2ltkwIPI4_L-PPRbOkJZUrpuZJWoeGKvUtcOZ_KZSesy44faQa9QXMUTLcZa-0d0IgxpT5-tlMraNV66B_Z0pLLSonmY9EapfP0ScZLgp9kV2HGV0WnsFPVpI6mgJIwb6Hlwre2etGkQkDmo3HZE2KouVrsGl8XWBz5ZVKlSq5fSQhyXLs9DJlBh8wMGIHPMsAwuPW0JXPr3qJaGRJICFqgCv3SWSHk_1bPQ7XLlSpM98bJXpjkrL6CiXnuhU7aBsI6M__6BlZvbblA956h_L2ORlx5lQ21uf5CDyaSavA78mz4WZFT25aOvkb40PGtw3KSn3WbSxASF9PKjbv-hAhBZ2sHjU_V9TaqVo1OCYs3uTIXjWaVYXUoTJM9OuLYrThsMK6VY8Zb6sh4jD1qmw0tOw_KampYlAzNVgiKsGkZrcRNNyTUBjR7EVuELoU4Lx2DXsqt8RwN8FPsRDXq9RpfoTCY3JVDfWvgiQLJGn1Qw_jM8ZaHvv1NBO-ditZFxrakOsYD1cWSWQ9GIeE06WoOZCFzlRISCTOa3MmMTLTIXoDr56AR9mTR1tYtBvReP1R47nUzD70ZnZqg8wJddCCWVA4RejNu8PJ0BNL50hO8M9uQMgy0fm2U0kvdIwdYcv0V_QBBydl3vqRJFOZDK6UlesqYEkKpkHCEoTzPFlNBZ8_Q7cnLDL8ZXkXCMa8XxNj35BmzFQSmgl9SepwEvmy-rXFh-4n5MoHR0NCp3hFHFsNiVWFYveSnVazxyJ8fEz4pBmr53BIFo4ITBG7dvJbr8p8PAGAAojpcnTAPqIiNW3rRAyLVW7f8bNxj_a_kvXm91M0Ti86Zx4hQT7zr2Zj2GpQc9vMF1DtNCrb4947asJJghYMI7YcSVc9galeOwhmz3iwoVCXNTAbfpcmRE_YDwkgbd8Z0cYG8i5Z_K0kV2OwJkPQLLm6KkH9oiKmFBNm-mRoC4SqjtaWmQDoQypmFHaWGMbOQ5Xm0y_esDOuybQox9zMbBjSUSNNTOBgw2QUgv2FyfWJOMHzXB57WoxDQzBK2z3oyU887ezw7Ous4Tr69-9cj-4QoncC5r5OPdkbg81WoVDr0yX5i0-m9-I4mBsrAsv_L95oXlys5SWTgSPBL6YB9UZlVyZQn-SONipfy74gge4v1DnhrpF_IVhMXQQG33sQjbmJf2-U3-m4eGZ16OPhMl1nGZue7iM8I5ODGTbdwSHHs6k3sDhE8FtNLXMEfZSnRac6tckUxhK2jMnRLZ1vrBuiLxsC23EqA13v7YSiZUGHCzBP0VZjxg2jI0QpqhmaTQ0y7sgBUtKi1-4oy1BJY-8owiXM3izSTMF3ELslSNCFrwO_WwE5pBm7LAye3BjSNFpeO96hRTAyNVp86S4dv1-ZaC00Yntx4B8ltPJYXqp6uyzUXqbENg16-zkca6eFY8n5l3AaqcwKSyQoobiwf97pojHIZ7oEZ2bExjYN9qGY928jshOHAlK6PpaXtWQxPfMX8Ca1pem9GC7ZRdxWo-Bw0YLa8QmoIKLe9eEcA-SQ9gbnAPa3mHUCJufiX2MlK_9aJN5yoD3tUEtTlT8w_d9dupdCjymzoBC1eiHAOsnIq1eUl6BZSPrtVs6e5UqLee_HOZG4bTop7D8g4d4JmpIGvs5HDnjnaXsgDY0QG502BnKS4DFnyj2w5nNFAZOZJB6LMR0I__9etX0kjO1r066f0Ot9R88da0okwhdqE2LBg7BcjFujcIt7iXX1NarcFQJD&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ds=l&xdt=1&iif=1&cor=1398298571471615500&adk=1964084972&idt=378&cac=0&dtd=32

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:11:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 752
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:11:34 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame C9D2 30 KB
11 KB 111ms
110ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e64ed909680284310d43b2c1e481c46cdd194084f1df8a605ab46183771add7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:11:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 751
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11511
x-xss-protection: 0
server: cafe
etag: 961974302080011826
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:11:35 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C9D2 41 KB
14 KB 79ms
78ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 15:11:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83543
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 15:11:43 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0FEC 1 KB
643 B 88ms
88ms Document
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 46577
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 01:27:49 GMT
etag: 48472445140208031
expires: Mon, 28 Aug 2023 01:27:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C9D2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cefa9e1381efad505b91c2bcb55b5b85c4d5b7b1007cec40117477f5b8d15c15

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 104ms
103ms Preflight
text/html 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CMCUkhFzrZLyuOJyxoPwPhNysqAW9tr2scq6Iq93gEYug6uCpMBABIOXP6xZgyYaAgNyjxBCgAZeJypoDyAEJ4AIAqAMByAPLBKoE_AFP0Frw7MupqMXYivOrMwte77Lk0yUearDfeRFYY9ZKsv6mzTNh7SGc1fEASJVlH5NzNxGQO4-v9Mm6buzeanvlHZKvqFIe7AHkSruSIetXv-d_VAgxMRmX9BZRPLw13-IvuYeNXyVsB28ZCKgwhh28MuHV3IH-aTafNrejUshGjbvrtMFxyYDwtIorHY2HBU8PLjO59kha1udEKYCRuEoQVEBtNh2gfYjH_XhRIEone1j2_qTRVkb7H3L6k5gg_tBr-Otyha4TJgwJncECYDHKeOH_ahY0NMNmIsaEYZ0W7U9PIxGZWYyPzVJeBw7vhBXphLxu_2QvowobEg_ABMuz8tf_A-AEAYgFr9Puz0CSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH0fa1ZagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAPIHBBDyvTLSCBQIgGEQARgdMgKKAjoCgEBIvf3BOpoJFGh0dHBzOi8vcmhvYmFjay5jb20vgAoDyAsB2gwRCgsQ0I6-7db5ka-OARICAQPYEwvQFQGYFgGAFwGyFx4KHAgAEhRwdWItMzI3OTg3Mzc2MzM4ODkxNBiknRA&sigh=OVM4dmlnL8I&uach_m=[UACH]&ase=2&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&template_id=494&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 27 Aug 2023 14:24:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 913D
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CMCUkhFzrZLyuOJyxoPwPhNysqAW9tr2scq6Iq93gEYug6uCpMBABIOXP6xZgyYaAgNyjxBCgAZeJypoDyAEJ4AIAqAMByAPLBKoE_AFP0Frw7MupqMXYivOrMwte77Lk0yUearDfeRFY...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xe21c5b6ab69a69e20000000000000000%22,%222%22:%220x88e6876a9cc42a520000000000000000%22,%223%22:%220xc7ce27...

0
0

261ms
100ms

Fetch
text/css

172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xe21c5b6ab69a69e20000000000000000%22,%222%22:%220x88e6876a9cc42a520000000000000000%22,%223%22:%220xc7ce27825322bfde0000000000000000%22,%224%22:%220x88d94216d7b1acc00000000000000000%22,%225%22:%220x6c3750fcf65893bf0000000000000000%22},%22debug_key%22:%2216651490904284972302%22,%22debug_reporting%22:true,%22destination%22:%22https://rhoback.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22861045911%22],%224%22:[%2208-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224602709718900259025%22}&andc=true

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:07 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xe21c5b6ab69a69e20000000000000000","2":"0x88e6876a9cc42a520000000000000000","3":"0xc7ce27825322bfde0000000000000000","4":"0x88d94216d7b1acc00000000000000000","5":"0x6c3750fcf65893bf0000000000000000"},"debug_key":"16651490904284972302","debug_reporting":true,"destination":"https://rhoback.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["861045911"],"4":["08-27"],"6":["true"]},"priority":"500","source_event_id":"4602709718900259025"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Aug 2023 14:24:07 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 27 Aug 2023 14:24:07 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xe21c5b6ab69a69e20000000000000000","2":"0x88e6876a9cc42a520000000000000000","3":"0xc7ce27825322bfde0000000000000000","4":"0x88d94216d7b1acc00000000000000000","5":"0x6c3750fcf65893bf0000000000000000"},"debug_key":"16651490904284972302","debug_reporting":true,"destination":"https://rhoback.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["861045911"],"4":["08-27"],"6":["true"]},"priority":"500","source_event_id":"4602709718900259025"}&andc=true
access-control-allow-origin: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230823/r20110914/ Frame 54C2 30 KB
11 KB 79ms
78ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230823/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A6vywtHB97-BRPW6mKQ9ZflJUQ2Rf6Jif75Obf4jE2OnGONM46d66VcYGvC6uGMoxFcFgFQSEoXZYc-1Z5VYiGov84_9Ac_hyB1sYTsRIxRiM2rEwJR4o1zyzryiWl-j1GwLoDFgD4MLIkTWWEmqpMmPUpLs70wS7L7ATvtWiMkNOzBQA&dbm_d=AKAmf-BcxhYTp1gyBaBZw_qH3WGgkhPguk7mvTzcfi_Xu-_dfWaZnmZryGaGj9eYzggzHP2ut0i1pzXIkTHr0R4lWut0r42HK3zgV8Cpp_VDb0YPk-mphZY_vV2n3ertLs8GXuhpN-4C2WLIrG7E7k6ffs_qXfWm_Zs-met78hKbhk-tTijJtv0QYh_Zr8Lbnfv-1YBSQeuMU2-CavvplzZiU2j5gvois6jEOJybwZqqkERE5U1R6XIrkxFVbxLaVUvWQtO-L41t_z2zprL7sv2h7Z6g3XfvkANeXXAnSB-ulRPbI2HfKlHZVQF_IRii9MCs3BJFGICdM_6hOxk2BMBRhMfsNzRmfI5U-uNJN9LYH9W-WjGkN1IPQX53H0d-dJ-ym8xgckE-2aPfqxZfvE6gXs5ebYkvjiOyZlTvwnNQRNLPU-MIl3IGLqF_L4hfj1NTLspYDG9U2KdeoLhkFZP09WpBfbQC75I0WQDwGc_k4XTmReZXfZJOqIyZ-mlTstvXhpTgjJMet73Nht3MywzquiM50s8499UfBOZJsOvM8XTEnD6Xkk-yP71YYAfO2lEkSqw6rfqc1kpXANK72bVqXO7lkFByECShVuVxeWiB8h2C7thkxikD2ndMlqyg4ZQf309rSVFuDrde4sIi6vNiPo3NqZBUZWC9U_y9YDJpPuwvSgKSuZpouSRuC1y2oPbPz9KTkY_EYPgw_zxgFLSWGraN8WL69G5a_Eg4e5ovvrBE-TCmMZcgL8FH_1jwBPEfJ_gbXIRb3EchzP5otus0bflc-a8UGakkmGuxkg8Y-wFWaPQa9o8nduQNr9p4YWgRfXbjioxKVm_yw9_GtGsclmrQ68RAkMvbFHP1WoSBbvB3R6aGW1OtTzwxARlEEJSY8tZuv2umg7SBBvhzT2Am9txJ3iGCGwE_2uhImA0bfZwT0gyhVFOZaB8kxhyiF_InjNLOmkV0lQN9FENEa4gahr4DHGjBMwYtDY0ry8PMA9D2oM4Fq5N_VIDQkyq7ySk_JEIEQBROCBsYMFylaRwGdsg7HvzSzAnxUlYkbysjIs8f7a2AHi--CfpM-RYuQWaZXxYeZF6LWPRj534XHVX5OGOP8j6V7rbyDxrrNYCnG3KwJQUQe-Cjwvw0ES1KMHhbWKNyZam9yiMK7KY-Tfk9prMwbjB-eAkl8CYQ42R2-C8tMsN0i_-m3Hb659YUKsOAGnWYEd1sbP_uUc2LDVOALKAe4WLhKUYjTHF4TxSjAYLJByHCgVOBdTIQwXhjds6FtRqH8tVm_zbjIj8TV4GUOBKv4v5duC5r2EHXHdu_jNmdlsHp7Y-xupkZW-Hn-R9qBh7I-qZ_Mw_okSk9BCZ5-D3LaLqJuld1ljCk1wDqS6aDeakcn5omJY81jOqnAOtH3IGq9Jn4-bRfPQ42s54ZVhBJFdnHpy_dAk5iHtu55tk3sx2If925g1CxK7nBcngu3EysG5qkCGUPHwWNKQoLwiq848YAaYfIPXEOVq11Xo34rcx9ZoauTtVu5fNGAZnYr8fw2K6urQAiK46tqj4n-FyLPQNBXc2hTaAYxmxZrJujh9vSHGps3V-KOWBS55MKqeyBNeiatGY9uHohiqfBrDcJDNjh6C1I_CuY8h3vm-w--YP2C2Nd-qP6ZfFmsUTSXCnVgf1yTgeT5mRpkiYCo6G3BvXnbZk68uk8Fc0c2L1XN8cB_u6Mrp6UVsbjz8GN1bCT306OMUfUH_WWvL_zcaUN_vEXl2PXhrhFKKlpk61QYRwhfSURIJubAqlglvXtvmu1pQ95g-2744guCSchN1zqawYoiai_-MXHINdoqlUYfw7VrqrJHA73EhVjmScAW6_hyR47uYulWKPSaQI3TrFMiPv-di9lAHMwCIEApG3YH3EhsJK0J0EmCseSs3X_2BAplU8wnIsL9tSLwwNUglDjyJW8l7l3sSaGwrmdk5tDCc509CkNwx45txnIsD8cMOtCit8Jg-_kOn8M-TfuVTQ_Tr_sYH3qI5gAUS_ai04l5D2QNnkW7imX_P6zWLU_XhXbNFy_0FZvuU9n8F9bcRCs_muERy6ZKDppIgpfyRunozc9XJ5ZUeCOwqPf3t3W7uLoVNFoLEa1Wf4gOUSqM0eGPbnpj-d4a6uknLgxLn3b4-GKMFb7DFfA3AqmNjByBHfIbeiOn5IpeLZ1FvDinn4UnFFToDRvO7TjeCM2lOT4pXUM2sr_7e0FOXBvnpCjQA0H6MIyPPIp7lgYr_lodw8LZiL_8EozXuKE55l1fsrSTqvxy5O3OflbKyBl0eJsfR6az2S_H6qRs9gcA8QlGSfSPCk1anz5qM0N_I1Yzd0Rxsn-hhz8nQWoAUAu0uCzQ6PEyQ5BzqDf3DUDdHBgzyX8eBS5ttFM2dnqfEFw-XpkIed8Z9fIcaQu6BJezOTry85BTzEtBPrqs8DgKPzSQyMoqqmmQHveAqAEgi7Yk65O90RfRGOJ3nPc_RUEgWfGHYMcLLRPjGtTY6tdlsj0lecSZkLlO_k_7p1qQA4rwAe2mxAjwEqTKJBpNb0tHcNOUf0sj2LBpStFntbMST-19Ui3IE-hSJ5ywOLQcVHm5XBPC5nGjhm1ulvtTjrrx01xfDO07peaHOF_XNw2YchRkTnCs28GfRkZE5FrDSoJArRSDd6WvzB5ec3rmalkNPgcz_l1JPllRZmNnaWyemu_4pWRButyGZ5s99ZIXdyQh37UzhCs85XAhFIZX3bUxifw0a4DtIWtyjoQBIuVVm6mWxwoQ4PeEjZoMXItrwBqKwFDsQQZ86WNgfcxW22enZvHMFDTDGAKDWgPrPaenMi_Jh5kCBNI8I6KrPt0lBkLF-mTKRyvrXWpkVPYreRuAi4rcuZiFvvYe5THb1VlnynlG63wFA6sMxpm7PWrkw1Xq-P9Tm1mGY8b-EAO1fy85LHXbFeyE-3hTZIDThNODG2RNUtykkUGq1cgEqCPcRLqlZMv77TBuJROvKw_WiSPUJJrFI3ZCoVKyVwpgjtqyenXftttIDM7UoIiqVUtPfFU2VIsaQHoiIgxrChKbEfIWxQUujsC2d_w_vZJBW8g8vIBnMC5gZ23VyYmz92NLwlmMYsdukpQEcPn-5pTfN8neD_bde55CMTKS-WJtn7o8QLZfCizSktr4BF24B99xRSzAr41qVFK0luMScDUiTY9_lG9aHK928tptxWvmVuPs7yxcN-3NBBA0zPLnfx3xAtV4eXTYu38VmqylLJlbcL5oZPVy4E0dp8mUc_D3PPymDDtmrryAflpwYDNu4gKenovtzREcwjgeXrdLdXAivNfM8EF2uSrh6MQZmkGEWo9pQTkmdSuC2QSCpc6MqpbIA_FoE-e0oLuXFK7fcODJDJYGthNG-nmQ5ly5hpumuMR58BoOpy0QiOXv3mQOb0l_qY9-gPbhTVICRQEg0XAD9LNKBbKtzJT8BmA8EX5kRhAw-OeT0t_gBEqAUI-yeONGE_stJRFYWoAMdDdDBjPpgO0RfYBakmjL8WsJsCj5c0Gew5LCnAFOwKzle-Dq5TLqAddJncKpftpxTuoFTDq4msjeOIvKh0PC_DJXzm85tpBJG_j9BD5pPkxkGimpqznpBopqWfzLB4D6El5XB515Fiz_RucAWzlX5TJCmrSDf5iC8eijxXN-eh7Ol69JCEbpszABkjSDjJ-7kb98sy-es3zA2BV6hrcx2Z1iU-ilUc1oSwXc4oG_Ctu6Q&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&dv3_ver=m202307240101&rfl=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&ds=l&xdt=1&iif=1&cor=12706996704164635000&adk=2857193498&idt=260&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e64ed909680284310d43b2c1e481c46cdd194084f1df8a605ab46183771add7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:11:35 GMT
content-encoding: br
x-content-type-options: nosniff
age: 751
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11511
x-xss-protection: 0
server: cafe
etag: 961974302080011826
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 10 Sep 2023 14:11:35 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 54C2 41 KB
13 KB 74ms
73ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 15:11:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 83543
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 15:11:43 GMT

