www.35express.org Open in urlscan Pro
139.180.156.24 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://35express.org/
Effective URL:
https://www.35express.org/
Submission: On July 25 via api (July 25th 2021, 5:16:11 am UTC) from US

Summary HTTP 282 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 20 IPs in 4 countries across 16 domains to perform 282 HTTP transactions. The main IP is 139.180.156.24, located in Singapore, Singapore and belongs to AS-CHOOPA, US. The main domain is www.35express.org.
TLS certificate: Issued by R3 on July 8th 2021. Valid for: 3 months.

This is the only time www.35express.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 101	139.180.156.24 139.180.156.24	20473 (AS-CHOOPA) (AS-CHOOPA)
47	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2606:4700:303... 2606:4700:3036::ac43:dcbd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	157.230.253.19 157.230.253.19	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
83	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
5 7	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
282	20

101 139.180.156.24 (Singapore, Singapore) 2 redirects

ASN20473 (AS-CHOOPA, US)
PTR: 139.180.156.24.vultr.com

35express.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.35express.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

47 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:3036::ac43:dcbd (United States)

ASN13335 (CLOUDFLARENET, US)

menu.metu.vn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.230.253.19 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)

api.trackpush.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

83 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 5 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
101	35express.org 2 redirects 35express.org www.35express.org	3 MB
99	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	1 MB
28	doubleclick.net googleads.g.doubleclick.net	297 KB
11	google.com 5 redirects adservice.google.com www.google.com	2 KB
9	gstatic.com www.gstatic.com fonts.gstatic.com	160 KB
8	googletagservices.com www.googletagservices.com	289 KB
7	ampproject.org cdn.ampproject.org	125 KB
6	metu.vn menu.metu.vn	100 KB
4	googleapis.com fonts.googleapis.com	2 KB
4	google.de adservice.google.de	1 KB
3	gravatar.com secure.gravatar.com	5 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	googleadservices.com partner.googleadservices.com	659 B
1	trackpush.com api.trackpush.com	8 KB
1	onesignal.com cdn.onesignal.com	3 KB
1	googletagmanager.com www.googletagmanager.com	39 KB
282	16

	Domain	Requested by
99	www.35express.org	www.35express.org
83	tpc.googlesyndication.com	www.35express.org googleads.g.doubleclick.net tpc.googlesyndication.com cdn.ampproject.org pagead2.googlesyndication.com
28	googleads.g.doubleclick.net	pagead2.googlesyndication.com www.35express.org googleads.g.doubleclick.net
16	pagead2.googlesyndication.com	www.35express.org pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
8	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
7	cdn.ampproject.org	googleads.g.doubleclick.net pagead2.googlesyndication.com
7	www.google.com	5 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
7	fonts.gstatic.com	fonts.googleapis.com
6	menu.metu.vn	www.35express.org menu.metu.vn
4	fonts.googleapis.com	googleads.g.doubleclick.net tpc.googlesyndication.com
4	adservice.google.com	pagead2.googlesyndication.com
4	adservice.google.de	pagead2.googlesyndication.com
3	secure.gravatar.com	www.35express.org
2	www.gstatic.com	googleads.g.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	35express.org	2 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	api.trackpush.com	www.35express.org
1	cdn.onesignal.com	www.35express.org
1	www.googletagmanager.com	www.35express.org
282	20

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
www.pinterest.com

Subject Issuer	Validity	Valid
35express.org R3	`2021-07-08` - `2021-10-06`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-04` - `2022-07-03`	a year	crt.sh
*.trackpush.com Sectigo RSA Domain Validation Secure Server CA	`2021-06-15` - `2022-07-16`	a year	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh

This page contains 29 frames:

Primary Page: https://www.35express.org/
Frame ID: 88A3667E3709AC0F25866D6BE8FFA126
Requests: 131 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html
Frame ID: 4CC242F826EB67E093C8EC3954203406
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&adk=1812271804&adf=3025194257&lmt=1627190149&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.35express.org%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149453&bpp=3&bdt=733&idt=109&shv=r20210720&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2425018222993&frm=20&pv=2&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=126
Frame ID: 6074A1341016224784B44CBF7298E5B7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133
Frame ID: 9F7C34016A63CA5CBF71113BE57EB4DA
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152
Frame ID: F88C53C8C568C957ECB0DC72F8C6BCA3
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161
Frame ID: 2EB840EDE268BA087E842139DC526138
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188
Frame ID: 0265B25D4C58D53FC0366D02FBEF49B2
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178
Frame ID: 8C4E88B83253035ED8F9393A5C3D933D
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223
Frame ID: E4CDABB07EEB4861470DCB734BDE480C
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html
Frame ID: 0C22C3F78B8201CD009F01D5171AE9BA
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CZaQRhfP8YKWuKYP4gAfM-pnADJmP4vdj8O-ZtZsOxru29rgDEAEg5c3MNWCVAqAB_9uKyAPIAQmoAwHIA0iqBNwBT9DZRx0mwmCEaOgPYNUKDS2ZsrAnyAxDAPdDOjsYy_CKFbM2eseoKeShj1Z1txHz1fENslADBvGp8WqOczn19HGMiDgvrjfSRTxaEu8mE31zAVHfu7EaiX3Iu7mg3R_cDLxCgdxAh7ziLDFMR2z40rZdqgrRogV29v6MxNRuYsdnDT0N_HHiAnPDbe6pkLqXhJqkDcf8frEK1JO5i_lllU0QC6uXt9doovzILpUaZUyr_RnW2TZyXkmbSDLW64iVmG1kJ23X32Dx9-dz1Ia_HPhHb28sQjc4v7jLJMAE09vO98IDkgUECAQYAZIFBAgFGASgBi6AB_DurKICqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEOmCKNIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi0zMDE3MjkxMTI5NDY0Njk3&sigh=qSYE56njiuQ&template_id=419
Frame ID: E28FCB5CD7C8CA84932E587FDD638F75
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 664488CAA62950AFFE777DC3E87EEC3C
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js
Frame ID: AB318B7AB78EB821C7E47DB3FC38E5B2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12
Frame ID: A7F7C79145B402AC8B17B7A4CBFA13E2
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html
Frame ID: 753BC357638EB04DA6F916272E7711AA
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=C-sL9hfP8YKj9JM2tgAfM2YqIC5mP4vdj8O-ZtZsOxru29rgDEAEg5c3MNWCVAqAB_9uKyAPIAQmoAwHIA0iqBNYBT9Akik0VFqdtD09kPKTTFUPJIqijJoQglm-C-lqRFEIfYbM6TSXy4WDDYZe5lykMs4WcxpTG6LF019ocdUZVulqLfkCEeGYXCZVl-TELkGWwTvkchWwKXv6q3oAVLr6ew0Xffe5d67_UgCW6fJyuHpAfc3hZr7j9z8-HpVPCt0BHKjwGADQPLV-ROrRX-LBAIdslL_34ZbbJ8a4S0ekKQSx4986Ji88BGEAHCkziyg44J9u31NddvHenq-O7kVYfCyLGEzRo24ww0tPdw3JwKryMa0kPYcAE09vO98IDkgUECAQYAZIFBAgFGASgBi6AB_DurKICqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEMrJHdIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi0zMDE3MjkxMTI5NDY0Njk3&sigh=2Bd50scni2M&template_id=419
Frame ID: ED60BC52F1748401835DB309627F4948
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js
Frame ID: EEE5759810DD712357EF4D48980D1787
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs
Frame ID: BD9158029DA69BE3E6F54D640228C551
Requests: 24 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 61B422A577C1942079ADFAA9DF9B67C4
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1
Frame ID: 5CA3A0CE931BE223626829755DA9E04A
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 231FCF1A49BF762BA68896FE4FE73494
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html
Frame ID: 454B252B633DA0EDB910BEEA964AC6DF
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 61454002737F76C675CF4A334F3B8093
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js
Frame ID: 979BB805A809C6F623B4367049813121
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html
Frame ID: 1FE5C870DF5949CCD7E9579E4326F2F9
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/adview?ai=CrMwhhvP8YL3xGoGW-gbagb7AD-Da3ORj8P-i54IO-cj93wUQASDlzcw1YJUCoAHS_O-KA8gBCakCNeHEoSzAsz6oAwHIA0iqBNYBT9AelkQ8mwb4kifcwD2rv48dm0lLjNl1Y3BNkJ9ltNWGUVThRvcp2nJpIpDLhFMqkiJkx90ynssMAqzkNx-J--cyERPcG2_RRIlrudkKvyegfePGhNFSx3UN0Qf7N2vlhnpgqXUXF_b7Y78xV7U0gg_WidlJCJlnISDJYWJk7OdjC8uKPM94vC7lsMCvJqqjJuOnvSYnRklqhG557KHywvxc3RB43g758Gx7z5Ax0f7yR4cYuoHY1y01VcfKdRPN672-MlS_Lag6EjQGugT66lOUBKOK28AEot-sn9ADkgUECAQYAZIFBAgFGASgBi6AB5aDkHWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQsOIF0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshcaChgIABIUcHViLTMwMTcyOTExMjk0NjQ2OTc&sigh=CMZpqBiOW90&template_id=419
Frame ID: C2CD5151962DDE3436223305D782D451
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: AEF18A5A3711012EE236BAA9951AE622
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: B25FD46BD9AC956F5DFFB755AEAB43C3
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: EFDA3E9468F081B67926CF326AF29EC9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://35express.org/ HTTP 301
https://35express.org/ HTTP 301
https://www.35express.org/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /react.*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]*href="[^"]+owl\.carousel(?:\.min)?\.css/i

