heroesoffreedom.0wn0.com Open in urlscan Pro
94.23.159.185  Public Scan

5 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

• https://www.google-analytics.com/r/collect?v=1&_v=j79&a=471339711&t=pageview&_s=1&dl=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ul=en-us&de=UTF-8&dt=Free%20forum%20%3A%20Heroes%20of%20Freedom&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=1623718900&gjid=2115857413&cid=1261789457.1575183575&tid=UA-144347007-1&_gid=146033526.1575183575&_r=1&gtm=2ouav9&z=557972000 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_gid=146033526.1575183575&gjid=2115857413&_v=j79&z=557972000 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_v=j79&z=557972000 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_v=j79&z=557972000&slf_rd=1&random=782225492

Request Chain 55

• http://hal900038.redintelligence.net/request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D6428345879797049815%26mt_id%3D6622478%26mt_adid%3D216536%26mt_sid%3D4562355%26mt_exid%3D9%26mt_inapp%3D0%26mt_uuid%3D49eb5de3-64d7-4701-b0aa-5c17d9becf4b%26mt_3pck%3Dhttp%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F%26redirect%3D&documentReferer=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ancestorOrigins=http%3A%2F%2Fheroesoffreedom.0wn0.com&random=1645556444577&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
• http://hal900038.redintelligence.net/request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D6428345879797049815%26mt_id%3D6622478%26mt_adid%3D216536%26mt_sid%3D4562355%26mt_exid%3D9%26mt_inapp%3D0%26mt_uuid%3D49eb5de3-64d7-4701-b0aa-5c17d9becf4b%26mt_3pck%3Dhttp%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F%26redirect%3D&documentReferer=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ancestorOrigins=http%3A%2F%2Fheroesoffreedom.0wn0.com&random=1645556444577&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 68

• https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062 HTTP 302
• https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ658Yvwk-YCFcj3dwodc-8J6g;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062

Request Chain 77

• http://b.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1575183576100&ns_c=UTF-8&cv=3.1e&c8=Free%20forum%20%3A%20Heroes%20of%20Freedom&c7=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&c9= HTTP 302
• http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1575183576100&ns_c=UTF-8&cv=3.1e&c8=Free%20forum%20%3A%20Heroes%20of%20Freedom&c7=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&c9=

Request Chain 78

• http://api.viglink.com/api/sync.js?key=0d80ae9fe71cec9484f682bd59232f9e HTTP 302
• http://get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/tag.min.js

Request Chain 79

• http://api.viglink.com/api/sync.gif?key=0d80ae9fe71cec9484f682bd59232f9e HTTP 302
• http://ce.lijit.com/merge?pid=8008&3pid=aee64d20642d27bd2f7fb480df1d0099 HTTP 302
• http://ce.lijit.com/merge?pid=8008&3pid=aee64d20642d27bd2f7fb480df1d0099&dnr=1

89 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response heroesoffreedom.0wn0.com/	51 KB 11 KB	165ms 125ms	Document text/html	94.23.159.185 OVH
General Check archive.org Show headers Download Go to Full URL http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 94.23.159.185 London, United Kingdom, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash efd70dbe20da69fb3318d9050c53d9a1a012abf90c2345407753d1c6545f23f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1 Request headers Host heroesoffreedom.0wn0.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Cache-Control no-cache, no-store Pragma no-cache Expires Sun, 01 Dec 2019 00:00:00 GMT Last-Modified Sun, 01 Dec 2019 06:59:35 GMT Vary User-Agent Set-Cookie exadd=157519; expires=Sun, 01-Dec-2019 10:59:35 GMT; Max-Age=14400 X-Content-Type-Options nosniff X-XSS-Protection 1 Access-Control-Allow-Origin * Content-Encoding gzip
GET H/1.1	200 OK	0-ltr.css heroesoffreedom.0wn0.com/	161 KB 58 KB	218ms 217ms	Stylesheet text/css	94.23.159.185 OVH
General Check archive.org Show headers Download Go to Full URL http://heroesoffreedom.0wn0.com/0-ltr.css Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 94.23.159.185 London, United Kingdom, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash c67c843a837c480d1b0052014139327db35308d1f133b8da43c74f86ecf6ee4c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Sun, 01 Dec 2019 00:00:00 GMT Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=315360000 Content-Length 58783 X-XSS-Protection 1 X-Cache-MA MISS Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.7.2/	93 KB 33 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:806::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 20 Nov 2019 11:27:22 GMT content-encoding gzip x-content-type-options nosniff age 934333 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 33845 x-xss-protection 0 last-modified Tue, 20 Dec 2016 18:17:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 19 Nov 2020 11:27:22 GMT
GET H2	200	en.js Show response illiweb.com/rs3/56/frm/lang/	69 KB 16 KB	38ms 18ms	Script application/x-javascript	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://illiweb.com/rs3/56/frm/lang/en.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 162f8a6d61544a0ab207c5614393b66bc21ddb2bfeabfc2c8f1479e21b7f5495 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 1962952 cf-polished origSize=70993 status 200 cf-bgj minify x-xss-protection 1; mode=block x-cache-ne EXPIRED last-modified Tue, 29 Oct 2019 14:00:04 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 x-cache-pr EXPIRED cf-ray 53e32de06dc5bec4-FRA expires Sat, 07 Nov 2020 13:43:43 GMT
GET H2	200	publishertag.js Show response static.criteo.net/js/ld/	87 KB 27 KB	58ms 28ms	Script text/javascript	178.250.0.130 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://static.criteo.net/js/ld/publishertag.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash 40483fac4e86b90f4d46c4b9ab5b5a25662849de0c9789e571abc23ef1217a6e Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip last-modified Fri, 25 Oct 2019 13:44:17 GMT server nginx access-control-allow-origin * etag W/"5db2fc31-15cda" content-type text/javascript status 200 cache-control max-age=86400, public timing-allow-origin * expires Mon, 02 Dec 2019 06:59:35 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	73 KB 27 KB	16ms 15ms	Script application/javascript	2a00:1450:4001:81b::2008 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-144347007-1 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 12c83d971954c06b2720ed16b8f62abc8f3627c6a991547ac4b32b6786a12a17 Security Headers Name Value X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding br last-modified Sun, 01 Dec 2019 06:00:00 GMT server Google Tag Manager access-control-allow-origin http://www.googletagmanager.com vary Accept-Encoding content-type application/javascript; charset=UTF-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control content-length 27666 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	jquery.cookie.js Show response illiweb.com/rs3/56/frm/jquery/cookie/	1011 B 876 B	31ms 12ms	Script application/x-javascript	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://illiweb.com/rs3/56/frm/jquery/cookie/jquery.cookie.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 6cf7880d67c712bb6f85f1dfa1d26ea5e0a7195130a3e42c8b441cdd1de77a90 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 1962961 status 200 last-modified Tue, 27 Aug 2019 14:00:14 GMT x-xss-protection 1; mode=block x-cache-ne HIT cf-bgj minify server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31536000 x-cache-pr HIT cf-ray 53e32de06dc6bec4-FRA expires Sat, 07 Nov 2020 13:43:34 GMT
GET H2	200	api.js Show response www.google.com/recaptcha/	729 B 562 B	18ms 18ms	Script text/javascript	2a00:1450:4001:818::2004 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software GSE / Resource Hash 3211cd82ce26fec042b2543617d3138a366d470fa74ed56788c3b0956c9f9ffb Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 status 200 cache-control private, max-age=300 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 463 x-xss-protection 1; mode=block expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	site_logo.gif illiweb.com/fa/prosilver_red/	3 KB 3 KB	32ms 13ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/site_logo.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 02b9085e77a1a1e15b70404e9c9c15a9868c809f32badd8b5cc108e532881c55 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 7519033 status 200 content-length 3430 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-d66" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de06dc7bec4-FRA expires Fri, 04 Sep 2020 06:22:22 GMT
GET H2	200	icon_home.gif illiweb.com/fa/prosilver_red/	306 B 415 B	32ms 13ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/icon_home.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 81ecdaa377868c079f2c32dbb4f0f15007cea9b4fc00726d4f97d1de3b0f0095 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 11146480 status 200 content-length 306 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-132" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de06dcabec4-FRA expires Fri, 24 Jul 2020 06:44:55 GMT