GET
H3 200 0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js Show response
pagead2.googlesyndication.com/bg/ Frame 04F9 37 KB
14 KB 80ms
72ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d30e077a8698103cabdcca696708b05c9806d9620e424fc9562395404b86e2e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 14:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 345984
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14706
x-xss-protection: 0
last-modified: Tue, 22 Aug 2023 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 22 Aug 2024 14:17:42 GMT

GET
H2 200 player Show response
realtime.clinch.co/video/player_v1/ Frame D282 11 KB
12 KB 533ms
87ms Document
text/html 108.156.184.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Requested by: Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.156.184.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-156-184-93.cmh68.r.cloudfront.net
Software: clinch /
Resource Hash: 241abad45d15b92f8025df49bace41958d8afb8cc5e1ea9ab29c6c2004c1939c

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store
content-type: text/html; charset=utf-8
date: Sun, 27 Aug 2023 14:24:07 GMT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server: clinch
via: 1.1 31c8b5078ed8a992dc522a331438c63e.cloudfront.net (CloudFront)
x-amz-cf-id: 7sIrnS0JSCN3nvqztC9YrCJyIq4_bVOV5kNH7IG_sQZv_kTLRD0b9g==
x-amz-cf-pop: CMH68-P2
x-cache: Miss from cloudfront

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0D94 1 KB
643 B 78ms
74ms Document
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 46577
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 01:27:49 GMT
etag: 48472445140208031
expires: Mon, 28 Aug 2023 01:27:49 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2B53 0
0 155ms
154ms Image
text/html 2607:f8b0:4020:805::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C0QNZhFzrZL6uOJyxoPwPhNysqAXnnr6YcuXdrdr5EOfz-YKSDhABIOXP6xZgyYaAgNyjxBCgAfnLuYoDyAEB4AIAqAMByAMKqgT5AU_QOIwSeS61T3vHiD-bZgSmdDuNWsZTwZs0C-oaT7nJkT8DgLtx-m2myduVDUZW3u9l3RnLYUH_lSRSCj-siGm_vFasrZk2waNaObd8K97mOcZ6cgMzS55_EynWMnELMDqsEVhr4L5wBOGbijfTi7OPTueywO-mCpuDafxlJp0WoxlE16wlBh2G6skRUPZzy7-qsHR4hZFKoSihD6_iq3E_snyC2B00S5cWbjnRruyWZQSIx0KI78MK_2ePE2jXkwc0rBWkd403FpdUSt_W2Cyt-6t0rsYl5Hg-Lo1NXUZmULiJRrDptO-zpy5-D2zLHI1jPf3YRRnOM8AEtqO1-ZUE4AQBiAW1wr3WNJIFBAgEGAGSBQQIBRgEgAfvs8Z1qAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ2JsJ0ggUCIBhEAEYHTICigI6AoBASL39wTqaCVtodHRwczovL21hbnVhbHNsaWJyYXJ5LmNvL3JkMi8_aWQ9NzA3MjRQV2R2YjJkc1pTMWthWE53YkdGNSZjPU1MX0Nocm9tZV9DUlhfVVNfRGlzcGxheV9BdXRvgAoDyAsB2gwRCgsQ4PD7_8WcrvngARICAQPYEwzQFQGAFwGyFx4KHAgAEhRwdWItMzI3OTg3Mzc2MzM4ODkxNBiknRA&sigh=FzyNceR7vcU&uach_m=[]&ase=2&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&cbvp=2
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:805::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 54C2 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04edfc43275a6b7925baad8d7a3a9ac4c224becba9d8751b3d4da764044e3e42

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1FC1 22 KB
8 KB 130ms
98ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 99572
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Aug 2023 10:44:35 GMT
expires: Sun, 25 Aug 2024 10:44:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 0FEC 0
174 B 326ms
60ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEP6-tb54ColUx6LoKNBKyfM&google_cver=1&google_push=AXcoOmRBUrz5N7ivWgNG72Uz5xT0yZExtGbB2c6YFQOLcDlrOxvJif_JSPpx-4uu6AF4OGBL5Iu52v7h14OXS2tIa3uuqHlkZ6Xg
Requested by: Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:07 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0FEC
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESECPlx2WXx_k6ABK9O01d_nc&google_cver=1&google_push=AXcoOmQ_EeaBRi9Ovz-qou7dxciRfKudf0mWQO1C11IZ_Xu-cmZ7lco-gpdav0712BHGA73NPkELvKwwFgU-T74_L7sfp71VgGez
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MEFBQzI1ODQxN0FDQjE1MA==

170 B
188 B

152ms
140ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MEFBQzI1ODQxN0FDQjE1MA==

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=MEFBQzI1ODQxN0FDQjE1MA==
date: Sun, 27 Aug 2023 14:24:07 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0FEC
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEM-g1KBSi3p0VFfPkVTyz0I&google_cver=1&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT6n...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEM-g1KBSi3p0VFfPkVTyz0I&google_cver=1&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAw...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgxNjE0NDk2Njg1MTg2OTYyMw&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT...

170 B
188 B

99ms
99ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgxNjE0NDk2Njg1MTg2OTYyMw&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT6nusd8h6BSdn_MsDnZ7ul7

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODgxNjE0NDk2Njg1MTg2OTYyMw&google_push=AXcoOmR2lUwMQd3qSY6CKw2T72IKRSoMRmUbck8vX2B_WkeLmJ2fseYy2eLgwpRW1FJ4OjdjpAweXT6nusd8h6BSdn_MsDnZ7ul7
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0FEC
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEKzhtuVpk5fEwY51-_dzKH8&google_cver=1&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJUwENv46...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEKzhtuVpk5fEwY51-_dzKH8&google_cver=1&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJU...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=L9gaFJdcSIWNAxKkv0b-7g&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJ...

170 B
188 B

105ms
104ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=L9gaFJdcSIWNAxKkv0b-7g&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJUwENv467zOSw

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=L9gaFJdcSIWNAxKkv0b-7g&google_push=AXcoOmSkSzBBxKqeFU3a3EnDichCxS5AI38CzOZMBN8-y3_9lwf3NXxVjzTEeqjx1ANfgfyDeQUPegwV0BefmGJUwENv467zOSw
access-control-allow-origin: *
date: Sun, 27 Aug 2023 14:24:07 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0FEC
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEF2dnPIHI-V-KZGPIFqL0hU&google_cver=1&google_push=AXcoOmTjJgAX_YJ9ilVzIG2mjArPMUuIv25O-v_01v50Iv3EuDnjddkVaU8JT370v6cN9WYSVJzoG3Nc1_O_Oey2ruWbgWsaWdU
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&mn_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTjJgAX_YJ9ilVzIG2mjArPMUu...

170 B
188 B

131ms
131ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&mn_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTjJgAX_YJ9ilVzIG2mjArPMUuIv25O-v_01v50Iv3EuDnjddkVaU8JT370v6cN9WYSVJzoG3Nc1_O_Oey2ruWbgWsaWdU&gdpr=&gdpr_consent=

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:07 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&mn_hm=MzM2MTQ3ODQ3MTUyNDI5NDAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmTjJgAX_YJ9ilVzIG2mjArPMUuIv25O-v_01v50Iv3EuDnjddkVaU8JT370v6cN9WYSVJzoG3Nc1_O_Oey2ruWbgWsaWdU&gdpr=&gdpr_consent=
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Sun, 27 Aug 2023 14:24:07 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0FEC
Redirect Chain

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEAuYLFUDMKsDRI617Nzgn8U&google_cver=1&google_push=AXcoOmQeJXxZ6LbPX60dwm6Dh0CLMRhsmeXjaO06vn8rElSgVsrlrrY8Xy-R-Xi_1ZqJI37CJ7cWy...
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQeJXxZ6LbPX60dwm6Dh0CLMRhsmeXjaO06vn8rElSgVsrlrrY8Xy-R-Xi_1ZqJI37CJ7cWyPwhQy76N0Xj6rFG5iXB2puraQ&google_hm=eEtPdEx3QkhSQj...

170 B
188 B

95ms
94ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQeJXxZ6LbPX60dwm6Dh0CLMRhsmeXjaO06vn8rElSgVsrlrrY8Xy-R-Xi_1ZqJI37CJ7cWyPwhQy76N0Xj6rFG5iXB2puraQ&google_hm=eEtPdEx3QkhSQjNfV3drNlN6MGI=

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:07 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQeJXxZ6LbPX60dwm6Dh0CLMRhsmeXjaO06vn8rElSgVsrlrrY8Xy-R-Xi_1ZqJI37CJ7cWyPwhQy76N0Xj6rFG5iXB2puraQ&google_hm=eEtPdEx3QkhSQjNfV3drNlN6MGI=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 242
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0FEC
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESEENuSalujrTphHp7AooAbCE&google_cver=1&google_push=AXcoOmSiOQibDZVNHNjXicm_7uOAC3-9NBikfZIBVTpalCr85a_mYj7c4J6JFPlRzI7Nf1WMtGM7suchyFpZZSA0GWR0kz815...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSiOQibDZVNHNjXicm_7uOAC3-9NBikfZIBVTpalCr85a_mYj7c4J6JFPlRzI7Nf1WMtGM7suchyFpZZSA0GWR0kz815bNIHg&google_hm=bbce98103257...

170 B
188 B

146ms
140ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSiOQibDZVNHNjXicm_7uOAC3-9NBikfZIBVTpalCr85a_mYj7c4J6JFPlRzI7Nf1WMtGM7suchyFpZZSA0GWR0kz815bNIHg&google_hm=bbce98103257336f0b10f0bbe93aff34

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmSiOQibDZVNHNjXicm_7uOAC3-9NBikfZIBVTpalCr85a_mYj7c4J6JFPlRzI7Nf1WMtGM7suchyFpZZSA0GWR0kz815bNIHg&google_hm=bbce98103257336f0b10f0bbe93aff34
date: Sun, 27 Aug 2023 14:24:07 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
content-type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0FEC 0
12 B 95ms
93ms Image
text/html 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jezt7FskBRKrjtekfD2BBFrXn6EM0LWCLw7sKKL9nL_MK6Z6V3dm7JejRL4FfPTyaSSP1lN_Y

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 350ms
109ms Preflight
text/html 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sun, 27 Aug 2023 14:24:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 985E 22 KB
8 KB 126ms
98ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 99572
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Aug 2023 10:44:35 GMT
expires: Sun, 25 Aug 2024 10:44:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 0D94 35 B
465 B 305ms
69ms Image
image/gif 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEhUMX0tO-L0XVvRHySQWPw&google_cver=1&google_push=AXcoOmT_3Jlb0ra-doguY8oAnMhI06QmhhNHDUHs4FNBIFJ5G3k_c0vGWMOkNt9dLHrjDKRQ021kMmsjriZp3ABlISIS1P5qt80Z

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D94
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmSpvRCXgEYXmDeoRFaLynwWfB4RGTGjqvX6IjDEObQ...

170 B
188 B

118ms
114ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmSpvRCXgEYXmDeoRFaLynwWfB4RGTGjqvX6IjDEObQCtalISdphuHJlDAFK-fjxhrOZsTcMwhPO3lvBV95UBZOpmWMhv5A

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 27 Aug 2023 14:24:06 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-788-g55788f4#dev-temp-decrease-retargeting-updates-batch i-0a5aaeacca2bba852@us-east-1e@dxedge-app-us-east-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=emVRTHMxcWMxUUFnR3E1&google_gid=CAESEIVF_KdwWPBSqbjLBqY3UK4&google_cver=1&google_push=AXcoOmSpvRCXgEYXmDeoRFaLynwWfB4RGTGjqvX6IjDEObQCtalISdphuHJlDAFK-fjxhrOZsTcMwhPO3lvBV95UBZOpmWMhv5A
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D94
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

101ms
97ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS2huX8kHPT1zhU04IJ6V3btMhTOaRAx854OzBhfzhRlqpHjJ3IoopYRbmOxAxMERE2AZspitQf8A_a5Q4q2ib5ilsN5Eei

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=YjD58XM1QViE_wFYD6f1mA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmS2huX8kHPT1zhU04IJ6V3btMhTOaRAx854OzBhfzhRlqpHjJ3IoopYRbmOxAxMERE2AZspitQf8A_a5Q4q2ib5ilsN5Eei
date: Sun, 27 Aug 2023 14:24:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D94
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEF...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-d7032288-63a6-4bd1-a77f-814159b8a9c4-005?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAXcoOmT8ykdSFTx0qSI1wZweV...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5&google_hm=BdcDIohjpkvRp3-BQVm4qcQ

170 B
188 B

97ms
96ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5&google_hm=BdcDIohjpkvRp3-BQVm4qcQ

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AXcoOmT8ykdSFTx0qSI1wZweV40oWK8fwxZcBxpi4a39gujYHAeWs46X8n9kzHb3_JP1ZylSMrk77_3-XHuJrg5miutwQhLwiYI5&google_hm=BdcDIohjpkvRp3-BQVm4qcQ
Date: Sun, 27 Aug 2023 14:24:08 GMT
Content-Type: text/html
Connection: keep-alive
ETag: RXd703228863a64bd1a77f814159b8a9c4005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D94
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_gid=CAESEPSgpNBwa6AVVerLVh4myZQ&google_cver=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26XmEPzhrc...
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_gid=CAESEPSgpNBwa6AVVerLVh4myZQ&google_cver=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26Xm...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=c24AmxjYQl6iN4KNU0lAuQ==&no_redirect=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI4...