Page Statistics

282
Requests

99 %
HTTPS

84 %
IPv6

16
Domains

20
Subdomains

20
IPs

4
Countries

5490 kB
Transfer

9602 kB
Size

2
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/102148735070472

Search URL Search Domain Scan URL

URL: https://twitter.com/35expressorg

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/35express/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCGKqQuKPjxnViMGJw9URC2g

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/35express/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://35express.org/ HTTP 301
https://35express.org/ HTTP 301
https://www.35express.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 174

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 232

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 247

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 255

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 275

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

282 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.35express.org/
Redirect Chain

http://35express.org/
https://35express.org/
https://www.35express.org/

202 KB
25 KB

710ms
690ms

Document
text/html

139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.35express.org/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

139.180.156.24.vultr.com

Software

nginx /

Resource Hash

85a665d8c7688717ecc822af5580eab71600f5bd5501ce506b09380b2d1d6471

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: www.35express.org
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

server: nginx
date: Sun, 25 Jul 2021 05:15:48 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
link: <https://www.35express.org/wp-json/>; rel="https://api.w.org/"
strict-transport-security: max-age=31536000
content-encoding: gzip

Redirect headers

server: nginx
date: Sun, 25 Jul 2021 05:15:47 GMT
content-type: text/html
content-length: 162
location: https://www.35express.org/
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff

GET
H2 200 style.min.css
www.35express.org/wp-includes/css/dist/block-library/ 57 KB
9 KB 217ms
214ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde

Request headers

:path: /wp-includes/css/dist/block-library/style.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Thu, 15 Apr 2021 14:36:39 GMT
server: nginx
etag: W/"60784f77-e33b"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 styles.css
www.35express.org/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 218ms
214ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.1
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 070edfef42e0980783d0acf8fa9ca6a9833b994eca13ffaa94e9a2deb47c92cf

Request headers

:path: /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.1
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 18 May 2021 09:14:43 GMT
server: nginx
etag: W/"60a38583-a50"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 kk-star-ratings.css
www.35express.org/wp-content/plugins/kk-star-ratings/public/css/ 3 KB
903 B 218ms
214ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/kk-star-ratings/public/css/kk-star-ratings.css?ver=4.2.0
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 70211e8296c52b3feb952e99accc2d44101ab3f2d8d20d912a3f544113af17ac

Request headers

:path: /wp-content/plugins/kk-star-ratings/public/css/kk-star-ratings.css?ver=4.2.0
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 11 May 2021 16:52:56 GMT
server: nginx
etag: W/"609ab668-ba4"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 style.min.css
www.35express.org/wp-content/plugins/easy-table-of-contents/vendor/icomoon/ 438 B
446 B 218ms
215ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a

Request headers

:path: /wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 30 Mar 2021 14:31:24 GMT
server: nginx
etag: W/"6063363c-1b6"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 screen.min.css
www.35express.org/wp-content/plugins/easy-table-of-contents/assets/css/ 5 KB
2 KB 219ms
215ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 22af5d3bf749542c2d95975186991b7b8c1e0766449c3fdeab55d57eb0d1ffdc

Request headers

:path: /wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 30 Mar 2021 14:31:24 GMT
server: nginx
etag: W/"6063363c-13ef"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 toastr.min.css
www.35express.org/wp-content/themes/zota_blog/libs/toastr/ 6 KB
3 KB 220ms
216ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/toastr/toastr.min.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 47dd690f8f315bea076e92581a7e7147443bb4c847e313ab5a7d50a8c44836d0

Request headers

:path: /wp-content/themes/zota_blog/libs/toastr/toastr.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:30 GMT
server: nginx
etag: W/"5f042fd6-1936"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 solid.css
www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/ 713 B
550 B 220ms
216ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/solid.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 776507af37e7093970722cbf5210af81bcb16dd025f958e7a3dc85d97657b410

Request headers

:path: /wp-content/themes/zota_blog/libs/font-awesome/css/solid.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:31 GMT
server: nginx
etag: W/"5f042fd7-2c9"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 regular.css
www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/ 719 B
551 B 220ms
216ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/regular.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b34914518abae35b58e1147f99c1525f58ae8fcc550efbfa0c0e47eaab7ba488

Request headers

:path: /wp-content/themes/zota_blog/libs/font-awesome/css/regular.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:31 GMT
server: nginx
etag: W/"5f042fd7-2cf"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 brands.css
www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/ 699 B
546 B 220ms
217ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/brands.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: ddf11d442e5dd8e654731c912a744f6e586d4a327bb46cebffda78d82470effb

Request headers

:path: /wp-content/themes/zota_blog/libs/font-awesome/css/brands.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:31 GMT
server: nginx
etag: W/"5f042fd7-2bb"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 fontawesome.css
www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/ 60 KB
10 KB 229ms
226ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/fontawesome.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 3afe80b8729301fa408af020233982d44fc86481e3bd1945bb940214e5dde1b4