GET H2	200	icon_search.gif illiweb.com/fa/prosilver_red/	334 B 412 B	10ms 10ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/icon_search.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 865b82b8f6e73ed114c2ca2850d7adff1d7b8c02756ac444194d53b3a6edad98 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 11146480 status 200 content-length 334 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-14e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de07ddebec4-FRA expires Fri, 24 Jul 2020 06:44:55 GMT
GET H2	200	empty.gif illiweb.com/fa/	42 B 147 B	9ms 9ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/empty.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 2763380 status 200 content-length 42 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-2a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de07ddfbec4-FRA expires Thu, 29 Oct 2020 07:23:15 GMT
GET H2	200	icon_register.gif illiweb.com/fa/prosilver_red/	228 B 357 B	15ms 15ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/icon_register.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash bcb8f7377a7f5e8909d0a1b54269e688609e3072e39b99e201a0eee9ff0ce2c7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 2763302 status 200 content-length 228 x-xss-protection 1; mode=block last-modified Mon, 16 May 2016 11:00:44 GMT server cloudflare etag "5739a85c-e4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de08df6bec4-FRA expires Thu, 29 Oct 2020 07:24:33 GMT
GET H2	200	icon_logout.gif illiweb.com/fa/prosilver_red/	219 B 326 B	11ms 11ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/icon_logout.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 25bee2375dd8b1ec1202ddfdf1b5771c8e597895ca1fa6fdc1a61b9533d3472a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 11936272 status 200 content-length 219 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-db" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de08df7bec4-FRA expires Wed, 15 Jul 2020 03:21:43 GMT
GET H2	200	forum_unread.gif illiweb.com/fa/prosilver/	667 B 799 B	10ms 10ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver/forum_unread.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5667e6ad4f9e971ffb36cb12d532bb4d20a70b6d753868170d2a4f764492fa48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 2677764 status 200 content-length 667 x-xss-protection 1; mode=block last-modified Mon, 16 May 2016 11:00:36 GMT server cloudflare etag "5739a854-29b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de0ae05bec4-FRA expires Fri, 30 Oct 2020 07:10:11 GMT
GET H2	200	forum_read.gif illiweb.com/fa/prosilver_red/	662 B 771 B	11ms 11ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/forum_read.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash a209eaf8369d27d2c9913c1d3db99dc1d7138dcf6c40d3f114d37927077fb12e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 24457608 status 200 content-length 662 x-xss-protection 1; mode=block last-modified Mon, 16 May 2016 11:00:44 GMT server cloudflare etag "5739a85c-296" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de0ae0bbec4-FRA expires Fri, 21 Feb 2020 05:12:47 GMT
GET H2	200	forum_read_locked.gif illiweb.com/fa/prosilver_red/	681 B 792 B	10ms 9ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/forum_read_locked.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 744d3be1c3bb363fe6f2927bee941648336b008a39258cd6b7e43b2f108b048a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 2848764 status 200 content-length 681 x-xss-protection 1; mode=block last-modified Mon, 16 May 2016 11:00:44 GMT server cloudflare etag "5739a85c-2a9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de0be10bec4-FRA expires Wed, 28 Oct 2020 07:40:11 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:81b::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-144347007-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Aug 2019 17:22:41 GMT server Golfe2 age 1558 date Sun, 01 Dec 2019 06:33:37 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 17803 expires Sun, 01 Dec 2019 08:33:37 GMT
GET H/1.1	200 OK	loader.js Show response cdn.taboola.com/libtrc/forumotion-en-2/	80 KB 19 KB	429ms 328ms	Script application/javascript	151.101.246.2 Fastly
General Check archive.org Show headers Download Go to Full URL http://cdn.taboola.com/libtrc/forumotion-en-2/loader.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 151.101.246.2 Helsinki, Finland, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software AmazonS3 / Resource Hash e5db34a2021ad12f8b54b09f744c4a2a75341c694075e8fb0e1644e200373222 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id htN39sySXqdc7ba6i4ycsCEs_sDs3T7u Content-Encoding gzip Age 0 X-Cache HIT Date Sun, 01 Dec 2019 06:59:35 GMT Connection keep-alive Content-Length 18720 x-amz-id-2 nFVBo0FdWdRs0bTPWREo2glMTlzOiJ56JFN5C83fHtXGvud4frZyYSX+reYYcppiw/0O2XdjPB4= X-Served-By cache-hel6825-HEL Last-Modified Sat, 30 Nov 2019 16:20:29 GMT Server AmazonS3 X-Timer S1575183576.539888,VS0,VE228 ETag "f8ec8919560e0b654fee29a312389ebd" Vary Accept-Encoding x-amz-request-id D9E7505FDAA0CB66 Via 1.1 varnish Cache-Control private,max-age=14401 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8 abp 55 X-Cache-Hits 1
POST H2	204	cdb Show response bidder.criteo.com/	0 153 B	47ms 16ms	XHR text/plain	178.250.0.165 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Full URL https://bidder.criteo.com/cdb?ptv=76&profileId=206&cb=80354215153 Requested by Host: static.criteo.net URL: https://static.criteo.net/js/ld/publishertag.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software Finatra / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers status 204 date Sun, 01 Dec 2019 06:59:34 GMT access-control-allow-credentials true server Finatra access-control-allow-origin http://heroesoffreedom.0wn0.com timing-allow-origin * vary Origin
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/	254 KB 91 KB	5ms 5ms	Script text/javascript	2a00:1450:4001:818::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/75nbHAdFrusJCwoMVGTXoHoM/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 3b6f51d30b4b20b9e7b3da75b5c14a51ce39ec203b9fa37e043f097272d5540e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 21 Nov 2019 04:26:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 11 Nov 2019 05:06:47 GMT server sffe age 873180 vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 92852 x-xss-protection 0 expires Fri, 20 Nov 2020 04:26:35 GMT
GET H2	200	corners_left.gif illiweb.com/fa/prosilver/	55 B 205 B	10ms 10ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver/corners_left.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e3c89e05bf4302b8521538f38f4117d88f59e34a3251b9daa330a1ac1bbfe23b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/0-ltr.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 17210258 status 200 content-length 55 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-37" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de20f36bec4-FRA expires Fri, 15 May 2020 02:21:57 GMT
GET H2	200	pixel.gif static.criteo.net/images/	43 B 260 B	14ms 14ms	Image image/gif	178.250.0.130 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Show image Full URL https://static.criteo.net/images/pixel.gif?ch=1 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT last-modified Tue, 09 Dec 2008 16:52:36 GMT server nginx access-control-allow-origin * etag "493ea254-2b" content-type image/gif status 200 cache-control max-age=31104000, public accept-ranges bytes timing-allow-origin * content-length 43 expires Wed, 25 Nov 2020 06:59:35 GMT
GET H2	200	pixel.gif static.criteo.net/images/	43 B 260 B	15ms 15ms	Image image/gif	178.250.0.130 ASN-CRITEO-EUROPE
General Check archive.org Show headers Download Go to Show image Full URL https://static.criteo.net/images/pixel.gif?ch=2 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR), Reverse DNS Software nginx / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT last-modified Tue, 09 Dec 2008 16:52:36 GMT server nginx access-control-allow-origin * etag "493ea254-2b" content-type image/gif status 200 cache-control max-age=31104000, public accept-ranges bytes timing-allow-origin * content-length 43 expires Wed, 25 Nov 2020 06:59:35 GMT
GET H2	200	bg_list.gif illiweb.com/fa/prosilver_red/	656 B 917 B	10ms 9ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/bg_list.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 682bfef93308871ae65d3767f1d750aaf58c82556d6a7efa6f10bcf9e40f9ce2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/0-ltr.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 2763332 status 200 content-length 656 x-xss-protection 1; mode=block last-modified Sat, 01 Jan 2005 00:00:00 GMT server cloudflare etag "41d5e800-290" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de21f46bec4-FRA expires Thu, 29 Oct 2020 07:24:03 GMT
GET H/1.1	404 Not Found	gray2410.jpg werefree.forumotion.com/users/a4/29/97/30/album/	0 0	95ms 59ms	Image text/html	188.165.2.137 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://werefree.forumotion.com/users/a4/29/97/30/album/gray2410.jpg Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 188.165.2.137 , Ireland, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://heroesoffreedom.0wn0.com/0-ltr.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin *
GET H2	200	forum_read_category.gif illiweb.com/fa/prosilver_red/	725 B 843 B	10ms 9ms	Image image/gif	2606:4700:e2::ac40:8a18 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://illiweb.com/fa/prosilver_red/forum_read_category.gif Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:8a18 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 04076a728975fd2932b7b2539681c30a953e30a27efbfbd8fc727645860464c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff cf-cache-status HIT age 24387268 status 200 content-length 725 x-xss-protection 1; mode=block last-modified Mon, 16 May 2016 11:00:44 GMT server cloudflare etag "5739a85c-2d5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes cf-ray 53e32de21f47bec4-FRA expires Sat, 22 Feb 2020 00:45:07 GMT