170 B
188 B

96ms
95ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=c24AmxjYQl6iN4KNU0lAuQ==&no_redirect=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26XmEPzhrc1vSPeEMhXJ116JRIPBWX0gTAbw

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=c24AmxjYQl6iN4KNU0lAuQ==&no_redirect=1&google_push=AXcoOmTODNcNpw7x9oieOMv_ojdCNtj84qN-nQI0F4IReqt8FGEuI44hilLvo86bQN26XmEPzhrc1vSPeEMhXJ116JRIPBWX0gTAbw
date: Sun, 27 Aug 2023 14:24:07 GMT
cache-control: no-cache, no-store, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D94
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESECjQai0LjX0XPO2kdi202no&google_cver=1&google_push=AXcoOmTJU1MTH3fxRiPWz9FP1CwLm4pqt1rMD6nP03LhucPn-XqZdFdrDIXXa1XD8FTDZCOFK6wLqUmC6LGjzT21T...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZGRiYjMyY2YtMzRmOC00ZDZjLWI0YzktZTQyYmY0YjA2MmY4&google_push=AXcoOmTJU1MTH3fxRiPWz9FP1CwLm4pqt1rMD6nP03LhucPn-XqZdFdrDIXXa1XD...

170 B
188 B

112ms
109ms

Image
image/png

172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZGRiYjMyY2YtMzRmOC00ZDZjLWI0YzktZTQyYmY0YjA2MmY4&google_push=AXcoOmTJU1MTH3fxRiPWz9FP1CwLm4pqt1rMD6nP03LhucPn-XqZdFdrDIXXa1XD8FTDZCOFK6wLqUmC6LGjzT21Tf3PsSfWKkY2KA

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZGRiYjMyY2YtMzRmOC00ZDZjLWI0YzktZTQyYmY0YjA2MmY4&google_push=AXcoOmTJU1MTH3fxRiPWz9FP1CwLm4pqt1rMD6nP03LhucPn-XqZdFdrDIXXa1XD8FTDZCOFK6wLqUmC6LGjzT21Tf3PsSfWKkY2KA
date: Sun, 27 Aug 2023 14:24:07 GMT
content-length: 0

GET
H2

200

report
sync.teads.tv/um/ Frame 0D94
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEG2ON1aEvzoW...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=NGQwNmZmZjYtY2Q2My00NmEyLWE2YTItYzVkOTI1ZmI1MzQ1&google_push=AXcoOmQbRIGDshHfnJJFhwBQuPD7OQRJWsmEDmZQE1jCwuu8ZyPzRAsz054Aycrw2nmyF...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

74ms
72ms

Image
image/gif

23.205.56.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 23.205.56.163 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-56-163.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

expires: Sun, 27 Aug 2023 14:24:07 GMT
pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0D94 0
12 B 110ms
108ms Image
text/html 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JY3a3LXlcPytjk8fbY71_RE6Cl_DGzlD9zwvbYKMVR6UgYL3oqQeulz8Dmbz7RO71hIWwhjBg3

Requested by

Host: 63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
URL: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16124890883933717423/ Frame 6F08 132 KB
35 KB 288ms
88ms Document
text/html 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

082391138121f44ec371af96e69a4c404650bf73649eb38da1616a8c6245cc83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 338975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 35569
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 23 Aug 2023 16:14:32 GMT
expires: Thu, 22 Aug 2024 16:14:32 GMT
last-modified: Wed, 23 Aug 2023 16:01:00 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C9D2 0
0 398ms
136ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvDumwp1vwkfDWm9mDvLaoQXTk9fvHm2iVdi_6y8gv5IhpzKJPuqvrStbJIPvh-2ARUzBNaagB9UIHCRfjNOcum5nRN0C9t70HLegbjDCu39ZJZ8MmcFpfJBpXlleC5exuSinglNWcY7OlNYiknxOvIVN0A6x41v4dLZmuN2PhiDYRGlhmq4pzskGeU_xM-GSh13gz82TyoyFCgETPg_xhZ2BuM3hxgGzvLFSMc4Z2akCsRDXEXBIIzyKlAN232JINj6LcD0tS4YL1ZeUiXKbZfw4UcbxP0yVibDYjPcHHuAQVLXCNJuQ-eNmJc7kppQ7v9kWk6AmqfdR_0fnQL_L4xto6QNyRshxYqYwmP_IE1ynWVjnGTKS_EXy74TqhznscEIKudtT-EAzEAhFnPXFDGtkihQ8CDJ_bMEbX7MtiVxbp6JYpZqm4Vf9fPPizFKIybVBosnz8-Jd_GdNP31mMuRDnTobZ8j7VNHbjcZW4aeN0ZMzNYV1rQ8NTPZizXLISD_7iG1GA7_DR_S9kdWURDZUx84eqeR0szj4hZMEnt9WXfqarfp1dAEC6W6XysxW3-4vqs_N1gp5n0O9Dq2c2JtnqZm459FXEwpXjIpgvwOfNmO8tN45S6AFg261yemuIyObTOVr_kqD9RkuX1Y0s6lT4pFFCXaK5lAPuKa06HJmEOugBBIyCegnwcgQOotG-b0A6K050cRAT1WSxPM1fqQ3tu1EURP8yostBQD_62jw0Cf7OnAhRKEK789WFYW__K0-NJ5yEVxyOEEDCP6DuBGY0kXlM31Z7A_HAvQzS-TFoTV4Ep0TBJ8B0mO1iw-AKTAwQwYIADn-D0Ld1k3QIYNDVj2C2a1QYIK_YVyJiTmYAcF6xsAXpHy4XQ_ougawiAsLC8QIZ5_sgeKi6Fo7zMTeyc9GcMHTaSP36wVXbRyLi0Ix2ys9FSBnM8MbLjqWvuLBI3tubBhFZTDJPiTi2iztHtNzysuQFzB_VhHPUSXhIHA1sf1GBEJK5UKxOqB1ANrxC1JxtpXZO2i6LjbHPsbfZ4sbDlI8GtbyKF9u2SP02BnUqk5ykpqMaP-L5XfvyDnZ57PvQ1VuAXo2HWYlu_pHvh5XzXacz8QNw00TsbpggGVFQVGCaFgdAT167P44m4gD5nDMrkVThbPbRG8o7OLFo_zjbRw3nIje8BSBYHsN6yurKH7GIuSfOjk7ObfNaenBzCX-WnaCxyWqwVXNdqkg6C7r0EbOdTwS8-WOhUl7v03hMt9H93StHVQ_kCOFlnhK6UqitGHGZsoaWN9YB0WrdEa3OCjdDpFXV3fpyEuL_puYxnLNw&sai=AMfl-YT1oa_eTrID6QrVbfmvcgjotnLxVlQEObE7Zt5kANQ48ppLIqdRDCEa37wkygLXOecxYt3cPo87Jf7Lph96eBRGEKA3li94YILyDRtiZvdXUAbCGIyu2yVkmhhA88Dr7wPZ31aBKvpv_K-6JwHDNUwvelAUld3IIpvMBdlN3101Afs7CpMwx8zosrgN5zTWbm5Dc6SHC6GXvnhETs5sYJWofpnB3dGVta11tI51bI6F3G_PxFKCWFPYWQyF1vIEjTvP&sig=Cg0ArKJSzJzvT5Tt62OiEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=542&cbvp=1&cstd=535&cisv=r20230823.83287&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 27 Aug 2023 14:24:07 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 27 Aug 2023 14:24:07 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 160ms
137ms Image
image/gif 2600:1f13:800:7780:78aa:1966:9c24:9c12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=86599826-8b18-de54-5519-a686e0871993&tv=%7Bc:msHAki,pingTime:-10,time:1271,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHw2MDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTYuMC41ODQ1LjExMCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1693146247457%7C%7C711756ec21fd8d5389300bd1a49f8569%7C%7Cf3b2a520b07e1265656cdb121718396d%7C%7Cbcef44748062c41f0c949158e129bc07%7C%7Cec601986cccd3c9161efebf2dc5a9239%7C%7C63362291bf4b6fbd7a73f5a9cb8dc1cd%7C%7Caa0207c0dc4d4b02e5f8059da57464c2%7C%7C9b2f065014321776e719067f2d8e2391%7C%7C1663701684,env:%7Bar:self.0%7D%7D
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f13:800:7780:78aa:1966:9c24:9c12 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: nginx
x-server-name: dt16.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 runtime_10_326.min.js Show response
cdn.clinch.co/a_js/dispad/ Frame D282 144 KB
43 KB 299ms
74ms Script
application/javascript 2600:9000:24fd:e00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.clinch.co/a_js/dispad/runtime_10_326.min.js
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:e00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 505c4254d85d5e030b01f0b8a6a723fa4e3e11ed935fe15de6df4ee835cafbaa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://realtime.clinch.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Tue, 15 Aug 2023 14:03:50 GMT
content-encoding: br
via: 1.1 8d8e064c65472b4d9092417cdcece59c.cloudfront.net (CloudFront)
last-modified: Mon, 31 Jul 2023 07:42:13 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P2
age: 1038018
etag: W/"5d406c17b5df97d8e19159516ea804af"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=2592000
x-amz-cf-id: oX3Q4nWqJr5DUHB2B2TEPgUtQSJN0nx1R3dk_-H6uS1im7u0MrMPCw==

GET
H2 200 300ax250_v14_u-638667622_en_movie.js Show response
cdn.clinch.co/a_styles/3029/js/ Frame D282 13 KB
2 KB 357ms
133ms Script
text/javascript 2600:9000:24fd:e00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.clinch.co/a_styles/3029/js/300ax250_v14_u-638667622_en_movie.js
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:e00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 56df36601375d7b06986029e0e37cbbb2725c31168147ca6a4790be88c0d37fb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://realtime.clinch.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 07 Aug 2023 05:27:34 GMT
content-encoding: br
via: 1.1 8d8e064c65472b4d9092417cdcece59c.cloudfront.net (CloudFront)
last-modified: Wed, 15 Feb 2023 15:17:23 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P2
age: 1760194
etag: W/"408b3f170c4e7656122915cd01f01a90"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=2592000
x-amz-cf-id: GWRX_ersOrnPISUy7JsS2n5H2W2IsMC8esaWgS8ACym3gZFZeaXtUA==

GET
H2 200 300ax250_v14_u-638667622_-638632270_mapping.js Show response
cdn.clinch.co/a_styles/3029/js/ Frame D282 5 KB
1 KB 358ms
135ms Script
text/javascript 2600:9000:24fd:e00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.clinch.co/a_styles/3029/js/300ax250_v14_u-638667622_-638632270_mapping.js
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24fd:e00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 407a33790358a92d990b76a909e66f70f982af2bd2925c8ef7ebce72d62fc155

Request headers

accept-language: en-US,en;q=0.9
Referer: https://realtime.clinch.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 14 Aug 2023 08:50:31 GMT
content-encoding: br
via: 1.1 8d8e064c65472b4d9092417cdcece59c.cloudfront.net (CloudFront)
last-modified: Wed, 15 Feb 2023 15:17:23 GMT
server: AmazonS3
x-amz-cf-pop: CMH68-P2
age: 1143217
etag: W/"dc84a858866fa5f69e39d6d1d84a70d7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=2592000
x-amz-cf-id: 3WE_RLp2i226rzDpDFkO97rew2h1NZDFB3Vibm6dVu0OGJux6g5KdA==

GET
H3 200 0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js Show response
pagead2.googlesyndication.com/bg/ Frame 1FC1 37 KB
14 KB 73ms
72ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d30e077a8698103cabdcca696708b05c9806d9620e424fc9562395404b86e2e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 14:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 345985
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14706
x-xss-protection: 0
last-modified: Tue, 22 Aug 2023 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 22 Aug 2024 14:17:42 GMT

GET
H3 200 0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js Show response
pagead2.googlesyndication.com/bg/ Frame 985E 37 KB
14 KB 110ms
110ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d30e077a8698103cabdcca696708b05c9806d9620e424fc9562395404b86e2e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 14:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 345985
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14706
x-xss-protection: 0
last-modified: Tue, 22 Aug 2023 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 22 Aug 2024 14:17:42 GMT

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 6F08 32 KB
11 KB 72ms
71ms Script
text/javascript 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 01:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46835
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 28 Aug 2023 01:23:32 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://us-u.openx.net/w/1.0/pd?plm=6&ph=dc423def-06ad-4fb4-a386-363c0a8315a3&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGMIdo-xyTtnLeLyS7SudUM&google_cver=1

43 B
114 B

49ms
48ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGMIdo-xyTtnLeLyS7SudUM&google_cver=1
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:07 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGMIdo-xyTtnLeLyS7SudUM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C9D2 42 B
64 B 265ms
116ms Fetch
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstLp4kaWYQ8ZVQ1DUEu50-J1EhXeGaDBEdIMrtFCs7hOpPwVbLgGtvJG5Cb7W_RBi6p6iuDHW9vS5bo58MJ4giIRIotReuIsw02gz7YkuhODsCrcOR2IZgVcZMPN4X6mAsBJVG7KwPong&sai=AMfl-YRygoPKfEqZtbb2vjY1OqPl1rqDSD4wc5gXhuQb4x7TFMdC4YUwwe8ACxOyVxFG8-fPd7UehcVnbKP7Upmadc9Nlpk8TXKnJmyyIGIhbdopi3IH75EHRZShgUc&sig=Cg0ArKJSzDQSh5jO5y0iEAE&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&id=lidar2&mcvt=1033&p=21,436,111,1164&mtos=1033,1033,1033,1033,1033&tos=1033,0,0,0,0&v=20230823&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4124475763&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693146245810&rpt=998&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 404 null
s0.2mdn.net/sadbundle/16124890883933717423/ Frame 6F08 43 B
64 B 387ms
387ms Image
image/gif 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16124890883933717423/null