Request headers

:path: /wp-content/themes/zota_blog/libs/font-awesome/css/fontawesome.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:31 GMT
server: nginx
etag: W/"5f042fd7-ee22"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 animate.css
www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/ 25 KB
3 KB 232ms
228ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/animate.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: cb09ab0572c6a6549a782e2843218c00285cb737ae50fe29a5061ca96aff0234

Request headers

:path: /wp-content/themes/zota_blog/libs/owlcarousel/animate.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:29 GMT
server: nginx
etag: W/"5f042fd5-6353"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 bootstrap.min.css
www.35express.org/wp-content/themes/zota_blog/libs/bootstrap/css/ 141 KB
20 KB 417ms
414ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/bootstrap/css/bootstrap.min.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: c4b6ed2645519ec2c128badb2a2e7720052f8441ffa94c4f0bceca02311004da

Request headers

:path: /wp-content/themes/zota_blog/libs/bootstrap/css/bootstrap.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:27 GMT
server: nginx
etag: W/"5f042fd3-235f3"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 owl.carousel.min.css
www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/ 3 KB
1 KB 419ms
416ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/owl.carousel.min.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: bba459209d2eb1d7f8f21dd8e91037f40bc6b407cd5f503185b3d478159cc574

Request headers

:path: /wp-content/themes/zota_blog/libs/owlcarousel/owl.carousel.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:28 GMT
server: nginx
etag: W/"5f042fd4-b48"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 owl.theme.default.min.css
www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/ 1 KB
737 B 419ms
416ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/owl.theme.default.min.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b07a2bd0c08e2363851192894ac79e426f1a53e37fd16ea3555b9585b864c485

Request headers

:path: /wp-content/themes/zota_blog/libs/owlcarousel/owl.theme.default.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:29 GMT
server: nginx
etag: W/"5f042fd5-464"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 jquery.fancybox.min.css
www.35express.org/wp-content/themes/zota_blog/libs/fancybox/ 10 KB
3 KB 419ms
416ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/fancybox/jquery.fancybox.min.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 52974e1f2c9fb2f17952ee8185bb18407775682348bf1848083163cf841b10da

Request headers

:path: /wp-content/themes/zota_blog/libs/fancybox/jquery.fancybox.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:30 GMT
server: nginx
etag: W/"5f042fd6-28b8"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 editor-style.css
www.35express.org/wp-content/themes/zota_blog/assets/css/ 4 KB
1 KB 419ms
416ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/css/editor-style.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 0857ce28c182d406d2e3b88e270ba4338a0347b2055becbade3d0c7396ed89ab

Request headers

:path: /wp-content/themes/zota_blog/assets/css/editor-style.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Mon, 21 Dec 2020 07:07:52 GMT
server: nginx
etag: W/"5fe049c8-f4f"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 style.css
www.35express.org/wp-content/themes/zota_blog/ 23 KB
5 KB 419ms
417ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/style.css?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: ea1fcf2e7040dfd8c82be3c52be92543261bb856e386e9ce178191a6f8658346

Request headers

:path: /wp-content/themes/zota_blog/style.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 10:07:06 GMT
server: nginx
etag: W/"5fabb7ca-5b83"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 style.min.css
www.35express.org/wp-content/plugins/wp-coupons-and-deals/assets/css/dist/ 64 KB
10 KB 422ms
419ms Stylesheet
text/css 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/wp-coupons-and-deals/assets/css/dist/style.min.css?ver=3.0.5
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 50c654f770aa2c7089bf1d590011861ae5aaa5dbabbd1d550f1a79989a87918a

Request headers

:path: /wp-content/plugins/wp-coupons-and-deals/assets/css/dist/style.min.css?ver=3.0.5
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 22 Jun 2021 09:11:18 GMT
server: nginx
etag: W/"60d1a936-1017d"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 jquery1.12.4.min.js Show response
www.35express.org/wp-content/themes/zota_blog/assets/js/ 95 KB
33 KB 425ms
423ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/js/jquery1.12.4.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe

Request headers

:path: /wp-content/themes/zota_blog/assets/js/jquery1.12.4.min.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:27 GMT
server: nginx
etag: W/"5f042fd3-17b90"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 myloadmore.js Show response
www.35express.org/wp-content/themes/zota_blog/assets/js/ 701 B
604 B 643ms
641ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/js/myloadmore.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 10232ad7723403bbb7aa0299d767d5e42d48b78eaefc3967ff082cf948799400

Request headers

:path: /wp-content/themes/zota_blog/assets/js/myloadmore.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Mon, 14 Oct 2019 06:34:05 GMT
server: nginx
etag: W/"5da416dd-2bd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 main.js Show response
www.35express.org/wp-content/plugins/wp-coupons-and-deals/assets/js/ 29 KB
6 KB 643ms
641ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/wp-coupons-and-deals/assets/js/main.js?ver=3.0.5
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: ce11c542168ce492d1b4ffdbe5bf3ee7026a1632fbf55d7675299b5074b56fec

Request headers

:path: /wp-content/plugins/wp-coupons-and-deals/assets/js/main.js?ver=3.0.5
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 22 Jun 2021 09:11:18 GMT
server: nginx
etag: W/"60d1a936-755c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 clipboard.min.js Show response
www.35express.org/wp-content/plugins/wp-coupons-and-deals/assets/js/ 11 KB
4 KB 643ms
641ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/wp-coupons-and-deals/assets/js/clipboard.min.js?ver=3.0.5
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 608b2266e3174718567f6dc3be4cb8bd503c9f1109136a8e4c49ffa227dc4e4c

Request headers

:path: /wp-content/plugins/wp-coupons-and-deals/assets/js/clipboard.min.js?ver=3.0.5
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:48 GMT
content-encoding: gzip
last-modified: Tue, 22 Jun 2021 09:11:18 GMT
server: nginx
etag: W/"60d1a936-2aa7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:48 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 136 KB
48 KB 24ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f16a935d459a3bf85554bc55742924f23066053190a78a54904b6bf3e8a0140e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49260
x-xss-protection: 0
server: cafe
etag: 17688924842044148777
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 25 Jul 2021 05:15:49 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 35ms
32ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-186463932-1

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6fab3ea4a64f8ef2b25500617e97d8e53fea4eadd42ab069de7d9a6db12b1c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39981
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 25 Jul 2021 05:15:49 GMT

GET
H2 200 35express-logo.png
www.35express.org/wp-content/uploads/2020/11/ 29 KB
29 KB 370ms
369ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/35express-logo.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 719b12b486c9f39345e5b3f4caf76c3545cb95f89083eb9d120a116bc6dae31a

Request headers

:path: /wp-content/uploads/2020/11/35express-logo.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Wed, 11 Nov 2020 09:40:10 GMT
server: nginx
etag: "5fabb17a-7405"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 29701
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 blog-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 367ms
366ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/blog-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: aa3fe744fb47d28b1d99ee7b3182c862bc8cfb66b1af622308be5f1ed813f8f4

Request headers

:path: /wp-content/uploads/2020/11/blog-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:18:58 GMT
server: nginx
etag: "5fbb7072-71b"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 1819
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 game-icon.png
www.35express.org/wp-content/uploads/2020/11/ 3 KB
3 KB 547ms
546ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/game-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 96f70be8a41e7a91e9a0338f8c097f954aed84c48a9a1ca7260d0b41d5060e87