GET H/1.1	200 OK	vglnk.js Show response cdn.viglink.com/api/	78 KB 28 KB	37ms 24ms	Script text/javascript	2606:4700::6810:a40d Cloudflare
General Check archive.org Show headers Download Go to Full URL http://cdn.viglink.com/api/vglnk.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip CF-Cache-Status HIT Age 1075543 Content-Type text/javascript Connection keep-alive Content-Length 27746 x-amz-id-2 BvWrCx4ENVEyTFkdGWO8b32fWif/t7+zUKoO3CKE7/ujB7loTjoMGO95lPtYYPtLNI1PNB7+82U= Last-Modified Mon, 21 Oct 2019 20:13:23 GMT Server cloudflare ETag "df893ab92782cedac4da4785df9ec68e" Vary Accept-Encoding x-amz-request-id 0FCA203CD776EAD5 Cache-Control public, max-age=1800 Accept-Ranges bytes CF-RAY 53e32de24a7259d6-VIE Expires Sun, 01 Dec 2019 07:29:35 GMT
GET H2	200	css fonts.googleapis.com/	3 KB 926 B	39ms 18ms	Font text/css	2a00:1450:4001:820::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto+Condensed Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 2b7caf43d9c84f7b05243a68e7bc41555f0b873a115a1e1c691f86bed97dd4d9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 01 Dec 2019 06:59:35 GMT server ESF access-control-allow-origin * date Sun, 01 Dec 2019 06:59:35 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	connect.js Show response connect.topicit.net/scripts/	3 KB 2 KB	78ms 17ms	Script application/javascript	2606:4700:30::6812:3ee8 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://connect.topicit.net/scripts/connect.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::6812:3ee8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 39ce845fc0203d4cb00559dff89d9448765e0ebd65ebbaf76623cc9850827542 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 1752 cf-polished origSize=5437 status 200 vary Accept-Encoding x-xss-protection 1; mode=block last-modified Tue, 27 Aug 2019 14:04:48 GMT server cloudflare etag W/"5d653880-153d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript access-control-allow-origin * cache-control max-age=86400 cf-ray 53e32de2abb8cbc8-VIE cf-bgj minify
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j79&a=471339711&t=pageview&_s=1&dl=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ul=en-us&de=UTF-8&dt=Free%20forum%20%3A%20Heroes%20of%20Freedom&sd=24-b... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_gid=146033526.1575183575&gjid=2115857413&_v=j79&z=557972000 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_v=j79&z=557972000 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_v=j79&z=557972000&slf_rd=1&random=782225492	42 B 109 B	17ms 17ms	Image image/gif	2a00:1450:4001:806::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_v=j79&z=557972000&slf_rd=1&random=782225492 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff server cafe timing-allow-origin * location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-144347007-1&cid=1261789457.1575183575&jid=1623718900&_v=j79&z=557972000&slf_rd=1&random=782225492 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 cache-control no-cache, no-store, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	11662.js Show response ads.rubiconproject.com/ad/ Frame F235	26 KB 8 KB	22ms 6ms	Script text/javascript	23.37.55.184 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ads.rubiconproject.com/ad/11662.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache / PHP/5.3.3 Resource Hash d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/5.3.3 Vary Accept-Encoding Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=7178 Access-Control-Allow-Credentials true Connection keep-alive Content-Length 7558 Expires Sun, 01 Dec 2019 08:59:13 GMT
GET H/1.1	200 OK	11662.js Show response ads.rubiconproject.com/ad/ Frame 0EA9	26 KB 8 KB	19ms 6ms	Script text/javascript	23.37.55.184 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ads.rubiconproject.com/ad/11662.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache / PHP/5.3.3 Resource Hash d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/5.3.3 Vary Accept-Encoding Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=7178 Access-Control-Allow-Credentials true Connection keep-alive Content-Length 7558 Expires Sun, 01 Dec 2019 08:59:13 GMT
GET H/1.1	200 OK	11662.js Show response ads.rubiconproject.com/ad/ Frame 8389	26 KB 8 KB	19ms 6ms	Script text/javascript	23.37.55.184 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://ads.rubiconproject.com/ad/11662.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache / PHP/5.3.3 Resource Hash d02197080b9680999381b5f5337fedd92674e5a1550ddfcc0c70612d3170a5e3 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/5.3.3 Vary Accept-Encoding Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=7178 Access-Control-Allow-Credentials true Connection keep-alive Content-Length 7558 Expires Sun, 01 Dec 2019 08:59:13 GMT
GET H/1.1	200 OK	pixel.gif cdn.viglink.com/images/	43 B 552 B	33ms 20ms	Image image/gif	2606:4700::6810:a40d Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://cdn.viglink.com/images/pixel.gif?ch=1&rn=5.133232004139005 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT CF-Cache-Status HIT Last-Modified Tue, 10 Feb 2015 03:29:39 GMT Server cloudflare Age 12 ETag "221d8352905f2c38b3cb2bd191d630b0" Vary Accept-Encoding Content-Type image/gif Cache-Control max-age=15, must-revalidate x-amz-request-id 57E6BAED6C2D109D Connection keep-alive Accept-Ranges bytes CF-RAY 53e32de29e70cbc0-VIE Content-Length 43 x-amz-id-2 gjzSTlpeWf2SYVeO+QgsIT+IpjXYFCYxHaURvfE+RBa98j5jOFCiYXtCG6/dm0lgcat3G+usK2s=
GET H/1.1	200 OK	pixel.gif cdn.viglink.com/images/	43 B 552 B	33ms 21ms	Image image/gif	2606:4700::6810:a40d Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://cdn.viglink.com/images/pixel.gif?ch=2&rn=5.133232004139005 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 2606:4700::6810:a40d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT CF-Cache-Status HIT Last-Modified Tue, 10 Feb 2015 03:29:39 GMT Server cloudflare Age 12 ETag "221d8352905f2c38b3cb2bd191d630b0" Vary Accept-Encoding Content-Type image/gif Cache-Control max-age=15, must-revalidate x-amz-request-id 57E6BAED6C2D109D Connection keep-alive Accept-Ranges bytes CF-RAY 53e32de29e0acba0-VIE Content-Length 43 x-amz-id-2 gjzSTlpeWf2SYVeO+QgsIT+IpjXYFCYxHaURvfE+RBa98j5jOFCiYXtCG6/dm0lgcat3G+usK2s=
GET H/1.1	200 OK	151376-2.js Show response optimized-by.rubiconproject.com/a/11662/36514/ Frame F235	3 KB 3 KB	50ms 43ms	Script text/javascript	69.173.144.140 The Rubicon Project
General Check archive.org Show headers Download Go to Full URL http://optimized-by.rubiconproject.com/a/11662/36514/151376-2.js?&cb=0.43518339114708326&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=36514_2 Requested by Host: ads.rubiconproject.com URL: https://ads.rubiconproject.com/ad/11662.js Protocol HTTP/1.1 Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software RAS 2.4 / Resource Hash b0c8fa00a5a8753a4a95951cdfa6d83c741595c10982d37b6764337022aa7752 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Cache-Control no-cache, no-store, max-age=0, must-revalidate Connection Keep-Alive Content-Type text/javascript Keep-Alive timeout=5, max=115 Content-Length 1980 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	151378-15.js Show response optimized-by.rubiconproject.com/a/11662/36514/ Frame 0EA9	2 KB 2 KB	46ms 41ms	Script text/javascript	69.173.144.140 The Rubicon Project
General Check archive.org Show headers Download Go to Full URL http://optimized-by.rubiconproject.com/a/11662/36514/151378-15.js?&cb=0.790620702418414&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=36514_15 Requested by Host: ads.rubiconproject.com URL: https://ads.rubiconproject.com/ad/11662.js Protocol HTTP/1.1 Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software RAS 2.4 / Resource Hash 927e0fb0cd3bcd8a6da6117aa026a28171985399559cb2684083c1eaf9a73d5e Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Cache-Control no-cache, no-store, max-age=0, must-revalidate Connection Keep-Alive Content-Type text/javascript Keep-Alive timeout=5, max=88 Content-Length 930 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H/1.1	200 OK	151378-15.js Show response optimized-by.rubiconproject.com/a/11662/36514/ Frame 8389	2 KB 2 KB	36ms 31ms	Script text/javascript	69.173.144.140 The Rubicon Project
General Check archive.org Show headers Download Go to Full URL http://optimized-by.rubiconproject.com/a/11662/36514/151378-15.js?&cb=0.4445806265490406&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=36514_15 Requested by Host: ads.rubiconproject.com URL: https://ads.rubiconproject.com/ad/11662.js Protocol HTTP/1.1 Server 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software RAS 2.4 / Resource Hash f83000a6deb1373548ae6ddd82743c5d91e5b2e930de5b40a7eae06a9d1387c6 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server RAS 2.4 Vary Accept-Encoding P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Cache-Control no-cache, no-store, max-age=0, must-revalidate Connection Keep-Alive Content-Type text/javascript Keep-Alive timeout=5, max=173 Content-Length 933 Expires Wed, 17 Sep 1975 21:32:10 GMT