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
server: sffe
x-dns-prefetch-control: off
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=0
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
expires: Sun, 27 Aug 2023 14:24:08 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 913D 42 B
64 B 225ms
111ms Fetch
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvCA1qmxCg3TcAKETnLFmPz5-fh19p9P5nnwSWJ54lt89ky33kbkREwryBeW4J4ot-6numKtiFwVa0rul87yIBUPYGAUf3uxU7F4MBqQSlXKMtE3oVkDE4wZNlfgsevy57-hyDvhfFdWQ&sai=AMfl-YR1U8X_EypcBi5Nc5hmQRSGAxxZcXZ_zBxcisYE6oLE-Dsmrc7tlBYTjOO9s69xIuIA3ARZ00MdUtke5umDnZCVwjaCjuUI51CwWyRlTIVtJuoixbI1kE9NF1g&sig=Cg0ArKJSzL6GnYYJexKQEAE&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&id=lidar2&mcvt=1037&p=169,170,419,1140&mtos=1037,1037,1037,1037,1037&tos=1037,0,0,0,0&v=20230823&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2756064699&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693146245865&rpt=1004&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/162/82/3/0a0a0a0/ Frame D282 4 KB
5 KB 278ms
68ms Image
image/webp 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/162/82/3/0a0a0a0/?u=%2F%2Fcdn.clinch.co%2Fa_styles%2F3029%2FGeneral_truck63777706717564.png
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: 9f86214c6d960ceee948f990ed88ed18a231f8c72b449dec142036e6910a2575

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 02:03:53 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 130815
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=606730
content-length: 4348
x-amz-cf-id: AJ4X2Pmpx6tgKgY7J1iykgpJEGZgFyvyAGD8eo9_GWyEwmjW56wodg==

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/104/80/2/0a0a0a0/ Frame D282 1 KB
2 KB 277ms
67ms Image
image/webp 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/104/80/2/0a0a0a0/?u=https%3A%2F%2Fcdn.clinch.co%2Fa_products_feed%2F512%2F3921%2Fassets_library%2FZephyrhills_1%20Color_White_Logo%20(1).png
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: b265476177e3ab0431283434dc52fb94854b6763cf84b236fb858de18c3757ad

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 21 Aug 2023 08:41:40 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 538948
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=650833
content-length: 1404
x-amz-cf-id: M_kdXTiwDeOGbYfE7Ttx2my7x9ZKcl7egRhvd3Rt8ETRSIzvZgEttg==

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/140/140/2/0a0a0a0/ Frame D282 3 KB
3 KB 284ms
75ms Image
image/webp 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/140/140/2/0a0a0a0/?u=https%3A%2F%2Fcdn.clinch.co%2Fa_client%2F512%2Fassets_library%2Fproduct-230x230-Lumina_ZH.png
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: 1852b86f96afa96e95103ee031a4fac938f321680f04f2090b6306cebed3b548

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 20 Aug 2023 09:12:10 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 623518
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=647332
content-length: 2782
x-amz-cf-id: jwLLsriNJ3LwqeWfUUOX4GfJ83RPofxzuXrNUVi0HLc8IX6o_40TXw==

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/300/250/2/0a0a0a0/ Frame D282 16 KB
16 KB 291ms
83ms Image
image/jpeg 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/300/250/2/0a0a0a0/?u=https%3A%2F%2Fcdn.clinch.co%2Fa_products_feed%2F512%2F3921%2Fassets_library%2FNWNA_DCO_BG_LifeStyle_ZH_300x250_2X.jpg
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: 31f8dd4c33c94b6ed7e64f46dd076e4f39cbd149a405b8dacd29b6c1ba7cd8e4

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 15:58:08 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 253560
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=630364
content-length: 16090
x-amz-cf-id: YegEgFUTc-udORB2mf5mw2rVeVj9fTZdFkgJ59DFSw4Aj668CZvnNg==

GET
H2 200 imp
trk.clinch.co/ Frame D282 43 B
219 B 209ms
66ms Image
image/gif 34.227.123.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.clinch.co/imp?cid=yps7WO&caid=10929&caver=34692&frmt=300a250&csid=45597&dsp=dv360&plcid=372641689&plc=497225&iid=34e592e8-4fa4-46b2-b8d9-242bf57fcf6c&env=web&hid=4abee9a9-d355-4814-8ecf-da6782dbc972&fcpath=lJIKBJIOAZJPAZJOwA&prd=Ecommerce&ids=ZH1&isrc=topItems&issrc=ZEPHYRHILLS&feed=3920&tilid=7833&lpsrc=Campaign&locsrc=Ip2LocDb&loc=x2Jj0gAAAGRx3AAXy0BEZgEA9wzLwFJ-FHrhR64DolVTA6JOWQOoTmV3IFlvcmsKAPAKpTEwMDI1A80B9QOwYW1lcmljYS9uZXdfeScA8AarcHNpbmV0IGluYy4DAQOhYqNoc3Q&g0var=77,78&g0sid=78&g0stg=77,78&g0node=79&dspiid=ABAjH0jlaTaymWmK21AbyYT93QGm&dsp_caid=20441486106&dsp_pub_id=1&domain=windowsxlive.saftawy.com&dsp_insertion_order_id=1014065068&dsp_crid=510375083&tc=&a=1693146248154
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=yps7WO&caid=10929&format=_300ax250a&dsp=dv360&plcId=372641689&plc=498640&dsp_impression_id=ABAjH0jlaTaymWmK21AbyYT93QGm&site_url=https://windowsxlive.saftawy.com/&dsp_pub_id=1&site_id=0&dsp_insertion_order_id=1014065068&dsp_caid=20441486106&dsp_crid=510375083&dsp_tracker_token=AD1EzRQAAABoCmAKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhMImqahk0yoAuyezAKwAqzPxeMDQAHSAioYACITCL2A7aOF_YADFZwYiAkdBC4LVSgBMAE47Y-4q9ERQAJIAViIgSAQq-mu8wF1ER8Lbmg1DdVUG_rE7DBu&rnd=1693146244923453&gdpr=&gdpr_consent=&gdpr_pd=&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DC-AcvhFzrZL2uOJyxoPwPhNysqAWvpPCkcu2PuKvREcaeiszYOhABIOXP6xZgyYaAgNyjxBCgAYb-7soCyAEJqAMByAObBKoEhQJP0EU7WZVbIWz35dgS9rQNv4pXEU1s3fmV0Ww8WM_b_0dqvoLaRak7UCMoi3g3e9Pt_f6vF8KuduQpQlQyduPEpvJyaAcqqFPHsNSpUASiMEutJBWRvnGa9ZW7Bs_wYC6iGpIfiPNS3vIbAHfS_pbDp7q4j-JXEGVw2YkClSSJzmfI7h0S028GDZxfCRefuQC2xvya-U9AdIgbOVvy008EHxLCoeyh1AF3CQCKdXHyAGYnI6PvumXJXkZbJWbJMdyh0nvvT0l-46OQ7TCBaOM4_41xf5KgvLnjrSR6NITO4ggjeaBrXnU7_kYshQ7Hd23_FU90zAO6R3fuGFvQRfm44dcu6vrABMblounFBOAEA4gFmqahk0yQBgGgBk2AB-KBkbUBqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFAiAYRABGB0yAooCOgKAQEi9_cE6gAoDmAsByAsBgAwBqg0CVVPIDQGwE-PatxTYEwrYFAHQFQH4FgGAFwHoFwQ%26ae%3D1%26gclid%3DEAIaIQobChMIvYDto4X9gAMVnBiICR0ELgtVEAEYASAAEgKHPvD_BwE%26num%3D1%26cid%3DCAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE%26sig%3DAOD64_0GiZ1gB9g67XNhNTJELQkjL4HZqg%26client%3Dca-pub-9914992914910847%26dbm_c%3DAKAmf-Dr2xwRGuRkQ-3LuqrSpdRyMBeXWEH-DoyP2EC2WuAvs7OCDp1qq4JrW5f3pRWQzKi2whodx3Igl41liWFO_LFSj2iNI1NhRgQQrG17jLNGal4DT4kWEOreZx0VBXPjEPkWEudOke0t_K3kTmyfNOiNBGP5jftBCqNCNbK1QYRlRDU7xjw%26dbm_d%3DAKAmf-DcuTWtV6W7w8cunpxoQ4S5Jy7MJEUtAbtVTUB4f_zyN0bFCjiqrlq35f5nzaJBye-NvNEovihJgZfnmzB_xmTurM67XZtADo2DZ50DjA0CObCKQ7skg_DqOJU7urMceGY4DxYUba6OLiB0vbikMjmg7-Ois8OPamVUCX4FJEUPkwwuusVddCO68AswX54_P4FXPuKWZtp5sQYKhKk2eyq-eLtWR-nSdOPohQzQ7s25Y2PAv5mT9YYsxBf3NKNROW42eFikPvGswET-l7JovqXqU99oSB-4EUGQP5y1v754Ord-qrlEsmC6gY9rtH_9oV8VLC-AC8oabLFdtF93CqCDYhJALgZISC7bVnhxVfJp6GDDTkLAARIGXzPz5B8y_bM7ROAlEJ8iyIv43yWby44K299ibmVCBl9ZjggQPGdWBWud-x8gJ2iANOLNhYIl5GunqKyo3y4KDIKP-JmqbVdtP3RumFxZU-WnOEgisnul5b1xk0xBbAI2qIb25TQadhxGzSqC%26adurl%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.227.123.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-227-123-3.compute-1.amazonaws.com
Software: clinch /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://realtime.clinch.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-type: image/gif
date: Sun, 27 Aug 2023 14:24:08 GMT
cache-control: no-store
server: clinch
x-robots-tag: none
content-length: 43
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H3 200 728x90_001.jpg
s0.2mdn.net/sadbundle/16124890883933717423/ Frame 6F08 39 KB
39 KB 75ms
74ms Image
image/jpeg 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16124890883933717423/728x90_001.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

93008445041e12a2220d0dcf7f0955cc4b23964b196d504f01627fa8e44c94f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 16:18:19 GMT
x-content-type-options: nosniff
age: 338749
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40022
x-xss-protection: 0
last-modified: Wed, 23 Aug 2023 16:01:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Aug 2024 16:18:19 GMT

GET
H3 200 728x90_002.jpg
s0.2mdn.net/sadbundle/16124890883933717423/ Frame 6F08 36 KB
36 KB 97ms
96ms Image
image/jpeg 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16124890883933717423/728x90_002.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81cf98ae1e014cf370b20aaef0cb64590cf7991f34c35a04703917a945e51f65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 16:18:19 GMT
x-content-type-options: nosniff
age: 338749
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36699
x-xss-protection: 0
last-modified: Wed, 23 Aug 2023 16:01:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Aug 2024 16:18:19 GMT

GET
H3 200 728x90_003.jpg
s0.2mdn.net/sadbundle/16124890883933717423/ Frame 6F08 40 KB
40 KB 116ms
115ms Image
image/jpeg 2607:f8b0:4020:807::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16124890883933717423/728x90_003.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2006 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