Request headers

:path: /wp-content/uploads/2020/11/game-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:15:33 GMT
server: nginx
etag: "5fbb6fa5-a2d"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2605
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 wiki-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 368ms
367ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/wiki-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: c5081e9c65415a1a3cdde2562c6a522dfdbdb063d23e218395039495f12f6eaf

Request headers

:path: /wp-content/uploads/2020/11/wiki-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:17:02 GMT
server: nginx
etag: "5fbb6ffe-803"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2051
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 tech-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 545ms
544ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/tech-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 35705a8c4f27600c1d9d9fe139c4ead072911e424cb6668b884379ac30ed65fc

Request headers

:path: /wp-content/uploads/2020/11/tech-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:18:12 GMT
server: nginx
etag: "5fbb7044-8f0"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2288
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 giai-tri-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 546ms
545ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/giai-tri-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b364cf5989c8f1cb905d272fb595a5c9a019370c874eec977897831158b9bd14

Request headers

:path: /wp-content/uploads/2020/11/giai-tri-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:19:54 GMT
server: nginx
etag: "5fbb70aa-7ac"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 1964
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 kien-thuc-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 547ms
546ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/kien-thuc-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: d495d21bc4d100ed95ddf5a91cd1c06cbdf3cbcaef991ccecd7d4eb18d02e809

Request headers

:path: /wp-content/uploads/2020/11/kien-thuc-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:20:40 GMT
server: nginx
etag: "5fbb70d8-8e9"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2281
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 thu-thuat-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
3 KB 217ms
214ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/thu-thuat-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 905bd605d1e44330dba4e64ec729cf1cc4679eebc4560e069e1fca6e41430768

Request headers

:path: /wp-content/uploads/2020/11/thu-thuat-icon.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Mon, 23 Nov 2020 08:27:46 GMT
server: nginx
etag: "5fbb7282-933"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2355
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 lam-dep-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 546ms
545ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/lam-dep-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 9afba6521efd9dec8788781d4493284b3e6e2dbbe95b6e6a227cb6cf01c50f14

Request headers

:path: /wp-content/uploads/2020/11/lam-dep-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:21:27 GMT
server: nginx
etag: "5fbb7107-79d"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 1949
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 phong-thuy-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 368ms
367ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/phong-thuy-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 312b9f5c61ad571fd892cb0391cbc4c27470488214490baf12d53af27ed8f1b6

Request headers

:path: /wp-content/uploads/2020/11/phong-thuy-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:22:39 GMT
server: nginx
etag: "5fbb714f-918"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2328
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 review-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 369ms
368ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/review-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 2a67286c7403309647cbc15efdbb85d179c541847aa5871da1b496ba20bdeb76

Request headers

:path: /wp-content/uploads/2020/11/review-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:23:50 GMT
server: nginx
etag: "5fbb7196-8e0"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2272
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 suc-khoe-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 547ms
545ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/suc-khoe-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 74200d8d4f78ec5dc0c272eeb36f3d5f4dc94a4a487e856ba0fbe610dfaa4b74

Request headers

:path: /wp-content/uploads/2020/11/suc-khoe-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:24:55 GMT
server: nginx
etag: "5fbb71d7-861"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2145
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 the-thao-icon.png
www.35express.org/wp-content/uploads/2020/11/ 2 KB
2 KB 368ms
367ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/the-thao-icon.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 1a0ea3ba48ef5ada4382b501746b9d9bc263b78e8d6f3527d76de9d97bbdfa37

Request headers

:path: /wp-content/uploads/2020/11/the-thao-icon.png
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 23 Nov 2020 08:26:33 GMT
server: nginx
etag: "5fbb7239-884"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 2180
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.35express.org/wp-includes/js/ 14 KB
5 KB 216ms
214ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Sun, 07 Mar 2021 14:55:05 GMT
server: nginx
etag: W/"6044e949-3795"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 logo-35express-footer.png
www.35express.org/wp-content/uploads/2020/11/ 29 KB
29 KB 216ms
215ms Image
image/png 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/11/logo-35express-footer.png
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 4b42b2888201c095a3f32e35add60d8862b2f6320922eda030f4ad928bff77cb

Request headers

:path: /wp-content/uploads/2020/11/logo-35express-footer.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Wed, 11 Nov 2020 09:41:55 GMT
server: nginx
etag: "5fabb1e3-73d6"
content-type: image/png
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 29654
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 wp-polyfill.min.js Show response
www.35express.org/wp-includes/js/dist/vendor/ 97 KB
34 KB 216ms
215ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3

Request headers

:path: /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 09:04:45 GMT
server: nginx
etag: W/"5f5de0ad-183ee"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 index.js Show response
www.35express.org/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 217ms
217ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 927d5436967ebce8a52c4bdcd27cc056c910a72270f74990dfbd1d554840c12d

Request headers

:path: /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Tue, 18 May 2021 09:14:43 GMT
server: nginx
etag: W/"60a38583-34ad"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 kk-star-ratings.js Show response
www.35express.org/wp-content/plugins/kk-star-ratings/public/js/ 2 KB
879 B 217ms
212ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/plugins/kk-star-ratings/public/js/kk-star-ratings.js?ver=4.2.0
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b8c0ce32234af999076b48518b249d477718550593a782e170f159477e8b4265

Request headers

:path: /wp-content/plugins/kk-star-ratings/public/js/kk-star-ratings.js?ver=4.2.0
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Tue, 11 May 2021 16:52:56 GMT
server: nginx
etag: W/"609ab668-77f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 toastr.min.js Show response
www.35express.org/wp-content/themes/zota_blog/libs/toastr/ 5 KB
2 KB 217ms
213ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/toastr/toastr.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 8abbc21521ab2927b47b6578c0c36d85801644919a9bf2b750c337216313bb66

Request headers

:path: /wp-content/themes/zota_blog/libs/toastr/toastr.min.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:30 GMT
server: nginx
etag: W/"5f042fd6-1461"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 commerce.js Show response
www.35express.org/wp-content/themes/zota_blog/inc/commerce/js/ 4 KB
1 KB 217ms
213ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/inc/commerce/js/commerce.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: f95b3d6693589b312ddb5f07077356084260464af0163acc96319aab5d4f7e8a

Request headers

:path: /wp-content/themes/zota_blog/inc/commerce/js/commerce.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:33 GMT
server: nginx
etag: W/"5f042fd9-1107"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 bootstrap.min.js Show response
www.35express.org/wp-content/themes/zota_blog/libs/bootstrap/js/ 48 KB
13 KB 218ms
214ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/bootstrap/js/bootstrap.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b00834c17c50af103e353ef86a69d90bbcaa819ed92b4d6ed670a425514e3c3a

Request headers

:path: /wp-content/themes/zota_blog/libs/bootstrap/js/bootstrap.min.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:28 GMT
server: nginx
etag: W/"5f042fd4-bf36"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 owl.carousel.min.js Show response
www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/ 42 KB
11 KB 910ms
909ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/owlcarousel/owl.carousel.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b5757aa153f991c82c949e638c56b4913042196240f3a41cec5a40c3366d1bdd