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/ Frame 8389	51 KB 15 KB	14ms 13ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: optimized-by.rubiconproject.com URL: http://optimized-by.rubiconproject.com/a/11662/36514/151378-15.js?&cb=0.4445806265490406&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=36514_15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash f39f343e54ceca709e31ef90afc42e5388bd34a8693ab98d15d65f7b1575d079 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "353 / 555 of 1000 / last-modified: 1574960877" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 15686 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H/1.1	200 OK	dadc7346-bfc5-425d-944c-eaeb6b38a545 beacon-eu2.rubiconproject.com/beacon/d/ Frame 8389	43 B 268 B	18ms 6ms	Image image/webp	69.173.144.153 The Rubicon Project
General Check archive.org Show headers Download Go to Show image Full URL http://beacon-eu2.rubiconproject.com/beacon/d/dadc7346-bfc5-425d-944c-eaeb6b38a545?oo=0&accountId=11662&siteId=36514&zoneId=151378&sizeId=15&e=6A1E40E384DA563B924D7E85A9A3A28A04B3C9012743B394B876CFED029F0A3025AD3F8049D1C374E0974857B9CC9325E4A9AFA6E089EF848E37AFBB025205B8F44C10B8F90491F08B765CD22D582F4FAC237D6FA0EBFC9A6240B348FC26EBCFB21DC93AEE450B7F8DD96D738C420CBD7831E5EA1B77C18BD82D574BB593C59832997889F1DA11D8 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 69.173.144.153 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software Rubicon Project / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:34 GMT Cache-Control private, max-age=0, no-cache Expires 01 Jan 1970 10:00:00 GMT Server Rubicon Project Content-Length 43 Content-Type image/webp
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/ Frame 0EA9	51 KB 15 KB	14ms 13ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: optimized-by.rubiconproject.com URL: http://optimized-by.rubiconproject.com/a/11662/36514/151378-15.js?&cb=0.790620702418414&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=btf&p_screen_res=1600x1200&ad_slot=36514_15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash f39f343e54ceca709e31ef90afc42e5388bd34a8693ab98d15d65f7b1575d079 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "353 / 915 of 1000 / last-modified: 1574960877" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 15686 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H/1.1	200 OK	8c562bfb-6467-471c-90a9-988de4b0487f beacon-eu2.rubiconproject.com/beacon/d/ Frame 0EA9	43 B 268 B	12ms 7ms	Image image/webp	69.173.144.153 The Rubicon Project
General Check archive.org Show headers Download Go to Show image Full URL http://beacon-eu2.rubiconproject.com/beacon/d/8c562bfb-6467-471c-90a9-988de4b0487f?oo=0&accountId=11662&siteId=36514&zoneId=151378&sizeId=15&e=6A1E40E384DA563B2F31C4C86368EE9A71F7838E290D8402B02AFFCAC229FD6BE4DA3C3C9332DB84C54D19CE76630813E4A9AFA6E089EF844205820F31DFC7D5F44C10B8F90491F08B765CD22D582F4FAC237D6FA0EBFC9A6240B348FC26EBCFB21DC93AEE450B7FCCC03D93D7B03184ABB8949CB44124C5D82D574BB593C59832997889F1DA11D8 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 69.173.144.153 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software Rubicon Project / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:34 GMT Cache-Control private, max-age=0, no-cache Expires 01 Jan 1970 10:00:00 GMT Server Rubicon Project Content-Length 43 Content-Type image/webp
GET H/1.1	200 OK	js Show response tags.mathtag.com/notify/ Frame F235	2 KB 2 KB	43ms 15ms	Script application/x-javascript	185.29.135.181 MediaMath Inc
General Check archive.org Show headers Download Go to Full URL https://tags.mathtag.com/notify/js?id=5aW95q2jLzIwLyAvT1dZM01Ua3pPV1V0T1dJeU5TMHpOR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3LzY0MjgzNDU4Nzk3OTcwNDk4MTUvNjYyMjQ3OC80NTYyMzU1LzkvODB2X0hyWWIwVHJNeG9UMVNVbm5sYmNhMzBTaXQ1VkhXMHY4NGZlTnZrSS8xLzkvMC8wLzk1NjgwMy8yNDIwOTI3Nzc0LzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC82NDI4MzQ1ODc5Nzk3MDQ5ODE1L2Ftcy8wLzIwNS8zMy85OTkvNDAvMTQ0Ljc2LjEwOS4wLzAuMDAwLzE1NzUxODM1NzUv/zTATvymGPoDAKEZQ3AKNEJ7TSsI&nodeid=356&auctionid=6428345879797049815&exch=ruc&sid=4562355&cid=6622478&price=7FF00CD929E26837&act=LiIiJiQocHxrPSwuJCMqcHxrKy5wfGshIioqJCMqcHxrOiwkOQsiPwQgPQMiOSQrcH0&group=eu&bp=a_aceaaa&3pck=http%3A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F Requested by Host: optimized-by.rubiconproject.com URL: http://optimized-by.rubiconproject.com/a/11662/36514/151376-2.js?&cb=0.43518339114708326&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=36514_2 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.29.135.181 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US), Reverse DNS Software MMBD/3.160.0 / Resource Hash 3eab32d44938be7e493386255678e7737c8ee309afb30595aa25610cc0fe8674 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip x-mm-bid-request-time 1575183575 Last-Modified Sun, 01 Dec 2019 06:59:35 GMT Server MMBD/3.160.0 x-mm-latency 1 (1) P3P CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" x-mm-dbg count Cache-Control no-cache x-mm-host cdg-router-x26, cdg-bidder-x53 Connection close x-mm-pending-bid-state eyJOb3RpZnlUeXBlIjoid2ViIiwiUEJEYXRhU291cmNlIjoiUEJDIiwiV2FpdEZvcldlYiI6ZmFsc2UsIldhaXRGb3JJbXAiOmZhbHNlLCJXYWl0Rm9yQ2siOnRydWUsIlBCU3RhdGUiOiJXaW4iLCJEdXBOb3RpZnkiOmZhbHNlLCJCaWRDbGFpbWVkIjpmYWxzZSwiUEJTV29ya2VkIjpmYWxzZSwiUEJTV2luUGF5bG9hZCI6IiJ9 Content-Type application/x-javascript; charset=UTF-8 Expires Sun, 01 Dec 2019 06:59:34 GMT
GET H/1.1	200 OK	09b599bc-321e-4915-a8d9-502d10c70a86 beacon-eu2.rubiconproject.com/beacon/d/ Frame F235	43 B 268 B	12ms 6ms	Image image/webp	69.173.144.153 The Rubicon Project
General Check archive.org Show headers Download Go to Show image Full URL http://beacon-eu2.rubiconproject.com/beacon/d/09b599bc-321e-4915-a8d9-502d10c70a86?oo=0&accountId=11662&siteId=36514&zoneId=151376&sizeId=2&e=6A1E40E384DA563BDFCA4302773FE14DF6E7D984316996DC2986628A830F958552702EBC3BDB7450C23DB32693792D42E4A9AFA6E089EF84830454A5DF63F59AF44C10B8F90491F020384A4CE700BB9BE581C7278562D885FD99DAC33F078020E95362172CF2D9E6992D6767FDC025DD7AD2C47A3B6B9893EF210C97010EC8148BE03C3D500331F09457E30D05AC9522D8E45BEB5CCD5D86D8D6E1A8B2E8E57FEBFBA2EDED8F9B8731FA5B04D1D738625F1407CF10CD53848803449ABBE5C9030E3B6D7A9E522428D8EFC9095A1DF1FB4620ACDF9CB6A8C8412EC3192328D16787564BED1DE5902D38940D47094D2BDD95FB8E54DFD88A11389B8FFB44E03EE2C944922ED5C0BB897CFB18E4870FBBE334B919E64D577601C08CA86A13B59F6E938C2B94BEF689F9046B1611E548DAD769F906FDD2F4FC6D69686FE89A90D1B30F984D56C8361623D888BD58682889188D1A1EDD315617F4E82C8DC099D34DAF7A4512289792C6D4D412D919DB7561D6D035A83E6F4D25F75F80E4DB370AA1A59B82BB21B430064CE82C8DC099D34DAF11EA0C268307A5A84BE0469B4098C39889EE741CE714E31A3C602C1782B6CBEA615D86485EB17FC6339EC7C702970D8FBCA1E8831F78FAC4793267B56D956A961FF23A8F80FB6D81E794E30949E5EBFD7D70377DD4EFD393C77669D7327B77ACA3D71F43F8BEE02D9F3AD60DF3143E962A343E90CFBE7034E1DBB4BF0F9E2493C9AA355E27BC03DBC2D1690597C2922DAA22B9FFCB0C25546240B348FC26EBCFB21DC93AEE450B7F2CF4479DCF7D16DF09E7FB285D730208D82D574BB593C598CEC42B1C68B2C2CFB10155BBECC493C431869959620D4F8E89E8285DE9184618F72E51D9BFF4EB8955FA1E261E910181 Requested by Host: optimized-by.rubiconproject.com URL: http://optimized-by.rubiconproject.com/a/11662/36514/151376-2.js?&cb=0.43518339114708326&tk_st=1&rf=http%3A//heroesoffreedom.0wn0.com/&rp_s=c&p_pos=atf&p_screen_res=1600x1200&ad_slot=36514_2 Protocol HTTP/1.1 Server 69.173.144.153 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software Rubicon Project / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:34 GMT Cache-Control private, max-age=0, no-cache Expires 01 Jan 1970 10:00:00 GMT Server Rubicon Project Content-Length 43 Content-Type image/webp
GET H2	200	pubads_impl_2019111801.js Show response securepubads.g.doubleclick.net/gpt/ Frame 8389	159 KB 58 KB	14ms 13ms	Script text/javascript	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software sffe / Resource Hash 03b07f320a1692a2d507465027fffaa6560d19d248c33bb6a5f2c97b75680c1d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 18 Nov 2019 14:07:04 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 59620 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	integrator.sync.js Show response adservice.google.de/adsid/ Frame 8389	113 B 178 B	15ms 15ms	Script application/javascript	2a00:1450:4001:81f::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.sync.js?domain=heroesoffreedom.0wn0.com Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 108 x-xss-protection 0
GET H2	200	pubads_impl_2019111801.js Show response securepubads.g.doubleclick.net/gpt/ Frame 0EA9	159 KB 58 KB	14ms 13ms	Script text/javascript	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software sffe / Resource Hash 03b07f320a1692a2d507465027fffaa6560d19d248c33bb6a5f2c97b75680c1d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 18 Nov 2019 14:07:04 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 59620 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	integrator.sync.js Show response adservice.google.de/adsid/ Frame 0EA9	113 B 175 B	15ms 15ms	Script application/javascript	2a00:1450:4001:81f::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.sync.js?domain=heroesoffreedom.0wn0.com Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ea03bfd7fdda1eac185ebc3e8e74b33065b04c8e0adc48cbbd4136748dbd2742 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript; charset=UTF-8 server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 108 x-xss-protection 0