066a4661d164d1a0645374fb01884042ca4a3b694a3caeb22ca5924ddf34ef86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16124890883933717423/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 16:18:19 GMT
x-content-type-options: nosniff
age: 338749
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40630
x-xss-protection: 0
last-modified: Wed, 23 Aug 2023 16:01:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 22 Aug 2024 16:18:19 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 54C2 42 B
64 B 116ms
115ms Fetch
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssfft0P2aLjzBFD1Ujhni2jpM4X6zR8kNbc4Z_vrtvaDmXnCGepHnENOFMYXrB-i0t1zxm4vXULbhGjhXbkICnnl9-iYw3gmhdrxl4x1JUX7UDLq3DHvH2RF0XUqe7E4nMc8YXyRGLe9A&sai=AMfl-YRhftBiJ8Ql0fE14cVIQwYoRrnIlhR6YAdSmFqn17siClFlZvvxxqPao7WjpkjyOJhjhGEScFUm-cNCtxFlCwb2b8lDe33EEFiU1OA20CNg9wM8b19fmTqdWM4&sig=Cg0ArKJSzEF_K6M3p47KEAE&cid=CAQSOwBpAlJW2SI-tFyFu3RsPANbQwm9x-RFmbODZhPPNFd6KbUFNecM6mwUHp4LVSD9lvA8NhIW_Ljl5VFZGAE&id=lidar2&mcvt=1097&p=264,1122,518,1422&mtos=0,1097,1097,1097,1097&tos=0,1097,0,0,0&v=20230823&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=2801519046&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693146245951&rpt=1116&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gn
secure-us.imrworldwide.com/cgi-bin/ 44 B
424 B 60ms
59ms Image
image/gif 52.204.12.229
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=au-408075&ch=au-408075_b99_0&sessionId=9wgixs4lne8uceb5vwr9yffkq55wf1693146245&fp_id=ul8jyvo2oqmb9my4o2ia8amcogd611693146245&fp_cr_tm=1693146245176&fp_acc_tm=1693146245176&fp_emm_tm=1693146245176&asn=0&prv=1&c6=vc,b99&ca=NA&c13=asid,NA&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,v60Bsdk&sup=0&segment2=&segment1=&forward=1&ad=0&cr=V&c9=devid,&enc=true&c1=nuid,brrctyjyfiaugpski0arxcz7dlpid1693146245&at=view&rt=text&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,16931462451726656&c30=bldv,6.0.0.663&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&devtypid=&pc=NA&si=https%3A%2F%2Fwindowsxlive.saftawy.com%2F&c73=phtype,&c74=dvcnm,&uoo=&c62=sendTime,1693146248&rnd=657418
Requested by: Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.12.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-12-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
server: nginx
accept-ch: Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 6F08 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C9D2 0
0 114ms
114ms Fetch
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvDumwp1vwkfDWm9mDvLaoQXTk9fvHm2iVdi_6y8gv5IhpzKJPuqvrStbJIPvh-2ARUzBNaagB9UIHCRfjNOcum5nRN0C9t70HLegbjDCu39ZJZ8MmcFpfJBpXlleC5exuSinglNWcY7OlNYiknxOvIVN0A6x41v4dLZmuN2PhiDYRGlhmq4pzskGeU_xM-GSh13gz82TyoyFCgETPg_xhZ2BuM3hxgGzvLFSMc4Z2akCsRDXEXBIIzyKlAN232JINj6LcD0tS4YL1ZeUiXKbZfw4UcbxP0yVibDYjPcHHuAQVLXCNJuQ-eNmJc7kppQ7v9kWk6AmqfdR_0fnQL_L4xto6QNyRshxYqYwmP_IE1ynWVjnGTKS_EXy74TqhznscEIKudtT-EAzEAhFnPXFDGtkihQ8CDJ_bMEbX7MtiVxbp6JYpZqm4Vf9fPPizFKIybVBosnz8-Jd_GdNP31mMuRDnTobZ8j7VNHbjcZW4aeN0ZMzNYV1rQ8NTPZizXLISD_7iG1GA7_DR_S9kdWURDZUx84eqeR0szj4hZMEnt9WXfqarfp1dAEC6W6XysxW3-4vqs_N1gp5n0O9Dq2c2JtnqZm459FXEwpXjIpgvwOfNmO8tN45S6AFg261yemuIyObTOVr_kqD9RkuX1Y0s6lT4pFFCXaK5lAPuKa06HJmEOugBBIyCegnwcgQOotG-b0A6K050cRAT1WSxPM1fqQ3tu1EURP8yostBQD_62jw0Cf7OnAhRKEK789WFYW__K0-NJ5yEVxyOEEDCP6DuBGY0kXlM31Z7A_HAvQzS-TFoTV4Ep0TBJ8B0mO1iw-AKTAwQwYIADn-D0Ld1k3QIYNDVj2C2a1QYIK_YVyJiTmYAcF6xsAXpHy4XQ_ougawiAsLC8QIZ5_sgeKi6Fo7zMTeyc9GcMHTaSP36wVXbRyLi0Ix2ys9FSBnM8MbLjqWvuLBI3tubBhFZTDJPiTi2iztHtNzysuQFzB_VhHPUSXhIHA1sf1GBEJK5UKxOqB1ANrxC1JxtpXZO2i6LjbHPsbfZ4sbDlI8GtbyKF9u2SP02BnUqk5ykpqMaP-L5XfvyDnZ57PvQ1VuAXo2HWYlu_pHvh5XzXacz8QNw00TsbpggGVFQVGCaFgdAT167P44m4gD5nDMrkVThbPbRG8o7OLFo_zjbRw3nIje8BSBYHsN6yurKH7GIuSfOjk7ObfNaenBzCX-WnaCxyWqwVXNdqkg6C7r0EbOdTwS8-WOhUl7v03hMt9H93StHVQ_kCOFlnhK6UqitGHGZsoaWN9YB0WrdEa3OCjdDpFXV3fpyEuL_puYxnLNw&sai=AMfl-YT1oa_eTrID6QrVbfmvcgjotnLxVlQEObE7Zt5kANQ48ppLIqdRDCEa37wkygLXOecxYt3cPo87Jf7Lph96eBRGEKA3li94YILyDRtiZvdXUAbCGIyu2yVkmhhA88Dr7wPZ31aBKvpv_K-6JwHDNUwvelAUld3IIpvMBdlN3101Afs7CpMwx8zosrgN5zTWbm5Dc6SHC6GXvnhETs5sYJWofpnB3dGVta11tI51bI6F3G_PxFKCWFPYWQyF1vIEjTvP&sig=Cg0ArKJSzJzvT5Tt62OiEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1650&vt=11&dtpt=1108&dett=3&cstd=535&cisv=r20230823.83287&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 27 Aug 2023 14:24:08 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1FC1 0
20 B 117ms
115ms Image
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BikYBhlzrZKSgIs7Towai-q_YBgAAAAA4AeAEAg&bg=!LC-lL2DNAAYkVgHwBFY7ADQBe5WfOFJLhorkiL-a6QUqv1rHU0UL3HbcoQQq6Yi_0rPCLjhvhmtGgOH5kI8ivhrAiiVuAgAAAm1SAAAAB2gBB5kDFok1c8R_qQ7PI3djbBKzEDu_f6xxRLfS3ZCifTETaF9DhOG2T8Fj5JcuuSxm-Aldgj57cRilBHja48N1D2oVE2lf06hDTc7e9BWrGpCqYijjo6blfNKIXcRU72JS1ZE6ZD2XH29ZKtXaU5SeC4hRyY2lYzVnbXtTly-T7PKMxIfu_aCjzppyL0LTXtT2vF-VFJ6aL1VkQluTAwtChNi1HEYIL3BrTksnZeTuzCMGy84EJnAo8zhCWwBzBIlcKyq82cLTmtvJoNoU2nkxVqqadz17unHLmO2JyDADaJUW5k4rC8SaaWLBXZxbInycWgztD9W7vmFKSx5fg9LTUAP4f4knWwE4QUardzTnaU95c1RkDsLQ0E-pHOaLH5JMhofJ7WA1QrCkSv0wIfzeHDrtpk6jtk1fpevWwhwL5rbBB6HPX9S2POaFVCXYalf6CKcK4Fz7exd4aAFnc2pJuBNCKkKC5PcB9SVulbDrYkIxreiskAUGNrxbUJAUYZEFe3a3OaLP7QNfFsMJteQrtRJMnd3aRceaIienl_3ceVez7FXQl-aeM_1kIQzxP0fUsqkoq9ulpimpO-5rTyJmC2jDUj6Pv014lBgGXO8HZ7rrhpL6o1xlZtJ-lc-rwJrfO4KMzkIjOb7gaUypacTlBm4YsPqDZtP7aebM4M74Mg2EQ5dOjHyR0bgXYReiSgXw_DgYu511SOQmVL35Zt8z5qd2P6s4YgImUkLSoXqOYicmQ5enoRxDN9pWGk7xgzlqLFB--rjQYNAeznH9DVQaLFT83BAF7bDmdb8Wc4ctANoH36hlFg4BjMtvSk3w6ovp5uwlPz4dw0nD9wcLWo7JU4lgbqmBMXvFvKt0HMxM4fcUaH4Chv8Q4k9Ri4NbIRxNGDDOa_PzpKS5Vf5RNS3zwzThjxCwpDSYaBnFi8qNuTf4JyJeWI1LDC-yjPHU9zKQOLcD7c4KJ7jbMwHGFzDNPqL9X74hb0Z25R-u4yXvNIrJl5xNppiuuVpj4o2dKw1Kxh-Bohae3c7GH3D90g6m5OYhdQ4UrdNK7cA

Requested by

Host: windowsxlive.saftawy.com
URL: https://windowsxlive.saftawy.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 check Show response
jogger.zdbb.net/ 5 B
231 B 750ms
61ms XHR
text/plain 54.209.208.39
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jogger.zdbb.net/check?href=https%3A%2F%2Fwindowsxlive.saftawy.com%2F
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.208.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-208-39.compute-1.amazonaws.com
Software: /
Resource Hash: 4e523a5ae5b4636c75901b79fafbd3912e41dc7987414e688b09d4b436ff22b3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:09 GMT
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=603404
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 5

GET
H2 200 zd-core-olt.min.js Show response
cdn.static.zdbb.net/js/ 844 B
795 B 70ms
66ms Script
application/javascript 23.43.85.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.zdbb.net/js/zd-core-olt.min.js?v=5
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.85.18 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-43-85-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-amz-version-id: NoSc52r87hwdm2sWWqfDUErz_UsoVzrE
content-encoding: gzip
date: Sun, 27 Aug 2023 14:24:08 GMT
last-modified: Thu, 17 Aug 2023 08:35:03 GMT
x-amz-request-id: M1DYGZ7EVXK0T9BQ
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 464
x-amz-id-2: AvLCUeVzHxOnOhIOpfVI+5cLn7FY6e0lP1pz/PDx/KSQesuIu2E9miJHutQiawCXo96wE4ImaaI=
expires: Sun, 03 Sep 2023 14:24:08 GMT

GET
H2 200 bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 782ms
69ms Script
application/javascript 72.247.64.74
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

72.247.64.74 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a72-247-64-74.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
date: Sun, 27 Aug 2023 14:24:09 GMT
last-modified: Fri, 21 May 2021 19:14:21 GMT
server: nginx/1.15.8
etag: W/"60a8068d-cbc2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
content-length: 16078
expires: Sun, 03 Sep 2023 14:24:09 GMT

GET
H2 200 krux-coretag.js Show response
cdn.static.zdbb.net/js/ 335 B
589 B 65ms
64ms Script
application/javascript 23.43.85.18
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.zdbb.net/js/krux-coretag.js
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.43.85.18 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-43-85-18.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4f30bdeed794aeb92d85e55d901c0bdb634df32432010792e3b569ea73cae443

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-amz-version-id: Y68nbPuiDAO3cLyl3mAY_XSn7tAqhxfE
content-encoding: gzip
date: Sun, 27 Aug 2023 14:24:08 GMT
last-modified: Thu, 17 Aug 2023 08:34:56 GMT
x-amz-request-id: M1DRTBC90ERW4F0D
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 255
x-amz-id-2: x/bNuz2P6fJuTLq2FYqEcUE3OJXLDQN8T8amNj/JucozdPUL0m1PIkfLauUwUnyLXXBjnRFRjxg=
expires: Mon, 28 Aug 2023 14:24:08 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 109ms
107ms XHR
application/json 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202308220101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5ae09d5c8ae94ac9ffe86174666a8d2b43e24281d1ac3ab2025e5ade31a7c793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:08 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11795
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 985E 0
20 B 108ms
107ms Image
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQ5kUhlzrZIeHJNf8owbf8qrgCwAAAAA4AeAEAg&bg=!nZ6lntHNAAYkVgHwBFY7ADQBe5WfOLZTCfKCiZNDVhBQJ_wsdNLxRrGZCWsfmizf26ER0iapSl_Cd3VCwiOWpkSN7p5IAgAAAnJSAAAADGgBBwoAapZIMbG0uZ0QbWIr_ZGCUx6d02o-dFrikmpZZtSs35pPMnak9dTdPWqD9pnS2c54qfPmxU53ZDF33tOvnzhUtNaAb0Sednralmax2bt-yFRTrIyP6ZCv2mzQ3vJm8nsRRLu3Yebcb55tI_aZAwzR1WdfsY4cgT9wfjcrkw759oQm8TvfCOuxIRyM2Muy5DHGyHNig3AKRJzSb5f3Js2OsGtscY0JhCvJ-Bo3LGZD2D7vXc-I1tUVQ6Wnt2oraMxapBQ7jo-jO0Y8U5WscCpZnG7dZGfLSHazeUbpzxdWz1DsVWsDUMWAnVVfqzF8IdnnOSRjGHd8KGCwt3ZGl8IvdjaUhAj14nZWtLYj70obTgmvDq_lfrbqjonNjrrkyOHlkLTCfs1A21euxVAbYm8PxwCdwWnmY2mVoua61otMjuZKvz5jkOAxvLMcfx9Cd-vSy8TKRlC5eXZWTxyDaNzGwfndQtV9M6zHIE86BdrDtDWvF2m4NJOXFHJbqMzwklOKx8ym898TqobQeKYhPc_HUSCY-z_OoMDlSPQtdI5ou2U1rZcOW6x7ta7w3cDHRpPb_SN3MxGJqtZvCE2VFDgD_CAXAHr2IkPzAA3dCCvIZhsd5vl6rZyiSU5dzNgNHVk-RpYhaRUTDKNKS0AtW3gLgCs5lSYusmzAARNwoEBJVtJbR0lXw5_JnV4--OSGNdO1kYkIa8Jyuwr80mm5sZHiWAqXfticqkqX8kARwTLO6ymEpSiQbjIgQZWMqslXIzR_fmOtVRuPKyML0qqADb7W5vpdfBbLmTwTC454nCcERY_xHlaDkvzgJqd6TuufpGl91FjLJWjweWK8IUC9l9Nx9ugQJQ7n5ns_R0mBf2OnOrPNrzXEvIRUSEdhxjwsaFCMA5lcxaV8wlD8BUj3C0sWWo-xppGJDZWbibWmrVrqVgiGFJRsYZJFH3nzMdxgC676_QfZgk0gdBUoPh7MQA8JJwE_GVZNwaHQsxqWrvfnNY5OI7HQJ3kCIz34T5gMWgBiS8RD8O-0Xdjwv5b_Qsn3wt_zLP1u2FDHLkCpF6FXPq8RfJ86mLxnIOFqZQtn9WmxOO6U9hx-MUioBbUDlRkcFDba98tUjko3Egvu9IAoCqt915A6Ps_WhuvpnMs0t00PRAYFOt9Pkyljh0fkVyQWmTDF69a2eq8qL5E

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/162/82/3/0a0a0a0/ Frame D282 4 KB
5 KB 68ms
66ms Image
image/webp 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/162/82/3/0a0a0a0/?u=%2F%2Fcdn.clinch.co%2Fa_styles%2F3029%2FGeneral_truck63777706717564.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: 9f86214c6d960ceee948f990ed88ed18a231f8c72b449dec142036e6910a2575

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 02:03:53 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 130815
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=606730
content-length: 4348
x-amz-cf-id: O_Nbsd1SHEOnN_XRd2iWvOc_k3gYiHkDwVHD3uUxEP2la5b1NV-Vvg==

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/104/80/2/0a0a0a0/ Frame D282 1 KB
2 KB 86ms
77ms Image
image/webp 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/104/80/2/0a0a0a0/?u=https%3A%2F%2Fcdn.clinch.co%2Fa_products_feed%2F512%2F3921%2Fassets_library%2FZephyrhills_1%20Color_White_Logo%20(1).png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: b265476177e3ab0431283434dc52fb94854b6763cf84b236fb858de18c3757ad

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Mon, 21 Aug 2023 08:41:40 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 538948
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=650833
content-length: 1404
x-amz-cf-id: SGDD8Y8_7H8OSdTAL6_qa8m4cCFdPVmA29-fTWTz68UkgfcZ63woxg==

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/140/140/2/0a0a0a0/ Frame D282 3 KB
3 KB 86ms
78ms Image
image/webp 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/140/140/2/0a0a0a0/?u=https%3A%2F%2Fcdn.clinch.co%2Fa_client%2F512%2Fassets_library%2Fproduct-230x230-Lumina_ZH.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: 1852b86f96afa96e95103ee031a4fac938f321680f04f2090b6306cebed3b548

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 20 Aug 2023 09:12:10 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 623518
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=647332
content-length: 2782
x-amz-cf-id: OivcvTobLMg9V0tSpOTXn764U-rLtYUN3_lo34K_x1idpIezgOAehw==

GET
H2 200 /
img-cdn.clinch.co/img2/yps7WO/300/250/2/0a0a0a0/ Frame D282 16 KB
16 KB 87ms
79ms Image
image/jpeg 2600:9000:25f4:5e00:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img-cdn.clinch.co/img2/yps7WO/300/250/2/0a0a0a0/?u=https%3A%2F%2Fcdn.clinch.co%2Fa_products_feed%2F512%2F3921%2Fassets_library%2FNWNA_DCO_BG_LifeStyle_ZH_300x250_2X.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f4:5e00:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: clinch /
Resource Hash: 31f8dd4c33c94b6ed7e64f46dd076e4f39cbd149a405b8dacd29b6c1ba7cd8e4

Request headers

Referer: https://realtime.clinch.co/
Origin: https://realtime.clinch.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 15:58:08 GMT
via: 1.1 42767add45e69e5301179d85b782d162.cloudfront.net (CloudFront)
server: clinch
x-amz-cf-pop: CMH68-P4
age: 253560
x-cache: Hit from cloudfront
edge-cache-tag: 512
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=630364
content-length: 16090
x-amz-cf-id: TUfevN2c5q-qVrgwvCnSe4-NOsVNel9Ku83xeFRs2K18C7I0GTKD2Q==

GET
H2 200 spgdj7g8u.js Show response
cdn.krxd.net/controltag/ 2 B
405 B 669ms
34ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/spgdj7g8u.js
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/krux-coretag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Sun, 27 Aug 2023 14:24:09 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 819
x-cache: MISS, HIT, HIT
x-app-cache: MISS
x-age: 0
content-length: 22
x-served-by: config-service-a006-ash-prod.krxd.net, cache-iad-kjyo7100110-IAD, cache-mia-kmia1760094-MIA
x-response-time: 0
x-do-esi: esi
x-timer: S1693146249.196292,VS0,VE0
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 7, 52

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 135ms
121ms Script
text/javascript 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 27 Aug 2023 14:24:08 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame EBB6 13 KB
5 KB 98ms
76ms Document
text/html 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 106483
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Aug 2023 08:49:26 GMT
expires: Sun, 25 Aug 2024 08:49:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9C60 829 B
557 B 121ms
101ms Document
text/html 2607:f8b0:4020:807::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:807::2004 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d95a95fa9822e4c25fa0225fab775b0ab9d37ba90bc9a4fa1b9f3986fb7e8720