Request headers

:path: /wp-content/themes/zota_blog/libs/owlcarousel/owl.carousel.min.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06; _ga=GA1.2.1259153762.1627190150; _gid=GA1.2.713580532.1627190150; _gat_gtag_UA_186463932_1=1
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:29 GMT
server: nginx
etag: W/"5f042fd5-a714"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 jquery.dcjqaccordion.2.7.min.js Show response
www.35express.org/wp-content/themes/zota_blog/assets/js/ 7 KB
2 KB 611ms
611ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/js/jquery.dcjqaccordion.2.7.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 3eacc6ed8697fe8437bdcb638b639f336b161865425c43f8e9017f286add77e1

Request headers

:path: /wp-content/themes/zota_blog/assets/js/jquery.dcjqaccordion.2.7.min.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:27 GMT
server: nginx
etag: W/"5f042fd3-1cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 jquery.fancybox.min.js Show response
www.35express.org/wp-content/themes/zota_blog/libs/fancybox/ 44 KB
15 KB 414ms
413ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/libs/fancybox/jquery.fancybox.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: e511216e709c35b8ce12479ebc9300f8e724f37320b25370eced2f3162d401a2

Request headers

:path: /wp-content/themes/zota_blog/libs/fancybox/jquery.fancybox.min.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:30 GMT
server: nginx
etag: W/"5f042fd6-b1c7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 jquery.cookie.js Show response
www.35express.org/wp-content/themes/zota_blog/assets/js/ 4 KB
2 KB 413ms
412ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/js/jquery.cookie.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 0c779ae95a8b1f10dcec474f7d89e001dfc1d27816dfe9e92542efdee4c6dc76

Request headers

:path: /wp-content/themes/zota_blog/assets/js/jquery.cookie.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:27 GMT
server: nginx
etag: W/"5f042fd3-10f5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 stickyMojo.js Show response
www.35express.org/wp-content/themes/zota_blog/assets/js/ 5 KB
2 KB 228ms
228ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/js/stickyMojo.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 892665c4ba08ff7b41d21672b31f00b4cecbaa485c0ee33cbcfd15cd5e83319e

Request headers

:path: /wp-content/themes/zota_blog/assets/js/stickyMojo.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Tue, 07 Jul 2020 08:18:27 GMT
server: nginx
etag: W/"5f042fd3-12f9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 custom.js Show response
www.35express.org/wp-content/themes/zota_blog/assets/js/ 7 KB
2 KB 398ms
397ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-content/themes/zota_blog/assets/js/custom.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: cf7171f0264b88fef3747c1cad5d65cbb14f7e88eb97f67c6c67929c91c3fdce

Request headers

:path: /wp-content/themes/zota_blog/assets/js/custom.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Tue, 20 Oct 2020 13:13:56 GMT
server: nginx
etag: W/"5f8ee294-1b43"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 wp-embed.min.js Show response
www.35express.org/wp-includes/js/ 1 KB
1013 B 216ms
213ms Script
application/javascript 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.35express.org/wp-includes/js/wp-embed.min.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.7.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
content-encoding: gzip
last-modified: Sun, 07 Mar 2021 14:55:05 GMT
server: nginx
etag: W/"6044e949-592"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 30ms
14ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.7.2
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ca739a13d804ea8806c9878d5b463d2a2c2a75b61a1b2f8a8e104e9b0daecb5

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 1416
etag: W/"96fc99e13be87550fcfc4474d30d43d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6742e9a1ce69176e-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Wed, 28 Jul 2021 05:15:49 GMT

GET
H2 200 sdk.js Show response
menu.metu.vn/static/js/ 1 KB
1 KB 38ms
12ms Script
application/javascript 2606:4700:3036::ac43:dcbd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://menu.metu.vn/static/js/sdk.js?container=body
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dcbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f06cbdca806bc6faf9a484f72ccecb9e3a99496eba276e48a714beaea2be248b

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: br
etag: W/"49b-umrJyvtKgMskCi5QYxVc32ONk3I"
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 486
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xs8hty2I1ICzPrQnRG%2BOG032%2B%2B8zrL5uBVptoE9QJXOPln5ylj93iD3IQOZpGVhbXHX8PHRxJCDUWkKGibZRXVn6p0GzXQBPKlKX2wz9r6qMUKsh%2F%2B%2BCBmPLEZviwmJgy8rD%2F6l9OoTjZhk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cf-ray: 6742e9a208bc0605-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H/1.1 200
OK v1.js Show response
api.trackpush.com/sdk/native/ 15 KB
8 KB 1095ms
527ms Script
text/javascript 157.230.253.19
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://api.trackpush.com/sdk/native/v1.js?pid=%2BB2FmBEYYxgxIJy%2FKLl19A%3D%3D&class=_80da05bc4c

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

157.230.253.19 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d1b3c56c7f552cd4e1ce9d214be42e8d05a43e53054e65ecc689ed9140e363ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 25 Jul 2021 05:15:50 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: text/javascript
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Expires: 0

GET
H2 200 fa-solid-900.woff2
www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/webfonts/ 61 KB
61 KB 209ms
209ms Font
font/woff2 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/webfonts/fa-solid-900.woff2

Requested by

Host: www.35express.org
URL: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/solid.css?ver=5.7.2

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

139.180.156.24.vultr.com

Software

nginx /

Resource Hash

5c7df99df232586111917083a85aa31b82ee29e48ca2990e13fae0c0663a923f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-fetch-mode: cors
origin: https://www.35express.org
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
:path: /wp-content/themes/zota_blog/libs/font-awesome/webfonts/fa-solid-900.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.35express.org
referer: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/solid.css?ver=5.7.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.35express.org
Referer: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/solid.css?ver=5.7.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Tue, 07 Jul 2020 08:18:32 GMT
server: nginx
etag: "5f042fd8-f408"
strict-transport-security: max-age=31536000
content-type: font/woff2
accept-ranges: bytes
content-length: 62472

GET
H2 200 review-du-an-indochina-riverside-complex-co-nen-dau-tu-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 99 KB
100 KB 1108ms
1106ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/review-du-an-indochina-riverside-complex-co-nen-dau-tu-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: cd956b1fe1fdb2064dcdd958d0c63581e2a899bd826fe5eb372ff5c11385383f

Request headers

:path: /wp-content/uploads/2021/07/review-du-an-indochina-riverside-complex-co-nen-dau-tu-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 05:38:16 GMT
server: nginx
etag: "60fba748-18ce8"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 101608
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 loi-bai-hat-hoang-hoa-ky-long-non-la-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 60 KB
60 KB 1116ms
1114ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/loi-bai-hat-hoang-hoa-ky-long-non-la-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 314d1480d881ee9f99bd0e9acfc27a338a28e35efe38ac346936ad698dbcbc5f

Request headers

:path: /wp-content/uploads/2021/07/loi-bai-hat-hoang-hoa-ky-long-non-la-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 03:40:45 GMT
server: nginx
etag: "60fb8bbd-ee3a"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 60986
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 loi-bai-hat-sao-ta-nguoc-loi-dinh-dung-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 63 KB
64 KB 1117ms
1115ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/loi-bai-hat-sao-ta-nguoc-loi-dinh-dung-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: a7c28020cc614373f347d1642686b35b7f2d52eeccaf7fc1280e5096947151b8

Request headers

:path: /wp-content/uploads/2021/07/loi-bai-hat-sao-ta-nguoc-loi-dinh-dung-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 03:30:47 GMT
server: nginx
etag: "60fb8967-fdbf"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 64959
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET ke-phat-tan-kho-anh-nong-loat-streamer-doi-mat-an-phat-nao-3-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 0
0