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/ Frame 8389	4 KB 2 KB	79ms 79ms	XHR text/plain	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1063678500277598&correlator=3016397970338777&output=ldjh&impl=fif&eid=21065219&vrg=2019111801&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=0&sfv=1-0-36&ecs=20191201&iu=%2F1150267%2FEtoxicSarl_2019_300x250&sz=300x250&eri=6&cookie_enabled=1&bc=23&abxe=1&lmt=1575183575&dt=1575183575551&dlt=1575183575424&idt=116&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=824&ady=1398&adk=3480591353&uci=mhl5zst67xi4&ifi=1&ifk=1745099358&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&top=heroesoffreedom.0wn0.com&dssz=6&icsg=90&mso=1&std=0&vis=1&scr_x=0&scr_y=0&ga_vid=1261789457.1575183575&ga_sid=1575183576&ga_hid=1545004120&fws=256&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software cafe / Resource Hash 3049308eb22f170b1996a864792114d8699068aff96187b4cfb2da04061d1f7d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2062 x-xss-protection 0 google-lineitem-id 227267817 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 107686126137 content-type text/plain; charset=UTF-8 access-control-allow-origin http://heroesoffreedom.0wn0.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_rendering_2019111801.js Show response securepubads.g.doubleclick.net/gpt/ Frame 8389	65 KB 25 KB	14ms 14ms	Script text/javascript	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software sffe / Resource Hash 23f5a3eca6fec1f8380dd45a87da65ee9ab4c93d4602403dc26b18e2afeb201f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 18 Nov 2019 14:07:04 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 25219 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-36/html/ Frame 8389	0 0	6ms 6ms	Other text/html	2a00:1450:4001:820::2001 Google LLC
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html?n=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame B76A	0 0	20ms 7ms	Document text/html	23.37.55.184 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html?&geo=eu&co=de Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer http://heroesoffreedom.0wn0.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Thu, 14 Nov 2019 18:59:50 GMT Content-Encoding gzip Content-Length 7459 Content-Type text/html; charset=UTF-8 Cache-Control max-age=13157 Expires Sun, 01 Dec 2019 10:38:52 GMT Date Sun, 01 Dec 2019 06:59:35 GMT Connection keep-alive Vary Accept-Encoding
GET H/1.1	200 OK	dap2i2xhbauc Show response hal9000.redintelligence.net/zone/ Frame F235	10 KB 3 KB	4ms 2ms	Script text/html	136.243.149.243 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://hal9000.redintelligence.net/zone/dap2i2xhbauc?subid=&rnd=6428345879797049815&extVar[]=DOUBLEBORDER:1&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D6428345879797049815%26mt_id%3D6622478%26mt_adid%3D216536%26mt_sid%3D4562355%26mt_exid%3D9%26mt_inapp%3D0%26mt_uuid%3D49eb5de3-64d7-4701-b0aa-5c17d9becf4b%26mt_3pck%3Dhttp%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F%26redirect%3D Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.243.149.243.136.clients.your-server.de Software Apache / Resource Hash 757411f5d44f355cd0fd505c949cdd8af04784cf00c386dbc794fb78de85141f Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server Apache Connection close Content-Length 2817 Vary Accept-Encoding Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	img pixel.mathtag.com/event/ Frame F235	43 B 360 B	36ms 22ms	Image image/gif	2.18.233.201 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=9&v2=6428345879797049815&v3=651871&v4=4562355&v5=6622478&mt_nsync=1&no_attr=1 Requested by Host: tags.mathtag.com URL: https://tags.mathtag.com/notify/js?id=5aW95q2jLzIwLyAvT1dZM01Ua3pPV1V0T1dJeU5TMHpOR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3LzY0MjgzNDU4Nzk3OTcwNDk4MTUvNjYyMjQ3OC80NTYyMzU1LzkvODB2X0hyWWIwVHJNeG9UMVNVbm5sYmNhMzBTaXQ1VkhXMHY4NGZlTnZrSS8xLzkvMC8wLzk1NjgwMy8yNDIwOTI3Nzc0LzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC82NDI4MzQ1ODc5Nzk3MDQ5ODE1L2Ftcy8wLzIwNS8zMy85OTkvNDAvMTQ0Ljc2LjEwOS4wLzAuMDAwLzE1NzUxODM1NzUv/zTATvymGPoDAKEZQ3AKNEJ7TSsI&nodeid=356&auctionid=6428345879797049815&exch=ruc&sid=4562355&cid=6622478&price=7FF00CD929E26837&act=LiIiJiQocHxrPSwuJCMqcHxrKy5wfGshIioqJCMqcHxrOiwkOQsiPwQgPQMiOSQrcH0&group=eu&bp=a_aceaaa&3pck=http%3A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.201 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-201.deploy.static.akamaitechnologies.com Software MT3 1913 979072d master cdg-pixel-x14 / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Server MT3 1913 979072d master cdg-pixel-x14 P3P CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control no-cache Connection keep-alive Content-Type image/gif Content-Length 43 Expires Sun, 01 Dec 2019 06:59:34 GMT
GET H/1.1	200 OK	img tags.mathtag.com/event/ Frame F235	49 B 329 B	38ms 13ms	Image image/gif	185.29.135.181 MediaMath Inc
General Check archive.org Show headers Download Go to Show image Full URL https://tags.mathtag.com/event/img?type=mmImpTrack&exch=ruc&bid=6428345879797049815&st=4562355&time=1575183575&nodeid=356 Requested by Host: tags.mathtag.com URL: https://tags.mathtag.com/notify/js?id=5aW95q2jLzIwLyAvT1dZM01Ua3pPV1V0T1dJeU5TMHpOR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3LzY0MjgzNDU4Nzk3OTcwNDk4MTUvNjYyMjQ3OC80NTYyMzU1LzkvODB2X0hyWWIwVHJNeG9UMVNVbm5sYmNhMzBTaXQ1VkhXMHY4NGZlTnZrSS8xLzkvMC8wLzk1NjgwMy8yNDIwOTI3Nzc0LzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC82NDI4MzQ1ODc5Nzk3MDQ5ODE1L2Ftcy8wLzIwNS8zMy85OTkvNDAvMTQ0Ljc2LjEwOS4wLzAuMDAwLzE1NzUxODM1NzUv/zTATvymGPoDAKEZQ3AKNEJ7TSsI&nodeid=356&auctionid=6428345879797049815&exch=ruc&sid=4562355&cid=6622478&price=7FF00CD929E26837&act=LiIiJiQocHxrPSwuJCMqcHxrKy5wfGshIioqJCMqcHxrOiwkOQsiPwQgPQMiOSQrcH0&group=eu&bp=a_aceaaa&3pck=http%3A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.29.135.181 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US), Reverse DNS Software MMBD/3.160.0 / Resource Hash 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Server MMBD/3.160.0 Content-Type image/gif Cache-Control no-cache x-mm-host cdg-router-x38, cdg-bidder-x53 Connection keep-alive Keep-Alive timeout=360 Content-Length 49 Expires Sun, 01 Dec 2019 06:59:34 GMT
GET H/1.1	200 OK	request.php Show response hal900038.redintelligence.net/ Frame F235 Redirect Chain http://hal900038.redintelligence.net/request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&cli... http://hal900038.redintelligence.net/request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...	2 KB 1 KB	85ms 84ms	Script application/x-javascript	136.243.54.220 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://hal900038.redintelligence.net/request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D6428345879797049815%26mt_id%3D6622478%26mt_adid%3D216536%26mt_sid%3D4562355%26mt_exid%3D9%26mt_inapp%3D0%26mt_uuid%3D49eb5de3-64d7-4701-b0aa-5c17d9becf4b%26mt_3pck%3Dhttp%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F%26redirect%3D&documentReferer=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ancestorOrigins=http%3A%2F%2Fheroesoffreedom.0wn0.com&random=1645556444577&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 136.243.54.220 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.220.54.243.136.clients.your-server.de Software Apache / Resource Hash 0bc580951e9697daa77ced6076ec685cb469a54dcc8f22518b4f0d140ffa8651 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control no-store, no-cache, must-revalidate, max-age=0 X-NEORY-SubId 79641200012863100951453011064038 Connection close Content-Type application/x-javascript; charset=utf-8 Content-Length 897 Expires Sun, 01 Dec 2019 06:59:35 +0100 Redirect headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Server Apache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Location request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D6428345879797049815%26mt_id%3D6622478%26mt_adid%3D216536%26mt_sid%3D4562355%26mt_exid%3D9%26mt_inapp%3D0%26mt_uuid%3D49eb5de3-64d7-4701-b0aa-5c17d9becf4b%26mt_3pck%3Dhttp%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F%26redirect%3D&documentReferer=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ancestorOrigins=http%3A%2F%2Fheroesoffreedom.0wn0.com&random=1645556444577&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1 Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection close Content-Type text/html; charset=UTF-8 Content-Length 0 Expires Sun, 01 Dec 2019 06:59:35 +0100
GET H2	200	ads Show response securepubads.g.doubleclick.net/gampad/ Frame 0EA9	4 KB 2 KB	63ms 63ms	XHR text/plain	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3634972213513926&correlator=4449060702528430&output=ldjh&impl=fif&eid=21062414%2C21063145%2C21064618%2C21065202&vrg=2019111801&guci=1.2.0.0.2.2.0.0&plat=1%3A536903688%2C2%3A536903688%2C8%3A134250504&sc=0&sfv=1-0-36&ecs=20191201&iu=%2F1150267%2FEtoxicSarl_2019_300x250&sz=300x250&eri=6&cookie_enabled=1&bc=23&abxe=1&lmt=1575183575&dt=1575183575575&dlt=1575183575421&idt=149&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=460&ady=1398&adk=3480591353&uci=gbp05hahpb2u&ifi=1&ifk=1745099358&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&top=heroesoffreedom.0wn0.com&dssz=6&icsg=90&mso=1&std=0&vis=1&scr_x=0&scr_y=0&ga_vid=1261789457.1575183575&ga_sid=1575183576&ga_hid=2137660745&fws=256&ohw=0 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software cafe / Resource Hash 00ad7ff4f6cea35984693fe62f69cbaada84614efef006c355ac9d5e27c65f2e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 2056 x-xss-protection 0 google-lineitem-id 227267817 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 107686126137 content-type text/plain; charset=UTF-8 access-control-allow-origin http://heroesoffreedom.0wn0.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	pubads_impl_rendering_2019111801.js Show response securepubads.g.doubleclick.net/gpt/ Frame 0EA9	65 KB 25 KB	14ms 14ms	Script text/javascript	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software sffe / Resource Hash 23f5a3eca6fec1f8380dd45a87da65ee9ab4c93d4602403dc26b18e2afeb201f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 18 Nov 2019 14:07:04 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 25219 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-36/html/ Frame 0EA9	0 0	6ms 6ms	Other text/html	2a00:1450:4001:820::2001 Google LLC