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-XNlibJwVJiYkhtFur3rThw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 535
content-security-policy: script-src 'report-sample' 'nonce-XNlibJwVJiYkhtFur3rThw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 14:24:09 GMT
expires: Sun, 27 Aug 2023 14:24:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 view_y
trk.clinch.co/ Frame D282 43 B
218 B 60ms
60ms Image
image/gif 34.227.123.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trk.clinch.co/view_y?cid=yps7WO&caid=10929&caver=34692&frmt=300a250&csid=45597&dsp=dv360&plcid=372641689&plc=497225&iid=34e592e8-4fa4-46b2-b8d9-242bf57fcf6c&env=web&hid=4abee9a9-d355-4814-8ecf-da6782dbc972&fcpath=lJIKBJIOAZJPAZJOwA&prd=Ecommerce&ids=ZH1&isrc=topItems&issrc=ZEPHYRHILLS&feed=3920&tilid=7833&lpsrc=Campaign&locsrc=Ip2LocDb&loc=x2Jj0gAAAGRx3AAXy0BEZgEA9wzLwFJ-FHrhR64DolVTA6JOWQOoTmV3IFlvcmsKAPAKpTEwMDI1A80B9QOwYW1lcmljYS9uZXdfeScA8AarcHNpbmV0IGluYy4DAQOhYqNoc3Q&g0var=77,78&g0sid=78&g0stg=77,78&g0node=79&dspiid=ABAjH0jlaTaymWmK21AbyYT93QGm&dsp_caid=20441486106&dsp_pub_id=1&domain=windowsxlive.saftawy.com&dsp_insertion_order_id=1014065068&dsp_crid=510375083&tc=&a=1693146249193
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 34.227.123.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-227-123-3.compute-1.amazonaws.com
Software: clinch /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://realtime.clinch.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-type: image/gif
date: Sun, 27 Aug 2023 14:24:09 GMT
cache-control: no-store
server: clinch
x-robots-tag: none
content-length: 43
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

GET
H2 200 30629 Show response
stags.bluekai.com/site/ Frame C265 428 B
899 B 165ms
164ms Document
text/html 184.50.205.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dwindowsxlive.saftawy.com&phint=referer%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=bbseg%3D1100034&phint=bbseg%3D900492&phint=bbseg%3D900111&phint=bbseg%3D6929&phint=bbseg%3D900115&phint=bbseg%3D6816&phint=bbseg%3D6817&phint=bbseg%3D900002&phint=bbseg%3D6947&phint=bbseg%3D900387&phint=bbseg%3D6823&phint=bbseg%3D900263&phint=bbseg%3D6825&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D6831&phint=bbseg%3D6833&phint=bbseg%3D6834&phint=bbseg%3D1100095&phint=bbseg%3D6848&phint=bbseg%3D1100482&phint=bbseg%3D900163&phint=bbseg%3D900171&phint=bbseg%3D6867&phint=bbseg%3D900189&phint=bbseg%3D1200482&phint=bbseg%3D6886&phint=bbseg%3D900455&phint=bbseg%3D900331&phint=bbseg%3D1100015&phint=bbseg%3D900207&phint=__bk_t%3DWindows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&phint=__bk_k%3Dwindows%2010%2C%20mac%2C%20os%20x%20el%20capitan%2C%20windows%2010%20theme%2C%20windows%208%20theme%2C%20windows%208%20customization%2C%20mac%20theme%2C%20mac%20customization%2C%20download%2C%20windows%20xp%2C%20windows%207%2C%20windows%208%2C%20windows%208.1%2C%20theme%2C%20transformation%2C%20customization%2C%20pack%2C%20news%2C%20review%2C%20ux%2C%20windows%2C%20apple%2C%20os%20x%20yosemite%2C%20os%20x%20mavericks%2C%20mavericks%2C%20lion%2C%20transformation%20pack%2C%20uxtheme%2C%20patcher%2C%20aero%2C%20glass%2C%20windows%20x%2C%20speed%20up%2C%20faster%2C%20livetuner%2C%20optimization%2C%20optimizer%2C%20optimizer%20xp%2C%20performance%2C%20tuner%2C%20tuning%2C%20tweak&phint=__bk_l%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=39506220
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.50.205.247 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: cba4ae1feed7df2f34d79e855a1a8236d9ad9c174fcc5eb629c4ebed41ee7cb7

Request headers

Referer: https://windowsxlive.saftawy.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

bk-server: 9fc7
cache-control: max-age=0, no-cache, no-store
content-length: 428
content-type: text/html
date: Sun, 27 Aug 2023 14:24:09 GMT
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
pragma: no-cache

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9C60 0
0 103ms
102ms Image
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202308220101&jk=2210391038026492&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
H3 200 0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js Show response
pagead2.googlesyndication.com/bg/ Frame EBB6 37 KB
14 KB 74ms
74ms Script
text/javascript 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0w4HeoaYEDyr3MppZwiwXJgG2WIOQk_JViOVQEuG4uU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d30e077a8698103cabdcca696708b05c9806d9620e424fc9562395404b86e2e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Wed, 23 Aug 2023 14:17:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 345987
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14706
x-xss-protection: 0
last-modified: Tue, 22 Aug 2023 10:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 22 Aug 2024 14:17:42 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C9D2 0
20 B 103ms
103ms Ping
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1893522312939&version=m202307240101&ct=76&x=1&cor=1398298571471615500

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 54C2 0
20 B 105ms
104ms Ping
image/gif 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8999221497232&version=m202307240101&ct=77&x=1&cor=12706996704164635000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

2981
tags.bluekai.com/site/ Frame C265
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=bluekai&google_cm&google_sc&google_hm=Z1RoemUwamw5OTlRUEkrQQ%3D%3D
https://tags.bluekai.com/site/2981?id=&google_gid=CAESEBNygMp8u18yF1EUCOu5mnE&google_cver=1

62 B
305 B

156ms
153ms

Image
image/gif

184.50.205.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/2981?id=&google_gid=CAESEBNygMp8u18yF1EUCOu5mnE&google_cver=1
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dwindowsxlive.saftawy.com&phint=referer%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=bbseg%3D1100034&phint=bbseg%3D900492&phint=bbseg%3D900111&phint=bbseg%3D6929&phint=bbseg%3D900115&phint=bbseg%3D6816&phint=bbseg%3D6817&phint=bbseg%3D900002&phint=bbseg%3D6947&phint=bbseg%3D900387&phint=bbseg%3D6823&phint=bbseg%3D900263&phint=bbseg%3D6825&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D6831&phint=bbseg%3D6833&phint=bbseg%3D6834&phint=bbseg%3D1100095&phint=bbseg%3D6848&phint=bbseg%3D1100482&phint=bbseg%3D900163&phint=bbseg%3D900171&phint=bbseg%3D6867&phint=bbseg%3D900189&phint=bbseg%3D1200482&phint=bbseg%3D6886&phint=bbseg%3D900455&phint=bbseg%3D900331&phint=bbseg%3D1100015&phint=bbseg%3D900207&phint=__bk_t%3DWindows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&phint=__bk_k%3Dwindows%2010%2C%20mac%2C%20os%20x%20el%20capitan%2C%20windows%2010%20theme%2C%20windows%208%20theme%2C%20windows%208%20customization%2C%20mac%20theme%2C%20mac%20customization%2C%20download%2C%20windows%20xp%2C%20windows%207%2C%20windows%208%2C%20windows%208.1%2C%20theme%2C%20transformation%2C%20customization%2C%20pack%2C%20news%2C%20review%2C%20ux%2C%20windows%2C%20apple%2C%20os%20x%20yosemite%2C%20os%20x%20mavericks%2C%20mavericks%2C%20lion%2C%20transformation%20pack%2C%20uxtheme%2C%20patcher%2C%20aero%2C%20glass%2C%20windows%20x%2C%20speed%20up%2C%20faster%2C%20livetuner%2C%20optimization%2C%20optimizer%2C%20optimizer%20xp%2C%20performance%2C%20tuner%2C%20tuning%2C%20tweak&phint=__bk_l%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=39506220
Protocol: H2
Server: 184.50.205.247 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Sun, 27 Aug 2023 14:24:09 GMT
content-length: 62
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://tags.bluekai.com/site/2981?id=&google_gid=CAESEBNygMp8u18yF1EUCOu5mnE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 296
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

5386
tags.bluekai.com/site/ Frame C265
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://tags.bluekai.com/site/5386?id=b63acc23-5e25-44ec-82bb-fa25cc39cfd3&gdpr=0&gdpr_consent=

62 B
305 B

170ms
156ms

Image
image/gif

184.50.205.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/5386?id=b63acc23-5e25-44ec-82bb-fa25cc39cfd3&gdpr=0&gdpr_consent=
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dwindowsxlive.saftawy.com&phint=referer%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=bbseg%3D1100034&phint=bbseg%3D900492&phint=bbseg%3D900111&phint=bbseg%3D6929&phint=bbseg%3D900115&phint=bbseg%3D6816&phint=bbseg%3D6817&phint=bbseg%3D900002&phint=bbseg%3D6947&phint=bbseg%3D900387&phint=bbseg%3D6823&phint=bbseg%3D900263&phint=bbseg%3D6825&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D6831&phint=bbseg%3D6833&phint=bbseg%3D6834&phint=bbseg%3D1100095&phint=bbseg%3D6848&phint=bbseg%3D1100482&phint=bbseg%3D900163&phint=bbseg%3D900171&phint=bbseg%3D6867&phint=bbseg%3D900189&phint=bbseg%3D1200482&phint=bbseg%3D6886&phint=bbseg%3D900455&phint=bbseg%3D900331&phint=bbseg%3D1100015&phint=bbseg%3D900207&phint=__bk_t%3DWindows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&phint=__bk_k%3Dwindows%2010%2C%20mac%2C%20os%20x%20el%20capitan%2C%20windows%2010%20theme%2C%20windows%208%20theme%2C%20windows%208%20customization%2C%20mac%20theme%2C%20mac%20customization%2C%20download%2C%20windows%20xp%2C%20windows%207%2C%20windows%208%2C%20windows%208.1%2C%20theme%2C%20transformation%2C%20customization%2C%20pack%2C%20news%2C%20review%2C%20ux%2C%20windows%2C%20apple%2C%20os%20x%20yosemite%2C%20os%20x%20mavericks%2C%20mavericks%2C%20lion%2C%20transformation%20pack%2C%20uxtheme%2C%20patcher%2C%20aero%2C%20glass%2C%20windows%20x%2C%20speed%20up%2C%20faster%2C%20livetuner%2C%20optimization%2C%20optimizer%2C%20optimizer%20xp%2C%20performance%2C%20tuner%2C%20tuning%2C%20tweak&phint=__bk_l%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=39506220
Protocol: H2
Server: 184.50.205.247 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Sun, 27 Aug 2023 14:24:09 GMT
content-length: 62
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:09 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://tags.bluekai.com/site/5386?id=b63acc23-5e25-44ec-82bb-fa25cc39cfd3&gdpr=0&gdpr_consent=
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 221

GET
H2

200

19505
tags.bluekai.com/site/ Frame C265
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=BLKAI
https://ups.analytics.yahoo.com/ups/58739/cms?partner_id=BLKAI
https://tags.bluekai.com/site/19505?id=y-gZThhsBE2pKhg.ZvZAnqlWon3tYg9mbCWX0-~A

62 B
305 B

149ms
143ms

Image
image/gif

184.50.205.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/19505?id=y-gZThhsBE2pKhg.ZvZAnqlWon3tYg9mbCWX0-~A
Requested by: Host: stags.bluekai.com
URL: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Dwindowsxlive.saftawy.com&phint=referer%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=bbseg%3D1100034&phint=bbseg%3D900492&phint=bbseg%3D900111&phint=bbseg%3D6929&phint=bbseg%3D900115&phint=bbseg%3D6816&phint=bbseg%3D6817&phint=bbseg%3D900002&phint=bbseg%3D6947&phint=bbseg%3D900387&phint=bbseg%3D6823&phint=bbseg%3D900263&phint=bbseg%3D6825&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D6831&phint=bbseg%3D6833&phint=bbseg%3D6834&phint=bbseg%3D1100095&phint=bbseg%3D6848&phint=bbseg%3D1100482&phint=bbseg%3D900163&phint=bbseg%3D900171&phint=bbseg%3D6867&phint=bbseg%3D900189&phint=bbseg%3D1200482&phint=bbseg%3D6886&phint=bbseg%3D900455&phint=bbseg%3D900331&phint=bbseg%3D1100015&phint=bbseg%3D900207&phint=__bk_t%3DWindows%20X%27s%20Live%20%E2%80%93%20Bringing%20the%20best%20Windows%2010%20and%20OS%20X%20El%20Capitan%20user%20experience%20to%20everyone&phint=__bk_k%3Dwindows%2010%2C%20mac%2C%20os%20x%20el%20capitan%2C%20windows%2010%20theme%2C%20windows%208%20theme%2C%20windows%208%20customization%2C%20mac%20theme%2C%20mac%20customization%2C%20download%2C%20windows%20xp%2C%20windows%207%2C%20windows%208%2C%20windows%208.1%2C%20theme%2C%20transformation%2C%20customization%2C%20pack%2C%20news%2C%20review%2C%20ux%2C%20windows%2C%20apple%2C%20os%20x%20yosemite%2C%20os%20x%20mavericks%2C%20mavericks%2C%20lion%2C%20transformation%20pack%2C%20uxtheme%2C%20patcher%2C%20aero%2C%20glass%2C%20windows%20x%2C%20speed%20up%2C%20faster%2C%20livetuner%2C%20optimization%2C%20optimizer%2C%20optimizer%20xp%2C%20performance%2C%20tuner%2C%20tuning%2C%20tweak&phint=__bk_l%3Dhttps%3A%2F%2Fwindowsxlive.saftawy.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=39506220
Protocol: H2
Server: 184.50.205.247 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-50-205-247.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: en-US,en;q=0.9
Referer: https://stags.bluekai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Sun, 27 Aug 2023 14:24:10 GMT
content-length: 62
content-type: image/gif