GET
H2 200 tai-gta-5-download-grand-theft-auto-v-game-hanh-dong-35express-1.jpg
www.35express.org/wp-content/uploads/2021/07/ 138 KB
138 KB 525ms
524ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/tai-gta-5-download-grand-theft-auto-v-game-hanh-dong-35express-1.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 5760b0a40e4c7e3aeb440abf5277b546e2af0658fc5bc6659bfb80d6b4711004

Request headers

:path: /wp-content/uploads/2021/07/tai-gta-5-download-grand-theft-auto-v-game-hanh-dong-35express-1.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 12 Jul 2021 07:26:20 GMT
server: nginx
etag: "60ebee9c-2261a"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 140826
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 top-10-website-ghep-nhac-vao-video-online-mien-phi-768x432.jpg
www.35express.org/wp-content/uploads/2021/05/ 69 KB
69 KB 1116ms
1115ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/top-10-website-ghep-nhac-vao-video-online-mien-phi-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 7203265bf1dddb821475201ac0fc73aa5f62876628dab951ef5da08b74b8368e

Request headers

:path: /wp-content/uploads/2021/05/top-10-website-ghep-nhac-vao-video-online-mien-phi-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Wed, 19 May 2021 07:53:41 GMT
server: nginx
etag: "60a4c405-11371"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 70513
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 top-7-phan-mem-gia-lap-android-tot-nhat-2021-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 62 KB
62 KB 1117ms
1116ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-7-phan-mem-gia-lap-android-tot-nhat-2021-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b7140a30d39d6e04f4adfcd55e4293d6dc02b0f0ce7408c2ed1a012a181425ac

Request headers

:path: /wp-content/uploads/2021/06/top-7-phan-mem-gia-lap-android-tot-nhat-2021-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Tue, 01 Jun 2021 02:54:13 GMT
server: nginx
etag: "60b5a155-f7f1"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 63473
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 photoshop-online-768x432.jpg
www.35express.org/wp-content/uploads/2020/06/ 32 KB
32 KB 1116ms
1115ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/06/photoshop-online-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b7cd883aaa04194a62e6a24024e7cbc62050554abf2e600b9baa62fa347d0342

Request headers

:path: /wp-content/uploads/2020/06/photoshop-online-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Tue, 01 Dec 2020 08:27:58 GMT
server: nginx
etag: "5fc5fe8e-7f8b"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 32651
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 top-6-dich-vu-cloud-vps-gia-re-768x432.jpg
www.35express.org/wp-content/uploads/2020/03/ 52 KB
52 KB 1117ms
1116ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/03/top-6-dich-vu-cloud-vps-gia-re-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 7f69eadb4759b03fe0f99070f06b4811311a56c200f99cd0708edbb833be353e

Request headers

:path: /wp-content/uploads/2020/03/top-6-dich-vu-cloud-vps-gia-re-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Wed, 02 Dec 2020 07:43:28 GMT
server: nginx
etag: "5fc745a0-ceca"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 52938
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 ke-phat-tan-kho-anh-nong-loat-streamer-doi-mat-an-phat-nao-3-35express.jpg
www.35express.org/wp-content/uploads/2021/07/ 87 KB
87 KB 718ms
717ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/ke-phat-tan-kho-anh-nong-loat-streamer-doi-mat-an-phat-nao-3-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 8db06315fa87e02b4ab308b7651a13f9b3b6c1ba0693b798add33c6a3399aefc

Request headers

:path: /wp-content/uploads/2021/07/ke-phat-tan-kho-anh-nong-loat-streamer-doi-mat-an-phat-nao-3-35express.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 02:59:40 GMT
server: nginx
etag: "60fb821c-15c72"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 89202
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 ekip-phia-sau-nhung-man-livestream-boc-phot-cua-ba-phuong-hang-0-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/05/ 62 KB
62 KB 1117ms
1116ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/ekip-phia-sau-nhung-man-livestream-boc-phot-cua-ba-phuong-hang-0-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 9a45f5cb86b17127523c133e17b0edb7cb6c3a266fb8d114885744a507a6c008

Request headers

:path: /wp-content/uploads/2021/05/ekip-phia-sau-nhung-man-livestream-boc-phot-cua-ba-phuong-hang-0-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Tue, 25 May 2021 13:06:44 GMT
server: nginx
etag: "60acf664-f669"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 63081
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 khanh-van-chinh-thuc-dung-chan-tai-top-21-miss-universe-2020-2-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/05/ 44 KB
44 KB 913ms
912ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/khanh-van-chinh-thuc-dung-chan-tai-top-21-miss-universe-2020-2-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 9498e12514c0b38bd754ad3326ef8c6ac83be8a9d2f29dba5cb340068fbece99

Request headers

:path: /wp-content/uploads/2021/05/khanh-van-chinh-thuc-dung-chan-tai-top-21-miss-universe-2020-2-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Mon, 17 May 2021 02:19:42 GMT
server: nginx
etag: "60a1d2be-afe8"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 45032
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 sau-cong-phuong-den-luot-xuan-truong-tuyen-bo-se-chuan-bi-dam-cuoi-0-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/04/ 52 KB
52 KB 1117ms
1116ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/04/sau-cong-phuong-den-luot-xuan-truong-tuyen-bo-se-chuan-bi-dam-cuoi-0-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 578b1a1ab346e8053c9b8d597c5232fada224cf813d462cd70ce0e0d0131c527

Request headers

:path: /wp-content/uploads/2021/04/sau-cong-phuong-den-luot-xuan-truong-tuyen-bo-se-chuan-bi-dam-cuoi-0-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Tue, 06 Apr 2021 08:01:27 GMT
server: nginx
etag: "606c1557-ce72"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 52850
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 cong-ty-xay-dung-nha-cho-thuy-tien-nhan-hang-loat-danh-gia-xau-tu-cdm-0-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 76 KB
76 KB 1116ms
1115ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/cong-ty-xay-dung-nha-cho-thuy-tien-nhan-hang-loat-danh-gia-xau-tu-cdm-0-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 5b85a6520191159435eda669fdeee77444eb59a885e95b64b330ddddd52dccea

Request headers

:path: /wp-content/uploads/2021/06/cong-ty-xay-dung-nha-cho-thuy-tien-nhan-hang-loat-danh-gia-xau-tu-cdm-0-35express-768x432.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Thu, 17 Jun 2021 01:23:54 GMT
server: nginx
etag: "60caa42a-12e14"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 77332
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 chay-di-cho-chi-la-gi-1-35express.jpg
www.35express.org/wp-content/uploads/2021/05/ 93 KB
93 KB 211ms
211ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/chay-di-cho-chi-la-gi-1-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 7e7b0f75251a9768444ee150256c11c0afdaf8cb7ff1c407124ffc2ff364e569

Request headers

:path: /wp-content/uploads/2021/05/chay-di-cho-chi-la-gi-1-35express.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Fri, 07 May 2021 02:07:01 GMT
server: nginx
etag: "6094a0c5-17350"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 95056
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 bach-hop-la-gi-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/05/ 55 KB
55 KB 205ms
204ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/bach-hop-la-gi-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: deb99d2e55ae5645b1a4e9568536623aeba5bd8a8b1e31a8b542fbee5022abfe