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-36/html/container.html?n=1 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame 1687	0 0	7ms 6ms	Document text/html	23.37.55.184 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html?&geo=eu&co=de Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer http://heroesoffreedom.0wn0.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Thu, 14 Nov 2019 18:59:50 GMT Content-Encoding gzip Content-Length 7459 Content-Type text/html; charset=UTF-8 Cache-Control max-age=13157 Expires Sun, 01 Dec 2019 10:38:52 GMT Date Sun, 01 Dec 2019 06:59:35 GMT Connection keep-alive Vary Accept-Encoding
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame EC88	0 0	16ms 16ms	Fetch image/gif	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuTOtrBsas9PysYivyG2tf07R7Th3_-1NtByvU7g4NF9p8GzIMOxxhQfUjH4v8tubFRTCFqkbBgm8HUeUO28TXlswtnCUwiOGZ9xbsX611WY2IgrH0ThqhRa3KEG-Zc0EA-DJKUe4hF5SoRTLpU2ZGllo11fDY2hx3rL6SFRJpIe8dVMI0vN8vjSUyDxEdXCPPaNHiwNz567scxVXvcwz1UPlSvdDSSM2pTj9pBXtMwbbxEeIj5FF9ut5Wknqtwd3xvzfkmFhMdfIlrRfe9FRKznpUtX2KMbQ&sai=AMfl-YTNRdeLKwkYghBeFcBSecUAEE3Xsm_aOX6tNs0m8CtcsaOXj8TVgUEArLkGInh9FQUQtvoatKVwLsZx2H1COZ5aEZ9w_kLDPBPVcctz&sig=Cg0ArKJSzGtqnAnYTh6HEAE&urlfix=1&adurl= Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H/1.1	200 OK	banner b.a2gw.com/ Frame E5B1	0 0	185ms 37ms	Document text/html	99.80.32.136 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://b.a2gw.com/banner?dfp=21773486844&cw=300&ch=250&_cb=1933175897 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.32.136 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-99-80-32-136.eu-west-1.compute.amazonaws.com Software nginx/1.12.1 / Resource Hash Request headers Host b.a2gw.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer http://heroesoffreedom.0wn0.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Sun, 01 Dec 2019 06:59:35 GMT Expires 0 Server nginx/1.12.1 Content-Length 280 Connection keep-alive
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame EC88	76 KB 29 KB	13ms 13ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash e48c4975b293be404aa17aca3844095d270597494ffabe5316cad8c3e45d5004 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1573858490126243" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 29138 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/ Frame 8389	78 KB 29 KB	41ms 40ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 0e946b0ee0337cf23c845f67a238e1fefd5f1e014fdbd8ea27870172fcedd40f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1573858490126243" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 29338 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	view securepubads.g.doubleclick.net/pcs/ Frame 9026	0 0	16ms 16ms	Fetch image/gif	172.217.16.162 Google LLC
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstDsbNSU5gynaZtqG4z3Lh2zdScjECQjcKbLLVCvU7jVPzxxdOiObc7kY_wTZ6-sH1cMJefKpn9ukW8Kgm2f0iDwUlXWRJrHJJrvWnFahK2y9VdoThr0Boi1nffoV4xk1xa6nBTVWCACSzw-365sHl3pi3S3tLdP5NeaFcOZ9AqGai9sXVqaKDdCN05Qhd16q91GZpTetcwnjCX3hB0O537J4aIO7TqYIjAMidSRbPIMKSvsMMJbtLc9ZqQc8IQNYw7urFqOGMQ5c90f45XF12ebw7W701MeA&sai=AMfl-YRQWhjGb8o3H38l8AKW9BXo6XZB_affir3wry10PXe94HnPa3pDF70HtLaROivl2z3zcR64-Wfwj8M1KFCwn--6izc4AP3kzrzM9UlC&sig=Cg0ArKJSzNMBvtY2DsH8EAE&urlfix=1&adurl= Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s11-in-f2.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers timing-allow-origin * date Sun, 01 Dec 2019 06:59:35 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H/1.1	200 OK	banner b.a2gw.com/ Frame 1646	0 0	178ms 37ms	Document text/html	99.80.32.136 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://b.a2gw.com/banner?dfp=21773486844&cw=300&ch=250&_cb=187795458 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.80.32.136 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-99-80-32-136.eu-west-1.compute.amazonaws.com Software nginx/1.12.1 / Resource Hash Request headers Host b.a2gw.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer http://heroesoffreedom.0wn0.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Sun, 01 Dec 2019 06:59:35 GMT Expires 0 Server nginx/1.12.1 Content-Length 280 Connection keep-alive
GET H2	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 9026	76 KB 29 KB	65ms 65ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash e48c4975b293be404aa17aca3844095d270597494ffabe5316cad8c3e45d5004 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1573858490126243" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 29138 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/ Frame 0EA9	78 KB 29 KB	67ms 66ms	Script text/javascript	2a00:1450:4001:817::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019111801.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 0e946b0ee0337cf23c845f67a238e1fefd5f1e014fdbd8ea27870172fcedd40f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 01 Dec 2019 06:59:35 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1573858490126243" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 29338 x-xss-protection 0 expires Sun, 01 Dec 2019 06:59:35 GMT
GET H2	200	activityi;dc_pre=CJ658Yvwk-YCFcj3dwodc-8J6g;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062 5994599.fls.doubleclick.net/ Frame 05B7 Redirect Chain https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062? https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ658Yvwk-YCFcj3dwodc-8J6g;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062?	0 0	23ms 23ms	Document text/html	172.217.22.6 Google LLC
General Check archive.org Show headers Download Go to Full URL https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ658Yvwk-YCFcj3dwodc-8J6g;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062? Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.22.6 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra16s14-in-f6.1e100.net Software cafe / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=21600 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 5994599.fls.doubleclick.net :scheme https :path /activityi;dc_pre=CJ658Yvwk-YCFcj3dwodc-8J6g;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062? pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site sec-fetch-mode nested-navigate referer http://heroesoffreedom.0wn0.com/ accept-encoding gzip, deflate, br cookie IDE=AHWqTUkFUAUw1l74IPxT1vip8-4_r-6AT7ROd2c2U4ckNQFENvFxKAanRG0lzGS- Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * date Sun, 01 Dec 2019 06:59:35 GMT expires Sun, 01 Dec 2019 06:59:35 GMT cache-control private, max-age=0 strict-transport-security max-age=21600 content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip server cafe content-length 321 x-xss-protection 0 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 Redirect headers status 302 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * date Sun, 01 Dec 2019 06:59:35 GMT pragma no-cache expires Fri, 01 Jan 1990 00:00:00 GMT cache-control no-cache, must-revalidate follow-only-when-prerender-shown 1 strict-transport-security max-age=21600 location https://5994599.fls.doubleclick.net/activityi;dc_pre=CJ658Yvwk-YCFcj3dwodc-8J6g;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9321520366105.062? content-type text/html; charset=UTF-8 x-content-type-options nosniff server cafe content-length 0 x-xss-protection 0 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H/1.1	200 OK	request_content.php hal900038.redintelligence.net/ Frame D667	0 0	2ms 2ms	Document text/html	136.243.54.220 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://hal900038.redintelligence.net/request_content.php?s=79641200012863100951453011064038&a=6abe74b3 Requested by Host: hal900038.redintelligence.net URL: http://hal900038.redintelligence.net/request.php?zone=dap2i2xhbauc&nw=20&renderingType=javascript&namespace=c7e56ad076&subid=&uid=035787d6f8d18cf1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D6428345879797049815%26mt_id%3D6622478%26mt_adid%3D216536%26mt_sid%3D4562355%26mt_exid%3D9%26mt_inapp%3D0%26mt_uuid%3D49eb5de3-64d7-4701-b0aa-5c17d9becf4b%26mt_3pck%3Dhttp%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F09b599bc-321e-4915-a8d9-502d10c70a86%2F%26redirect%3D&documentReferer=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&ancestorOrigins=http%3A%2F%2Fheroesoffreedom.0wn0.com&random=1645556444577&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1 Protocol HTTP/1.1 Server 136.243.54.220 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.220.54.243.136.clients.your-server.de Software Apache / Resource Hash Request headers Host hal900038.redintelligence.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Referer http://heroesoffreedom.0wn0.com/ Accept-Encoding gzip, deflate Cookie 8lcfmzhxc8d6_uid=7a156870657cdb90 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Server Apache Cache-Control no-store, no-cache, must-revalidate, max-age=0 Expires Sun, 01 Dec 2019 06:59:35 +0100 Pragma no-cache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Vary Accept-Encoding Content-Encoding gzip Content-Length 1649 Connection close Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	id.js Show response mathid.mathtag.com/device/ Frame F235	54 KB 19 KB	52ms 27ms	Script text/javascript	185.29.133.199 MediaMath Inc