Redirect headers

location: https://tags.bluekai.com/site/19505?id=y-gZThhsBE2pKhg.ZvZAnqlWon3tYg9mbCWX0-~A
date: Sun, 27 Aug 2023 14:24:09 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.75
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame EBB6 0
10 B 80ms
77ms Image
text/plain 2607:f8b0:4020:807::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?pWoWAw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:807::2001 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 14:24:09 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 111ms
108ms Image
text/html 2607:f8b0:4020:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202308220101&jk=2210391038026492&bg=!5-Sl5KvNAAYkVgHwBFY7ADQBe5WfOM18ZMd8iXJelZz5Pdrx1iwgplZuh1yo85FU8TurmsTx2hFyuqDKHHTzcjUJx-HiAgAAAS5SAAAADGgBBwoAF7tgnxuXUolLGXLbPnLkXz6Zrt0ejOeymQK9gpPPFSMxwI3Vt6TEP0hqjPct4XkHLsiHmxOb8YKjEFqbdRRkV6eajw-fmYUPuSxjp5v60ufR_QseU6IlDa8q4Ebw0vnckxpzQIheBl8m1EpFDNJxT8d9zwaqh8w5b0yBTkBUBP7JZ8FNrHKuPZ0aE-5kAo42kP_mAu7if3oCAD8SBTD9zpVlRXEi_qYO7GFabTWQZfKiUTHqUFinCgcsFJrAz34vK65uL7W5UNTN0uZcmhrG9ukduk8wIqZHkwA54Yk6jYKUYkI4MG2ftt9ldNJ9VfPJds6eJaJgDrBWg08Ri5Dy5IpQXK9kqw3XeBFY9u5zJy2n7MXeUbLEgj6FwcllziHf9DNeiEszINgLcCcJgzc64BJKw1pWuhIzrMXgLShNpfDe_uAWLxIt16O9Exs2DRXmknu4dN3LQ_BPc2AzNXojV_Kb0AHbaStiq59h6eLMZGwuK1JqjjbZbS4YpahVjL4ZabgSu4AWIGBgCZGWfU6dtTvyd2fdrHJS_BX_fRNSG3mkBBX9gpJ5OHJd5PH3u7-kl4vmQfsF9Xht4beRV8C7jHRQaMwZ0eMfl0kkwT7r9o6N1cez-7uFZM_8zHtKiHaDbLBPi9o0BMW6nIhlyMGGuYknezo2gJSY37dAh3Sijw6pYLF_FqmEpHhX7UgfKvibNpStinKqGSUX3joYOlX-soaajr2UXgPBnB6isQTkj0HcVelTVtaga2-XO3HRH0iwp5GDhYahDD3nnaQaa5M9WsFm3yGkGyOP5hf55lSlc0OkbB6-dDw_N0u1BrkBBj9mfTjYdjExG_902dfgcAhgVGv5W1XLY9Yi2lf5KVYxiCv1x0J4-DyymTuJVD6qRjJ8uDhZnNyBhzMJpTvYg3S-K7czhuHj7ioDbPa3bKsrorR2OWXqP5z68zxIPjHWlEj5Arud6LYyp8o
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://windowsxlive.saftawy.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

GET
H2 200 dc_oe=ChMIpPvQpIX9gAMVzunICh0i_QtrEAAYACCntZVeQhMIu4Dto4X9gAMVnBiICR0ELgtV;met=1;&timestamp=1693146258405;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame C9D2 42 B
401 B 290ms
105ms Image
image/gif 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIpPvQpIX9gAMVzunICh0i_QtrEAAYACCntZVeQhMIu4Dto4X9gAMVnBiICR0ELgtV;met=1;&timestamp=1693146258405;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 27 Aug 2023 14:24:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: w.po.st
URL: https://w.po.st/share/script/post-widget.js

Domain: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?pid=mla6m40&t=gif

Domain: search.keywordblocks.com
URL: http://search.keywordblocks.com/cmedianet?cid=8CU2338X2&size=160x600&crid=610386075

Verdicts & Comments Add Verdict or Comment

160 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

90 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
windowsxlive.saftawy.com/	1969-12-31 23:59:59	Name: ntvSession Value: {}
.postrelease.com/	1970-01-20 23:04:42	Name: visitor Value: ff060fb2-5c0e-4f44-9e9e-7d7f7dacdc36
.postrelease.com/	1970-01-20 23:04:42	Name: status Value: 0
.saftawy.com/	1970-01-20 23:55:06	Name: _ga Value: GA1.2.767488006.1693146243
.saftawy.com/	1970-01-20 14:20:32	Name: _gid Value: GA1.2.685388684.1693146243
.saftawy.com/	1970-01-20 14:19:06	Name: _gat Value: 1
windowsxlive.saftawy.com/	1969-12-31 23:59:59	Name: logglytrackingsession Value: 9fab1df4-58a5-4e64-8a8a-f9d5311e39b3
.saftawy.com/	1970-01-20 14:19:06	Name: _gat_ns Value: 1
.saftawy.com/	1969-12-31 23:59:59	Name: zd_session_id Value: 5e26014c-637f-45c6-b5f7-bfcc6ad3c6f9
windowsxlive.saftawy.com/	1970-01-20 15:02:18	Name: fu Value: 1
.saftawy.com/	1970-01-20 18:38:18	Name: h_zdbb Value:
.saftawy.com/	1969-12-31 23:59:59	Name: zpack Value: eyJ6ZGJiIjoiIiwiZnBpZCI6bnVsbCwicHBpZCI6IjU5NmMxYjI0ODdiNTQ4ODg4MzlhOTFhMDc1MGY2NjJiIiwidWVfbTJzIjoiIiwibGNsX2lkIjoiIiwibG9jIjoiaHR0cHM6Ly93aW5kb3dzeGxpdmUuc2FmdGF3eS5jb20vIiwicHZfaWQiOiJlNjNlYWRhMi02ZTg4LTQyNmItODBlNS03Y2IzZTYwOGViY2QiLCJzZXNzX2lkIjoiNWUyNjAxNGMtNjM3Zi00NWM2LWI1ZjctYmZjYzZhZDNjNmY5In0=
.scorecardresearch.com/	1970-01-20 23:55:06	Name: UID Value: 1A2afa9f6dc0f731cbb61b81693146243
.zdbb.net/	1970-01-20 15:02:18	Name: csp Value: 0
.zdbb.net/	1970-01-20 18:38:18	Name: h_zdbb Value: 596c1b2487b54888839a91a0750f662b
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_go Value: 1
.saftawy.com/	1970-01-20 23:55:06	Name: _ga_Q1821CHBT3 Value: GS1.2.1693146243.1.0.1693146243.0.0.0
windowsxlive.saftawy.com/	1970-01-20 14:19:20	Name: geoCC Value: US
.doubleclick.net/	1970-01-20 23:55:06	Name: IDE Value: AHWqTUmcxcozVH4sAdvXLmwAoe_dTL5vHRjlWxWQbA3jbTn5JvxGEDLn6c70UGab-xE
.openx.net/	1970-01-20 23:04:42	Name: i Value: 1115db06-82ec-0faa-2c82-ad7e4a4ff1e6\|1693146244
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_ns Value: 1
.rubiconproject.com/	1970-01-20 23:04:42	Name: khaos Value: LLTJK3IJ-1G-M9YL
.rubiconproject.com/	1970-01-20 23:04:42	Name: audit Value: 1\|clb2f5t+FPrl3RYd3feB6KS5Bv7H1ouoxdnNVF8ci14pFQkGbpMNqAsxqWXNg6zvS3petGpnmj7kTJ/sI0r9SYqNS8gEjQkR4HEYI5ehIrVd7QnCalft3L7FQD2yB//hvsVAPbIH/+E=
.adnxs.com/	1970-01-20 16:28:42	Name: icu Value: ChgI2aksEAoYASABKAEwhLmtpwY4AUABSAEQhLmtpwYYAA..
.adnxs.com/	1970-01-20 16:28:42	Name: uuid2 Value: 6389646049437144040
.agkn.com/	1970-01-20 23:04:42	Name: ab Value: 0001%3AlYaDBRHfZF1mgPAkiEdRylYdrW3bAcYJ
.imrworldwide.com/	1970-01-20 23:40:42	Name: IMRID Value: 603e9de0-44e5-11ee-b90b-1b3a23ce86fe
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_bk Value: 1
.saftawy.com/	1970-01-20 18:38:18	Name: nol_fpid Value: ul8jyvo2oqmb9my4o2ia8amcogd611693146245\|1693146245176\|1693146245176\|1693146245176
.bluekai.com/	1970-01-20 18:44:03	Name: bku Value: Qly99/PzbtxvCNyw
.zdbb.net/	1970-01-20 14:19:13	Name: zd_cs_td Value: 1
.adsrvr.org/	1970-01-20 23:06:08	Name: TDID Value: b63acc23-5e25-44ec-82bb-fa25cc39cfd3
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_None Value: 1
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_bw Value: 1
.saftawy.com/	1970-01-20 23:40:42	Name: __gads Value: ID=2f6f6be90ac94808:T=1693146244:RT=1693146244:S=ALNI_MaS1j704JeNi-qFCuKCZ8ZxKEe4zw
.saftawy.com/	1970-01-20 23:40:42	Name: __gpi Value: UID=00000d8e13e9d690:T=1693146244:RT=1693146244:S=ALNI_MYuif68IGU-b_7uYfSPIrMsFQQJIw
.bidr.io/	1970-01-20 23:47:39	Name: bito Value: AAAyoU7J1rkAACYsVV_yHA
.bidr.io/	1970-01-20 23:47:39	Name: bitoIsSecure Value: ok
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_aam Value: 1
.demdex.net/	1970-01-20 18:38:18	Name: demdex Value: 16517465780325121254070302540021926316
.simpli.fi/	1970-01-20 23:06:08	Name: suid Value: CC62689BB1534F359EF2A228B8FA6803
.adingo.jp/	1970-01-20 15:02:18	Name: ID Value: cb2524cd04f0865c2d6fc3255a792a88
.pubmatic.com/	1970-01-20 14:20:32	Name: KTPCACOOKIE Value: YES
.owneriq.net/	1970-01-20 23:55:06	Name: si Value: Q7464326461548165047P
.owneriq.net/	1970-01-20 14:33:30	Name: p2 Value: gguuid
.owneriq.net/	1970-01-20 14:33:30	Name: gguuid Value: 1
.w55c.net/	1970-01-20 23:50:47	Name: wfivefivec Value: zeQLs1qc1QAgGq5
.dpm.demdex.net/	1970-01-20 18:38:18	Name: dpm Value: 16517465780325121254070302540021926316
.adnxs.com/	1970-01-20 16:28:42	Name: anj Value: dTM7k!M41.D>6NRF']wIg2Hc!q11o=!@wnfH8K6pQK`!5=E<L5?%M/65#$leWS$cy_ib[:[F(3_YGEAjO[ulC!/e%nugO%v4VB%nnu6*.XDg
.casalemedia.com/	1970-01-20 16:28:42	Name: CMPS Value: 014
.casalemedia.com/	1970-01-20 16:28:42	Name: CMPRO Value: 014
.zemanta.com/	1970-01-20 23:04:42	Name: zuid Value: xKOtLwBHRB3_Wwk6Sz0b
.pubmatic.com/	1970-01-20 23:04:42	Name: KADUSERCOOKIE Value: 6230F9F1-7335-4158-84FF-01580FA7F598
.casalemedia.com/	1970-01-20 23:04:42	Name: CMID Value: ZOtchvwmdzIifd8VY0TdywAA
.doubleclick.net/	1970-01-20 18:38:18	Name: APC Value: AfxxVi7EUuTJHYWMzYYZpAf4QncG77hrTz5OTfr20JgsdxT2cBNwzw
.w55c.net/	1970-01-20 15:02:18	Name: matchgoogle Value: 5
.zdbb.net/	1970-01-20 15:02:18	Name: zd_cs_pm Value: 1
.smartadserver.com/	1970-01-20 23:49:20	Name: pid Value: 216506690543231001
.doubleclick.net/	1970-01-20 14:19:09	Name: DSID Value: NO_DATA
.zdbb.net/	1970-01-20 14:19:13	Name: zd_cs_eo Value: 1
.clinch.co/	1970-01-20 23:55:06	Name: clinch-sid Value: 91175de6-c7e6-480d-a9c3-a44d4710f3c5
fksnk.com/	1970-01-20 14:29:11	Name: AWSALBCORS Value: y7izC8YB0XRvIqFPPmQtFKniwHIBEYsuXFvOPM0e2pE6LmfQCcekVyloxl2kgB3Sbu1eDc8FLzn1SkiK6m4AAsIcNs/NGeyZ75v2NStUbVLGEhKXHZM2XDjhmlA1
.fksnk.com/	1970-01-20 16:28:42	Name: f_001 Value: 0AAC258417ACB150
.fksnk.com/	1970-01-20 14:20:32	Name: g_001 Value: 1
.360yield.com/	1970-01-20 16:28:42	Name: tuuid Value: 2fd81a14-975c-4885-8d03-12a4bf46feee
.360yield.com/	1970-01-20 16:28:42	Name: tuuid_lu Value: 1693146247
.blismedia.com/	1970-01-20 23:04:46	Name: b Value: 64EB5C87ABE6A7063DC74AABBLIS
.adform.net/	1970-01-20 15:03:44	Name: C Value: 1
.mediago.io/	1970-01-20 23:04:42	Name: __mguid_ Value: bbce98103257336f0b10f0bbe93aff34
.media.net/	1970-01-20 23:04:42	Name: visitor-id Value: 3361478471524294000V10
.media.net/	1970-01-20 14:39:15	Name: data-g Value: CAESEF2dnPIHI-V-KZGPIFqL0hU~~3
.eyeota.net/	1970-01-20 23:06:08	Name: mako_uid Value: 18a3761714d-10f90000010a4a7f
.eyeota.net/	1970-01-20 14:19:06	Name: SERVERID Value: 19071~DM
.sharethrough.com/	1970-01-20 15:02:18	Name: stx_user_id Value: ddbb32cf-34f8-4d6c-b4c9-e42bf4b062f8
.quantserve.com/	1970-01-20 16:28:42	Name: d Value: EFYBCQHnKYEA
.quantserve.com/	1970-01-20 23:49:20	Name: mc Value: 64eb5c87-80fb4-37361-6f8c4
.mfadsrvr.com/	1970-01-20 23:55:06	Name: tuuid Value: 736e009b-18d8-425e-a237-828d534940b9
.mfadsrvr.com/	1970-01-20 23:55:06	Name: c Value: 1693146247
.mfadsrvr.com/	1970-01-20 23:55:06	Name: tuuid_lu Value: 1693146247
.teads.tv/	1970-01-20 23:03:15	Name: tt_viewer Value: 4d06fff6-cd63-46a2-a6a2-c5d925fb5345
.adform.net/	1970-01-20 15:45:30	Name: uid Value: 8816144966851869623
.mfadsrvr.com/	1970-01-20 23:55:06	Name: ssh Value: !google,1693146247
.googleadservices.com/	1970-01-20 16:28:42	Name: ar_debug Value: 1
.1rx.io/	1970-01-20 23:04:42	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-d7032288-63a6-4bd1-a77f-814159b8a9c4-005%22%7D
.openx.net/	1970-01-20 14:40:42	Name: pd Value: v2\|1693146247\|gy
.targeting.unrulymedia.com/	1970-01-20 23:04:42	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-d7032288-63a6-4bd1-a77f-814159b8a9c4-005%22%7D
.bluekai.com/	1970-01-20 18:38:18	Name: bkdc Value: phx
.adsrvr.org/	1970-01-20 23:06:08	Name: TDCPM Value: CAESFgoHYmx1ZWthaRILCLCGy_npxJM8EAUYBSACKAIyCwjyquj__8STPBAFOAE.
.yahoo.com/	1970-01-20 23:05:03	Name: A3 Value: d=AQABBIlc62QCEGFeoAuSYe0xL7D_HXGlIZ0FEgEBAQGu7GT1ZNxH0iMA_eMAAA&S=AQAAAj_pKhspx5V1kyjVoUP1VQk
.analytics.yahoo.com/	1970-01-20 23:04:42	Name: IDSYNC Value: 19bn~2dl2

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://w.po.st/share/script/post-widget.js#publisherKey=WindowsXlive Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security	error	URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308220101/pubads_impl.js(Line 9) Message: Mixed Content: The page at 'https://windowsxlive.saftawy.com/' was loaded over HTTPS, but requested an insecure script 'http://search.keywordblocks.com/cmedianet?cid=8CU2338X2&size=160x600&crid=610386075'. This request has been blocked; the content must be served over HTTPS.
network	error	URL: https://ps.eyeota.net/pixel?pid=mla6m40&t=gif Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://s0.2mdn.net/sadbundle/16124890883933717423/null Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