Request headers

:path: /wp-content/uploads/2021/05/bach-hop-la-gi-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Wed, 26 May 2021 07:31:42 GMT
server: nginx
etag: "60adf95e-db4d"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 56141
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 con-gai-minh-nhua-21-tuoi-nhu-em-sao-co-the-tu-mua-porsche-911-0-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/03/ 52 KB
52 KB 204ms
203ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/03/con-gai-minh-nhua-21-tuoi-nhu-em-sao-co-the-tu-mua-porsche-911-0-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 1c6863381aad621f26a0c52404c391314acd0f95b745c8ff125181711dd9782e

Request headers

:path: /wp-content/uploads/2021/03/con-gai-minh-nhua-21-tuoi-nhu-em-sao-co-the-tu-mua-porsche-911-0-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Wed, 10 Mar 2021 03:45:11 GMT
server: nginx
etag: "604840c7-d0a9"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 53417
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 ban-mashup-cua-van-mai-huong-va-hoa-minzy-gay-bao-mxh-lam-le-top-1-trending-nhung-ai-nhinh-hon-ai-5-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/03/ 47 KB
47 KB 208ms
207ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/03/ban-mashup-cua-van-mai-huong-va-hoa-minzy-gay-bao-mxh-lam-le-top-1-trending-nhung-ai-nhinh-hon-ai-5-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 204d5c862d44127428ab4cc5f27ee51c8e5878998c534c5a15f4d02baaa0c982

Request headers

:path: /wp-content/uploads/2021/03/ban-mashup-cua-van-mai-huong-va-hoa-minzy-gay-bao-mxh-lam-le-top-1-trending-nhung-ai-nhinh-hon-ai-5-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Wed, 10 Mar 2021 02:43:18 GMT
server: nginx
etag: "60483246-bca2"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 48290
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 lich-nghi-tet-nguyen-dan-tan-suu-2021-cua-hoc-sinh-63-tinh-thanh-768x432.jpg
www.35express.org/wp-content/uploads/2021/01/ 56 KB
56 KB 370ms
369ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/01/lich-nghi-tet-nguyen-dan-tan-suu-2021-cua-hoc-sinh-63-tinh-thanh-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: cd1b08e3b1008ec5b6e23644fa1c02b274a033e74a607cf7335aab4f38be4d9b

Request headers

:path: /wp-content/uploads/2021/01/lich-nghi-tet-nguyen-dan-tan-suu-2021-cua-hoc-sinh-63-tinh-thanh-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Thu, 07 Jan 2021 09:47:44 GMT
server: nginx
etag: "5ff6d8c0-de54"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 56916
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 ha-noi-toi-nay-may-gio-ban-phao-o-dau-768x432.jpg
www.35express.org/wp-content/uploads/2020/12/ 54 KB
54 KB 373ms
372ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/12/ha-noi-toi-nay-may-gio-ban-phao-o-dau-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 1126b83561c4313b0365ad8c062bf4649e8a55f77a6e67f686ee6936d9560b0a

Request headers

:path: /wp-content/uploads/2020/12/ha-noi-toi-nay-may-gio-ban-phao-o-dau-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:52 GMT
last-modified: Thu, 31 Dec 2020 15:29:45 GMT
server: nginx
etag: "5fedee69-d846"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 55366
expires: Tue, 24 Aug 2021 05:15:52 GMT

GET
H2 200 review-du-an-indochina-riverside-complex-co-nen-dau-tu-35express.jpg
www.35express.org/wp-content/uploads/2021/07/ 131 KB
131 KB 1116ms
1115ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/review-du-an-indochina-riverside-complex-co-nen-dau-tu-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 254bc6f633c06fe6077256191c4a595988ac69a2b6d235e93b561fdb1c68e3a3

Request headers

:path: /wp-content/uploads/2021/07/review-du-an-indochina-riverside-complex-co-nen-dau-tu-35express.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 05:38:16 GMT
server: nginx
etag: "60fba748-20bd7"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 134103
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 tai-sao-giai-quyet-viec-lam-dang-la-van-de-xa-hoi-gay-gat-o-nuoc-ta-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 71 KB
72 KB 379ms
378ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/tai-sao-giai-quyet-viec-lam-dang-la-van-de-xa-hoi-gay-gat-o-nuoc-ta-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 3e7a966f00c8a8a2e4e17fe2483d16c146625704f26a085b58f4bc75cb942ff9

Request headers

:path: /wp-content/uploads/2021/07/tai-sao-giai-quyet-viec-lam-dang-la-van-de-xa-hoi-gay-gat-o-nuoc-ta-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Fri, 16 Jul 2021 09:20:10 GMT
server: nginx
etag: "60f14f4a-11d80"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 73088
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 tai-sao-khong-khi-nong-lai-nhe-hon-khong-khi-lanh-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 30 KB
30 KB 382ms
382ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/tai-sao-khong-khi-nong-lai-nhe-hon-khong-khi-lanh-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: b0db33ffd7e79416a2a26305c56ba8069fce67bc72f4b8eeeda02eb87d7da506

Request headers

:path: /wp-content/uploads/2021/07/tai-sao-khong-khi-nong-lai-nhe-hon-khong-khi-lanh-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Fri, 23 Jul 2021 09:40:52 GMT
server: nginx
etag: "60fa8ea4-78af"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 30895
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 tai-sao-khong-nen-doc-sach-o-noi-thieu-anh-sang-tren-tau-xe-bi-xoc-nhieu-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 39 KB
39 KB 382ms
381ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/tai-sao-khong-nen-doc-sach-o-noi-thieu-anh-sang-tren-tau-xe-bi-xoc-nhieu-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: db6686d4db6ec8f49f7a31a5b42f1ca193c05533426380d9505089d67f6787d0

Request headers

:path: /wp-content/uploads/2021/07/tai-sao-khong-nen-doc-sach-o-noi-thieu-anh-sang-tren-tau-xe-bi-xoc-nhieu-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Fri, 23 Jul 2021 08:58:22 GMT
server: nginx
etag: "60fa84ae-9add"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 39645
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 hemp-la-gi-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/05/ 88 KB
89 KB 390ms
390ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/hemp-la-gi-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: faebcdbf65e220945ac2efd3cb7cb2318fd0cf884f3c794884e3a0e65de32fb9

Request headers

:path: /wp-content/uploads/2021/05/hemp-la-gi-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Tue, 25 May 2021 03:01:01 GMT
server: nginx
etag: "60ac686d-1617a"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 90490
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 1000-cach-dat-biet-danh-cho-nguoi-yeu-cuc-thu-vi-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/05/ 61 KB
62 KB 396ms
396ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/1000-cach-dat-biet-danh-cho-nguoi-yeu-cuc-thu-vi-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 3a51d51c183a0030a6e6ef209b0d84a720eca480bcdc10e17f2f693f465cfd57

Request headers

:path: /wp-content/uploads/2021/05/1000-cach-dat-biet-danh-cho-nguoi-yeu-cuc-thu-vi-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Tue, 01 Jun 2021 03:02:03 GMT
server: nginx
etag: "60b5a32b-f556"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 62806
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 loi-bai-hat-hoang-hoa-ky-long-non-la-35express.jpg
www.35express.org/wp-content/uploads/2021/07/ 93 KB
93 KB 1065ms
1065ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/loi-bai-hat-hoang-hoa-ky-long-non-la-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 7c4a5a83cf4db1f08ec521e1ff1f07a7ae58cbf6d6a076c2da20e2c4f99e5779