General Check archive.org Show headers Download Go to Full URL http://mathid.mathtag.com/device/id.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 185.29.133.199 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US), Reverse DNS Software / Express Resource Hash b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip X-Powered-By Express Vary Accept-Encoding Access-Control-Allow-Methods GET,PUT,POST,DELETE Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control public, max-age=3600 Transfer-Encoding chunked X-MM-Host zrh-mathid-x2 Connection keep-alive Access-Control-Allow-Headers Content-type, X-Optout Keep-Alive timeout=360 Expires Sun, 01 Dec 2019 07:59:35 GMT
GET H/1.1	200 OK	usync.html eus.rubiconproject.com/ Frame 8B6A	0 0	7ms 6ms	Document text/html	23.37.55.184 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://eus.rubiconproject.com/usync.html?&geo=eu&co=de Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.37.55.184 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-37-55-184.deploy.static.akamaitechnologies.com Software Apache/2.2.15 (CentOS) / PHP/5.3.3 Resource Hash Request headers Host eus.rubiconproject.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Sec-Fetch-Mode nested-navigate Referer http://heroesoffreedom.0wn0.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.3.3 p3p CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT" Last-Modified Thu, 14 Nov 2019 18:59:50 GMT Content-Encoding gzip Content-Length 7459 Content-Type text/html; charset=UTF-8 Cache-Control max-age=13157 Expires Sun, 01 Dec 2019 10:38:52 GMT Date Sun, 01 Dec 2019 06:59:35 GMT Connection keep-alive Vary Accept-Encoding
GET DATA	200 OK	truncated / Frame EC88	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8dc0fe8fac535e7b35fc6bfb4135a562f93b36acbe8c792f9cc44966419e1a18 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame 9026	213 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 72c289bc6f41760ce4e2f7c3db6de885ede7f5c1ce75874945edd3b7645abf61 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
POST H/1.1	200 OK	ping Show response api.viglink.com/api/	304 B 994 B	75ms 37ms	XHR text/javascript	52.214.93.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://api.viglink.com/api/ping Requested by Host: cdn.viglink.com URL: http://cdn.viglink.com/api/vglnk.js Protocol HTTP/1.1 Server 52.214.93.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-214-93-23.eu-west-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash 4108fe317e374a8da9f5601d5d30c265379a8b3cc24463ca899006a02f744bfc Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin http://heroesoffreedom.0wn0.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/javascript;charset=UTF-8 Content-Length 304 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	impl.20191130-2-RELEASE.js Show response cdn.taboola.com/libtrc/	419 KB 118 KB	36ms 34ms	Script application/javascript	151.101.86.2 Fastly
General Check archive.org Show headers Download Go to Full URL https://cdn.taboola.com/libtrc/impl.20191130-2-RELEASE.js Requested by Host: cdn.taboola.com URL: http://cdn.taboola.com/libtrc/forumotion-en-2/loader.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.86.2 Stockholm, Sweden, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software AmazonS3 / Resource Hash f43c9a6473f8db88131adcf90e78eb36c06aaeb7c87cfa7127312a4db59b5985 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id 3GLCgfmm5lISfk7DJ3iG_YR9MHqHU_H0 content-encoding gzip age 89 x-cache HIT status 200 date Sun, 01 Dec 2019 06:59:36 GMT x-amz-replication-status COMPLETED content-length 120492 x-amz-id-2 7ZPIOz4/QpCnJvUODlJ+PMYlWfNjoncrD1xvZBatBJ4k59tYW5v5UM40OtJpIqEP7Z7kniNH9iQ= x-served-by cache-bma1627-BMA last-modified Sat, 30 Nov 2019 16:11:35 GMT server AmazonS3 x-timer S1575183576.089854,VS0,VE0 etag "1ece7cd420afa09725398d70cd9c4ac4" vary Accept-Encoding x-amz-request-id 83232C1D3C6DBD60 via 1.1 varnish cache-control private,max-age=31536000 accept-ranges bytes content-type application/javascript; charset=utf-8 abp 67 x-cache-hits 132
GET H/1.1	200 OK	beacon.js Show response sb.scorecardresearch.com/	1 KB 1 KB	22ms 6ms	Script application/x-javascript	2.16.31.65 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://sb.scorecardresearch.com/beacon.js Requested by Host: cdn.taboola.com URL: http://cdn.taboola.com/libtrc/forumotion-en-2/loader.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.16.31.65 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-16-31-65.deploy.static.akamaitechnologies.com Software / Resource Hash 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:36 GMT Content-Encoding gzip Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=86400 Connection keep-alive Content-Length 902 Expires Mon, 02 Dec 2019 06:59:36 GMT
GET H/1.1	204 No Content	b2 b.scorecardresearch.com/ Redirect Chain http://b.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1575183576100&ns_c=UTF-8&cv=3.1e&c8=Free%20forum%20%3A%20Heroes%20of%20Freedom&c7=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&c9= http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1575183576100&ns_c=UTF-8&cv=3.1e&c8=Free%20forum%20%3A%20Heroes%20of%20Freedom&c7=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&c9=	0 248 B	6ms 6ms	Image text/plain	2.16.186.51 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1575183576100&ns_c=UTF-8&cv=3.1e&c8=Free%20forum%20%3A%20Heroes%20of%20Freedom&c7=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&c9= Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 2.16.186.51 , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-16-186-51.deploy.static.akamaitechnologies.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location http://b.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1575183576100&ns_c=UTF-8&cv=3.1e&c8=Free%20forum%20%3A%20Heroes%20of%20Freedom&c7=http%3A%2F%2Fheroesoffreedom.0wn0.com%2F&c9= Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	tag.min.js Show response get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/ Redirect Chain http://api.viglink.com/api/sync.js?key=0d80ae9fe71cec9484f682bd59232f9e http://get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/tag.min.js	44 KB 15 KB	48ms 6ms	Script text/javascript	2600:9000:20eb:7000:1f:287:d20a:ce1 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/tag.min.js Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 2600:9000:20eb:7000:1f:287:d20a:ce1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software AmazonS3 / Resource Hash 23b08bd5971fa9db2bdfa94f862dfcea0e8dd32d387c3fb2fe41211ac5e1b64e Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id CUtyhcQzDpP0iYAxkh51rGVGuOXE0Mza Content-Encoding gzip Last-Modified Mon, 11 Nov 2019 17:40:37 GMT Server AmazonS3 Age 3536 Date Sun, 01 Dec 2019 06:00:41 GMT Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type text/javascript Via 1.1 96ab38d99b79d57e5c7e9b8a07c0fad3.cloudfront.net (CloudFront) Cache-Control max-age=3600 Transfer-Encoding chunked X-Amz-Cf-Pop FRA2-C1 Connection keep-alive X-Amz-Cf-Id uY32AhdG1RkqwrE6xTpounNUqS1AeoTlwqQyopJDDhwlN__771jngQ== Redirect headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Location http://get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/tag.min.js Cache-Control no-cache, no-store Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200 OK	merge ce.lijit.com/ Redirect Chain http://api.viglink.com/api/sync.gif?key=0d80ae9fe71cec9484f682bd59232f9e http://ce.lijit.com/merge?pid=8008&3pid=aee64d20642d27bd2f7fb480df1d0099 http://ce.lijit.com/merge?pid=8008&3pid=aee64d20642d27bd2f7fb480df1d0099&dnr=1	43 B 583 B	26ms 25ms	Image image/gif	72.251.249.13 Internap Corporation
General Check archive.org Show headers Download Go to Show image Full URL http://ce.lijit.com/merge?pid=8008&3pid=aee64d20642d27bd2f7fb480df1d0099&dnr=1 Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Server 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US), Reverse DNS Software nginx / raptor Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Server nginx X-Powered-By raptor P3P CP="CUR ADM OUR NOR STA NID" Cache-Control private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 X-Sovrn-Pod ap2ams1 Content-Type image/gif Content-Length 43 X-Application-Context application:prod:9080 Expires Fri, 20 Mar 2009 00:00:00 GMT Redirect headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Server nginx X-Powered-By raptor P3P CP="CUR ADM OUR NOR STA NID" Location http://ce.lijit.com/merge?pid=8008&3pid=aee64d20642d27bd2f7fb480df1d0099&dnr=1 Cache-Control private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0 X-Sovrn-Pod ap2ams1 Content-Length 0 X-Application-Context application:prod:9080 Expires Fri, 20 Mar 2009 00:00:00 GMT