63a1ca1829b811d823ac5c0ba55fc669.safeframe.googlesyndication.com
9wgixs4lne8uceb5vwr9yffkq55wf1693146245.nuid.imrworldwide.com
a.postrelease.com
ade.googlesyndication.com
as-sec.casalemedia.com
b1sync.zemanta.com
bee.imrworldwide.com
c1.adform.net
cc.adingo.jp
cdn-gl.imrworldwide.com
cdn.ampproject.org
cdn.clinch.co
cdn.krxd.net
cdn.nsstatic.net
cdn.static.zdbb.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
cms.quantserve.com
cs.media.net
dsum-sec.casalemedia.com
dt.adsafeprotected.com
encrypted-tbn0.gstatic.com
encrypted-tbn1.gstatic.com
encrypted-tbn2.gstatic.com
encrypted-tbn3.gstatic.com
fastlane.rubiconproject.com
fksnk.com
fonts.googleapis.com
fonts.gstatic.com
g.pcmag.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gurgle.zdbb.net
ib.adnxs.com
image6.pubmatic.com
img-cdn.clinch.co
jadserve.postrelease.com
jogger.zdbb.net
match.360yield.com
match.adsrvr.org
match.sharethrough.com
native.sharethrough.com
ns.zdbb.net
pagead2.googlesyndication.com
pixel.adsafeprotected.com
pm.w55c.net
ps.eyeota.net
px.owneriq.net
realtime.clinch.co
resources.infolinks.com
router.infolinks.com
rtb.mfadsrvr.com
s0.2mdn.net
sb.scorecardresearch.com
search.keywordblocks.com
secure-us.imrworldwide.com
secure.gravatar.com
securepubads.g.doubleclick.net
ssbsync.smartadserver.com
stags.bluekai.com
static.adsafeprotected.com
stats.g.doubleclick.net
sync.1rx.io
sync.targeting.unrulymedia.com
sync.teads.tv
tags.bkrtx.com
tags.bluekai.com
tpc.googlesyndication.com
tr.blismedia.com
trace.mediago.io
trk.clinch.co
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
w.po.st
windowsxlive.net
windowsxlive.saftawy.com
windowsxslive.disqus.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
zdbb.net
ziffdavis-d.openx.net
ps.eyeota.net
search.keywordblocks.com
w.po.st
104.18.39.155
104.36.115.113
108.156.184.115
108.156.184.25
108.156.184.93
108.167.181.192
151.101.194.133
172.217.13.162
172.217.13.194
172.66.41.9
18.211.192.157
184.50.205.247
184.86.146.172
185.167.164.39
192.40.39.223
199.127.204.142
199.232.192.134
23.105.12.170
23.205.56.163
23.205.72.21
23.215.130.187
23.43.85.18
2600:1400:9000::172c:edbb
2600:1f13:800:7780:78aa:1966:9c24:9c12
2600:9000:24fd:a800:1d:667e:2a40:93a1
2600:9000:24fd:e00:12:6a04:c9c0:93a1
2600:9000:25f3:400:8:48e:53c0:93a1
2600:9000:25f4:5e00:5:393a:f0c0:93a1
2600:9000:25f5:8c00:2:42d9:3100:93a1
2602:803:c002:200::42
2607:f8b0:4004:c0b::9b
2607:f8b0:4006:80b::200e
2607:f8b0:4020:804::2002
2607:f8b0:4020:805::2002
2607:f8b0:4020:805::200a
2607:f8b0:4020:805::200e
2607:f8b0:4020:806::2001
2607:f8b0:4020:806::2002
2607:f8b0:4020:806::2003
2607:f8b0:4020:806::2008
2607:f8b0:4020:806::200e
2607:f8b0:4020:807::2001
2607:f8b0:4020:807::2003
2607:f8b0:4020:807::2004
2607:f8b0:4020:807::2006
2620:116:800b:21:c1e8:5385:5098:6bf0
2a04:fa87:fffe::c000:4902
3.160.5.103
3.212.40.172
3.225.218.10
34.197.182.56
34.227.123.3
34.230.226.68
34.96.105.8
34.98.64.218
35.207.24.140
35.208.249.213
35.236.220.17
35.71.131.137
44.196.176.11
52.204.12.229
54.159.93.151
54.209.208.39
54.237.107.196
54.81.223.21
54.85.16.190
64.74.236.191
68.67.160.26
72.247.64.74
00c7226270ee70dc934c77933c17e8bb18e425b207afcf2253fdf829297f703d
016d9a2e1ac4b7f5846d5d9443f34ec3f1809055bdbe9b10f2df20c4184a3305
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
0210bcf8c6f9fb41e1db722e8ec3c318101342f5922c59331321c993df1720d1
03abb79e0dbe50a1e23e9eca45094fefb296018f5ae85daa2e7cbe2c8099cedb
046056e1f1697fc205d4938137b935a6f05f378791015844d7adf1425cf21430
04edfc43275a6b7925baad8d7a3a9ac4c224becba9d8751b3d4da764044e3e42
066a4661d164d1a0645374fb01884042ca4a3b694a3caeb22ca5924ddf34ef86
067115f5883c4d1dc3fed1a8a58b10113d71abfe7284c74750b04e3a3a0718f6
082391138121f44ec371af96e69a4c404650bf73649eb38da1616a8c6245cc83
09309ddb733a7c98fba0d2d5a245e3eea11f6eedae44ca55f08027659a614d14
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ff4fe886c21f09a3ba144b93e3eb818a5152eaac69c25fce50a31677078c533
117ed873640b992e38f34a0a761dd3e1cda6b3c24c9507bb3adc0323039f8ff1
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2
1510fc6ba5664447376b7b5f15cb988571edd425abf91a0784bd17bf4e52ce86
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
17945a4908b1b8a69172a6babc6fc3787422e230253b5fd44b0edcc414505e2d
1852b86f96afa96e95103ee031a4fac938f321680f04f2090b6306cebed3b548
19dcd5c7ba1ff7d65ade52ad1079bd7db75a7832c2412f72df3c2ed2eda2e0ab
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1df629c9e3d7999c38bfa18b45032197fd4da30e8e893bf07f5083e1fa9b4390
1fb34e7eb4868771d4507dcb23bbc90a807676ff3c459cbb7ed1ba6a8ca28d1f
22a85f78f1f3eef33148c79b6dc94b7814ea93700d2f2d15e7d2184c8a874d48
241abad45d15b92f8025df49bace41958d8afb8cc5e1ea9ab29c6c2004c1939c
273c8613cdd2852dd5318f224d804ae6d2fc717c48d3f1dab587b6d396fb4fc8
30c115ca04d30ca0b431acb2849d869c2c43f64ebba1c2daca82c4da7d6b4510
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31c8024e36419f969589a6b1600a32ba2533ddc8827016158f16fac75897fbb7
31f8dd4c33c94b6ed7e64f46dd076e4f39cbd149a405b8dacd29b6c1ba7cd8e4
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3fdd9957f328674a49573806215c9fe67a6f827515607cf8d7db980fc94b771c
407a33790358a92d990b76a909e66f70f982af2bd2925c8ef7ebce72d62fc155
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
485567ada85d2d82f3c23210e6082009fcd03700751bf61a07a56a256b1e8918
4a88c983cfdc75cee9ae18b2b8bf8defbe9561eba9c98210f375fb5ee50fffa4
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e1a9b64ef61d81d14debbd19b42547879aa635d37a69e03807a85a82d44c20b
4e523a5ae5b4636c75901b79fafbd3912e41dc7987414e688b09d4b436ff22b3
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
4f30bdeed794aeb92d85e55d901c0bdb634df32432010792e3b569ea73cae443
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
505c4254d85d5e030b01f0b8a6a723fa4e3e11ed935fe15de6df4ee835cafbaa
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56df36601375d7b06986029e0e37cbbb2725c31168147ca6a4790be88c0d37fb
5ae09d5c8ae94ac9ffe86174666a8d2b43e24281d1ac3ab2025e5ade31a7c793
5c2d662e92bcbf1a5970b97040f901031295e79a96314db8302f549003022087
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
5e3e377390273cdcadaaa15956be20643d89765dfe7b62c363e9442a68bd4271
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
5fa7e3cdf66d3191e10c92b08d49b749357c43031cfc90e01345d0e4d71133a9
610b306b09d3bf72d6f223228530fd45a7a8519fe94ce478d27046ed687bda3d
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
65acd116fab8d8d54d31dad36101083b89a6ac3871f37fd99dc702cf8b4a5b6f
65b978e80fdf031da25da84fd0f3e56d5d3282a2c3c07d1436e8cf1bfce4c449
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d4083520c18bfdcdffb319248525ebf8f1a547326e10c02e6a0ed0b1722ae9a
6d49b77aafce0365a34a91dd855d678f5beb1e1c1f4e9cf142c9c9a4421a51da
6da6b8a9d8949e69f28ce7440ed762ef13ce09b2dc2ba5914eac2b77307ec9df
700d989c1b35e57320c279cff1f2b11dd2b54518bd3992d0bf18640550d884d0
767a456e2a3d977102a5a4224d43f77ca39d3e196d21ba98e3849eb5061d1e5c
77f5a108d4e15bf7e5a3dd1dcd877cab841f84f8424626c6ce33ff97a36b7a4d
790fb5cd8aa82cc66e398d7034ee249a1ff0844d7f8967c08e72c925d2475127
7e8e0dd52fdad574552c3e7f492becb949de12a2936ddae55844807b3e80e90d
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8165d8e2771d30c1a2baf2e6ebb58ce49c3b9dc575676b6f1aa7afeb2e5efe86
81cf98ae1e014cf370b20aaef0cb64590cf7991f34c35a04703917a945e51f65
8235338c85d9a067c5cd68932d0254970b2eef016c95e52c585950b74a91f428
8265df6f17eaef70b04915e4f6c759172d87c9e495d93ebc421d0717d83a1d16
82c739bf372e6d8f0df0b257208d5d9c119172b65d768eaf0faf4d481e23c47b
865b01752fdbd28411769343be9b09b8d7626efb9f81dc4efbe0be082e8d2a2c
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
93008445041e12a2220d0dcf7f0955cc4b23964b196d504f01627fa8e44c94f0
93be5534e8e441b4f97f735ce3f72e6567660d1768eaebc07a13e38804e51c3b
9608d5785c54026a0793d2acc25210e74ba4bea031b4ed68b429c2880d311be4
96cba0d12c5459510c043c454746be86a91aa00bc0567428e1904e99aaf72864
978135170529b02153aadd1f34e89413e4d36b0c9e1fe3a4fa9c23dbfd6525da
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9f86214c6d960ceee948f990ed88ed18a231f8c72b449dec142036e6910a2575
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a68a7aaf623132b6e47f6d9753c49336cc812251cc91a1b82280aca86144b29a
a69c12ccd186a899db79fce802b46c08e71f69c2c422be2666ed8565e3add026
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
ad5b30a375e95ccde57c84c338686771c5e0dd575d7f75f040ef111524f0054e
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
b0cbbfe7e06fd7a9274bcdf96bde690f294cdef1ba01f2f20c9a9bd09eb1502b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1fe6456a4e2d8871862a70a1d1ad7dee8887643ee994ad850ee0a30072cfbd2
b265476177e3ab0431283434dc52fb94854b6763cf84b236fb858de18c3757ad
b539aa567737502e514c07c10b6aac24bf529773c73242e1dcd73d195b0d9148
b70f0a80bac892e1e492a9ee5cee527ea2a9a2ff162614ff7a3acc78b2e83db0
b7d11c07f9cfce0d8b6e409e045a32b0cb35c252351793e8923d92ac299a3edc
bad66a0d8415b5c7060c7bee51dd8d81972fb48c520142af34eff6c721b95516
be7df9413f1250349464bbfde8a9c6de99868c84a13772ceef3e7526125b0e33
c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1
c3c15124d07031d5c46efa225e58e4a29c8772f120464c52be5652a24dbc2764
c4f393315ffc75417c9c350e709bbcca2d2e9d5640fa0925b32088ff1ed6c84f
c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc
c6d56f8cdef052a7d17726f28428d67ba5fc76cd473b8b3198c7ae4bca139122
c9b840d6615c475d0852e462df613b941d822540a56510881b5edae1b5bb97f4
c9e25231a4b17a1057bcb96e3289b66e21755d8467c301617240b068b6ca7b51
ca0b13088e4cc740b37d30f2a5dd83dba46709641f40678950fc0a8f41c9c14c
ca4342c70b92db9a83a50027c679aba826a512977181599ea7df321068f28ff7
cba4ae1feed7df2f34d79e855a1a8236d9ad9c174fcc5eb629c4ebed41ee7cb7
cca4f37b4a4385ecdf4190c9f2be8e2ded15b5ed018bc04d4f63dd42c2eaf2fc
cd560776866989d49ed110649053e185fe1917d62b8636ed13ac8ac81304fdb9
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cefa9e1381efad505b91c2bcb55b5b85c4d5b7b1007cec40117477f5b8d15c15
cf442222f0ea6f2b4cc735cef3a9548366ad6dbed5805af0d427b4db1fef9ef8
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d03a659e72c02fe9b403fb3df9d0921880bec3cb4aa433bf29a40e082cc6fe38
d30e077a8698103cabdcca696708b05c9806d9620e424fc9562395404b86e2e5
d957204c168f813d6801b41dfb5aab96c2bd93cd246ffec3d8e46b68fb555ec6
d95a95fa9822e4c25fa0225fab775b0ab9d37ba90bc9a4fa1b9f3986fb7e8720
d9ecacf0e4adcba3a7b7dfa57becbc921434053158e57401578818ab40bab332
dd5493d72c92e81a1e612241012ccb48a8e2d285af3d3319cb55528b313340ca
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e15f917b9b117ebc51b92dc361965c9d72897798571430d8f0ee775bbb373a1e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64ed909680284310d43b2c1e481c46cdd194084f1df8a605ab46183771add7e
e714852f3b82bb509bcee07036e4663506b0d7389d9f02cbb2b0cc7523b8e094
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc2b5f3cfb42ac86c11900be6091d645853af46ab4f01bfba7280c3ac37ae02
f24d352fc8e0fbbfd349ef49e86d9317834abb3494be70b4513660803ff66c67
f6072019ba53a652c426b2621fb6e94a4cbc3fba6f5c0a7106a1960156e2e83f
fac391178b8132bb5fb1b8e7096b26add5f1bb2fbb73a3a14c145e0b746fe34b
fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1
fd0a9db3fc70f81152fd134ec8cd6e91b9074759d33232e3d301fd40cb3b2b96

windowsxlive.saftawy.com Open in urlscan Pro 108.167.181.192 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

243 Requests

83 %HTTPS

36 %IPv6

55 Domains

86 Subdomains

53 IPs

5 Countries

3070 kBTransfer

8007 kBSize

90 Cookies

75 Outgoing links

Redirected requests

243 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

windowsxlive.saftawy.com Open in urlscan Pro
108.167.181.192 Public Scan

Screenshot
Live screenshot

Full Image

243
Requests

83 %
HTTPS

36 %
IPv6

55
Domains

86
Subdomains

53
IPs

5
Countries

3070 kB
Transfer

8007 kB
Size

90
Cookies

243 HTTP transactions
8 data transactions