POST H/1.1	200 OK	domains Show response api.viglink.com/api/	42 B 497 B	54ms 30ms	XHR text/javascript	52.214.93.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://api.viglink.com/api/domains Requested by Host: cdn.viglink.com URL: http://cdn.viglink.com/api/vglnk.js Protocol HTTP/1.1 Server 52.214.93.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-214-93-23.eu-west-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash e3947f5692a535800302dd8c7d6d1dabb3ca3a6a355747e3dfa6b4da8fdb3699 Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin http://heroesoffreedom.0wn0.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/javascript;charset=UTF-8 Content-Length 42 Expires Thu, 01 Jan 1970 00:00:00 GMT
POST H/1.1	200 OK	insert Show response api.viglink.com/api/	45 KB 7 KB	89ms 63ms	XHR text/javascript	52.214.93.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://api.viglink.com/api/insert Requested by Host: cdn.viglink.com URL: http://cdn.viglink.com/api/vglnk.js Protocol HTTP/1.1 Server 52.214.93.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-214-93-23.eu-west-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash 43e158768726a372890e3ae4bc0ff631f97ee39bd939f8e3e4abb8b10f3838d3 Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Content-Encoding gzip Server Apache-Coyote/1.1 Vary Accept-Encoding P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin http://heroesoffreedom.0wn0.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/javascript;charset=UTF-8 transfer-encoding chunked Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200 OK	ck-confirm tags.mathtag.com/ Frame F235	49 B 329 B	17ms 17ms	Image image/gif	185.29.135.181 MediaMath Inc
General Check archive.org Show headers Download Go to Show image Full URL https://tags.mathtag.com/ck-confirm?bid_id=6428345879797049815&node_id=356&exch_id=9&mathid_data=%7B%22dv1%22%3A%22TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNg%3D%3D%22%2C%22dv2%22%3A%22NWI2NjgwZjU1ZmFiYmMxM2YxMGMwMDgyNTM4NjQ0OTk%3D%22%2C%22dv3%22%3A%22%22%2C%22dv4%22%3A%22MTYwMHwxMjAwfDE2MDB8MTIwMHwyNHx8%22%2C%22dv5%22%3A%22RXVyb3BlL0Jlcmxpbg%3D%3D%22%2C%22dv6%22%3A%22%22%2C%22dv7%22%3A%22MA%3D%3D%22%2C%22dv8%22%3A%22ZmFsc2V8dHJ1ZXx0cnVl%22%2C%22dv9%22%3A%22fGVuLVVTfA%3D%3D%22%2C%22dv10%22%3A%22TW96aWxsYXxOZXRzY2FwZXxMaW51eCB4ODZfNjR8%22%7D Requested by Host: heroesoffreedom.0wn0.com URL: http://heroesoffreedom.0wn0.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.29.135.181 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US), Reverse DNS Software MMBD/3.160.0 / Resource Hash 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 01 Dec 2019 06:59:36 GMT Server MMBD/3.160.0 Content-Type image/gif Cache-Control no-cache x-mm-host cdg-router-x51, cdg-bidder-x53 Connection keep-alive Keep-Alive timeout=360 Content-Length 49 Expires Sun, 01 Dec 2019 06:59:35 GMT
POST H/1.1	400 Bad Request	optimize Show response api.viglink.com/api/	986 B 1 KB	33ms 33ms	XHR text/html	52.214.93.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://api.viglink.com/api/optimize Requested by Host: cdn.viglink.com URL: http://cdn.viglink.com/api/vglnk.js Protocol HTTP/1.1 Server 52.214.93.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-214-93-23.eu-west-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash 4192f7a925a86b25b87e422c509071dc6d5222fef92358406b627882ee2c22af Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Server Apache-Coyote/1.1 Content-Language en P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin http://heroesoffreedom.0wn0.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html;charset=utf-8 Content-Length 986 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200 OK	/ Show response onetag-geo.s-onetag.com/	23 B 591 B	178ms 159ms	XHR application/json	2600:9000:21f3:6800:5:ae3a:ba00:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://onetag-geo.s-onetag.com/ Requested by Host: get.s-onetag.com URL: http://get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/tag.min.js Protocol HTTP/1.1 Server 2600:9000:21f3:6800:5:ae3a:ba00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software / Resource Hash ad16e1b37490fca28df99d039d6373d2fee4d894fcd279d95b90ae872f4d860f Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com Response headers Date Sun, 01 Dec 2019 06:59:36 GMT Via 1.1 216b2e0a8a27f8fca1b540a1c4ea6922.cloudfront.net (CloudFront), 1.1 d9bf8acc1da383db4531789bbb03ac07.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA2-C2, FRA2-C2 x-amzn-RequestId 0e6f5879-e797-4370-800c-7fea4cac72b3 X-Cache Miss from cloudfront Content-Type application/json Access-Control-Allow-Origin * Cache-Control max-age=3600 Connection keep-alive x-amz-apigw-id EAyxzFjxSK4FiYQ= Content-Length 23 X-Amz-Cf-Id kz3egymc15MezpuGFzA9IXnsDEC97VwnZ9LtW529NpJZdKJwD6Zx0w==
GET H2	200	beacon.min.js Show response beacon.s-onetag.com/	17 KB 6 KB	69ms 7ms	Script application/javascript	2600:9000:20eb:e800:5:9a4c:9b00:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://beacon.s-onetag.com/beacon.min.js Requested by Host: get.s-onetag.com URL: http://get.s-onetag.com/87eee822-3536-4216-86df-3b822f799b42/tag.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:20eb:e800:5:9a4c:9b00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software AmazonS3 / Resource Hash 1e794399af60ec6300017e12e37a6b7a8253a9ff05ef41ca5e42b76dced02ef4 Request headers Referer http://heroesoffreedom.0wn0.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id QuZjBQ9JYyZaR8wz.Z.0oyNzLjKP2j64 content-encoding gzip last-modified Tue, 05 Nov 2019 16:59:56 GMT server AmazonS3 age 3538 date Sun, 01 Dec 2019 06:00:40 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript status 200 cache-control max-age=3600 x-amz-cf-pop FRA2-C1 x-amz-cf-id WB1Mwj2i3siJ7ALrhUZ4oZkfZY5Uz5oHcMM8CupxSB2mCLeNm4YTdg== via 1.1 7a18a0a1d9929dae345690b88b08dd5e.cloudfront.net (CloudFront)
POST H/1.1	202 Accepted	inserted Show response api.viglink.com/api/	0 415 B	34ms 34ms	XHR text/plain	52.214.93.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://api.viglink.com/api/inserted Requested by Host: cdn.viglink.com URL: http://cdn.viglink.com/api/vglnk.js Protocol HTTP/1.1 Server 52.214.93.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-214-93-23.eu-west-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:35 GMT Server Apache-Coyote/1.1 P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin http://heroesoffreedom.0wn0.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 GMT
POST H/1.1	400 Bad Request	optimize Show response api.viglink.com/api/	986 B 1 KB	32ms 32ms	XHR text/html	52.214.93.23 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://api.viglink.com/api/optimize Requested by Host: cdn.viglink.com URL: http://cdn.viglink.com/api/vglnk.js Protocol HTTP/1.1 Server 52.214.93.23 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-214-93-23.eu-west-1.compute.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash 4192f7a925a86b25b87e422c509071dc6d5222fef92358406b627882ee2c22af Request headers Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Sun, 01 Dec 2019 06:59:36 GMT Server Apache-Coyote/1.1 Content-Language en P3P CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI" Access-Control-Allow-Origin http://heroesoffreedom.0wn0.com Cache-Control no-cache, no-store Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html;charset=utf-8 Content-Length 986 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	fetch_frame_2019111801.html ff.doubleclick.net/tag/js/ Frame B6D1	0 0	26ms 6ms	Document text/html	2a00:1450:4001:81c::2006 Google LLC
General Check archive.org Show headers Download Go to Full URL https://ff.doubleclick.net/tag/js/fetch_frame_2019111801.html Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority ff.doubleclick.net :scheme https :path /tag/js/fetch_frame_2019111801.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site sec-fetch-mode nested-navigate referer http://heroesoffreedom.0wn0.com/ accept-encoding gzip, deflate, br cookie IDE=AHWqTUkFUAUw1l74IPxT1vip8-4_r-6AT7ROd2c2U4ckNQFENvFxKAanRG0lzGS- Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 6737 date Sat, 30 Nov 2019 18:09:41 GMT expires Sun, 29 Nov 2020 18:09:41 GMT last-modified Mon, 18 Nov 2019 14:07:04 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 46195 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
GET H/1.1	200 OK	/ Show response onetag-geo.s-onetag.com/	23 B 599 B	12ms 7ms	XHR application/json	2600:9000:21f3:6800:5:ae3a:ba00:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://onetag-geo.s-onetag.com/ Requested by Host: beacon.s-onetag.com URL: https://beacon.s-onetag.com/beacon.min.js Protocol HTTP/1.1 Server 2600:9000:21f3:6800:5:ae3a:ba00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software / Resource Hash ad16e1b37490fca28df99d039d6373d2fee4d894fcd279d95b90ae872f4d860f Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://heroesoffreedom.0wn0.com/ Origin http://heroesoffreedom.0wn0.com Response headers Date Sun, 01 Dec 2019 06:59:36 GMT Via 1.1 216b2e0a8a27f8fca1b540a1c4ea6922.cloudfront.net (CloudFront), 1.1 4048e3a1e70c8529cbd86f04580a3da4.cloudfront.net (CloudFront) Connection keep-alive Age 10 x-amzn-RequestId 0e6f5879-e797-4370-800c-7fea4cac72b3 X-Cache Hit from cloudfront Content-Type application/json Access-Control-Allow-Origin * Cache-Control max-age=3600 X-Amz-Cf-Pop FRA2-C2, FRA2-C2 x-amz-apigw-id EAyxzFjxSK4FiYQ= Content-Length 23 X-Amz-Cf-Id 7QTarc6ASuUDxV6FTIugNCkl_3bn4D2cCib8p1o18R2wzGUEKORFOQ==