Request headers

:path: /wp-content/uploads/2021/07/loi-bai-hat-hoang-hoa-ky-long-non-la-35express.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 03:40:45 GMT
server: nginx
etag: "60fb8bbd-17389"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 95113
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 loi-bai-hat-sao-ta-nguoc-loi-dinh-dung-35express.jpg
www.35express.org/wp-content/uploads/2021/07/ 93 KB
93 KB 1065ms
1065ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/loi-bai-hat-sao-ta-nguoc-loi-dinh-dung-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: c22d5e7960949ce5282dff0c8b09dca227ef42d92c862eecee77b925dfdef157

Request headers

:path: /wp-content/uploads/2021/07/loi-bai-hat-sao-ta-nguoc-loi-dinh-dung-35express.jpg
pragma: no-cache
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Sat, 24 Jul 2021 03:30:47 GMT
server: nginx
etag: "60fb8967-17331"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 95025
expires: Tue, 24 Aug 2021 05:15:49 GMT

GET
H2 200 nuoc-dau-den-cong-dung-tuyet-voi-cach-chon-rang-tai-nha-35express.jpg
www.35express.org/wp-content/uploads/2021/05/ 96 KB
97 KB 565ms
565ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/05/nuoc-dau-den-cong-dung-tuyet-voi-cach-chon-rang-tai-nha-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 3618716f55706a405602bae7d865ede3f94f996af8ad2cb1a46a1ad12214b637

Request headers

:path: /wp-content/uploads/2021/05/nuoc-dau-den-cong-dung-tuyet-voi-cach-chon-rang-tai-nha-35express.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Wed, 05 May 2021 01:43:31 GMT
server: nginx
etag: "6091f843-181c7"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 98759
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 chi-so-triglyceride-la-gi-1-768x432.jpg
www.35express.org/wp-content/uploads/2019/12/ 51 KB
52 KB 402ms
402ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2019/12/chi-so-triglyceride-la-gi-1-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: fb4ad401669d7f09714262088d3ad6fdd5a67ec95f8d921f94fa751915e76253

Request headers

:path: /wp-content/uploads/2019/12/chi-so-triglyceride-la-gi-1-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Wed, 25 Nov 2020 03:49:00 GMT
server: nginx
etag: "5fbdd42c-cd1c"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 52508
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 nhin-tieu-lau-co-hai-nhu-the-nao-768x432.jpg
www.35express.org/wp-content/uploads/2019/12/ 27 KB
28 KB 403ms
403ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2019/12/nhin-tieu-lau-co-hai-nhu-the-nao-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: bbdcb192b10b0f48ada67d79a504bb8c1341645584612b44560f647aa57b440f

Request headers

:path: /wp-content/uploads/2019/12/nhin-tieu-lau-co-hai-nhu-the-nao-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Tue, 01 Dec 2020 07:17:44 GMT
server: nginx
etag: "5fc5ee18-6df8"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 28152
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 cong-nghe-vi-sinh-la-gi-768x432.jpg
www.35express.org/wp-content/uploads/2019/12/ 45 KB
45 KB 568ms
566ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2019/12/cong-nghe-vi-sinh-la-gi-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: beec618936d8f6a0cc9da57125553c71d3f212cc4c3c1028979d5523f3380fbd

Request headers

:path: /wp-content/uploads/2019/12/cong-nghe-vi-sinh-la-gi-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Tue, 24 Nov 2020 02:44:45 GMT
server: nginx
etag: "5fbc739d-b3a2"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 45986
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 hat-sachi-co-tac-dung-gi-768x432.jpg
www.35express.org/wp-content/uploads/2020/03/ 50 KB
50 KB 395ms
394ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/03/hat-sachi-co-tac-dung-gi-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 85663dccf5900fa4c9e54364909dd6d67fbe2c03cc3a19215ce307169b89d67e

Request headers

:path: /wp-content/uploads/2020/03/hat-sachi-co-tac-dung-gi-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Wed, 02 Dec 2020 01:45:03 GMT
server: nginx
etag: "5fc6f19f-c84f"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 51279
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 sap-vuot-toc-danh-cho-nam.jpg
www.35express.org/wp-content/uploads/2021/02/ 88 KB
89 KB 395ms
395ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/02/sap-vuot-toc-danh-cho-nam.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: d1919f983459281ec9d56b30b9f43d12203cbe7197a75f2b4ccc42f9d8b3e29d

Request headers

:path: /wp-content/uploads/2021/02/sap-vuot-toc-danh-cho-nam.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Thu, 20 May 2021 02:21:21 GMT
server: nginx
etag: "60a5c7a1-160c4"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 90308
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 top-nhung-mau-toc-nam-ngan-dep-nhat-10-768x432.jpg
www.35express.org/wp-content/uploads/2020/03/ 34 KB
34 KB 397ms
396ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/03/top-nhung-mau-toc-nam-ngan-dep-nhat-10-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 2d88687758a5d3a385c77fe877ac3e49c7247f8cb845d70dfe6cedbc8ee1c5ca

Request headers

:path: /wp-content/uploads/2020/03/top-nhung-mau-toc-nam-ngan-dep-nhat-10-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Tue, 01 Dec 2020 07:40:19 GMT
server: nginx
etag: "5fc5f363-86ee"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 34542
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 co-nen-su-dung-mat-na-trang-da-tri-mun-hay-khong-768x432.jpg
www.35express.org/wp-content/uploads/2020/02/ 23 KB
23 KB 396ms
396ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/02/co-nen-su-dung-mat-na-trang-da-tri-mun-hay-khong-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 9f91f4169ec21914c2eb2cc601919b53218dfbbb92208f9a3f0d01f67802736c

Request headers

:path: /wp-content/uploads/2020/02/co-nen-su-dung-mat-na-trang-da-tri-mun-hay-khong-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:53 GMT
last-modified: Tue, 01 Dec 2020 07:53:48 GMT
server: nginx
etag: "5fc5f68c-5bef"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 23535
expires: Tue, 24 Aug 2021 05:15:53 GMT

GET
H2 200 nhung-kieu-son-mong-tay-dep-nhat-768x432.jpg
www.35express.org/wp-content/uploads/2020/01/ 79 KB
79 KB 230ms
230ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/01/nhung-kieu-son-mong-tay-dep-nhat-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: c7e9c3d33202b4f3d1fdc7ef2d5218209a4c717d39fe29e5f710136d0257b295

Request headers

:path: /wp-content/uploads/2020/01/nhung-kieu-son-mong-tay-dep-nhat-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Mon, 30 Nov 2020 02:33:42 GMT
server: nginx
etag: "5fc45a06-13c68"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 81000
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 mau-nail-dep-don-gian-768x432.jpg
www.35express.org/wp-content/uploads/2020/01/ 51 KB
52 KB 385ms
384ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/01/mau-nail-dep-don-gian-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 8a77f3887deb60af592efdd0b0da1e70a27dc7a44b7ff1eaef2ac3b8fab8025a

Request headers

:path: /wp-content/uploads/2020/01/mau-nail-dep-don-gian-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Thu, 26 Nov 2020 09:54:47 GMT
server: nginx
etag: "5fbf7b67-cd0a"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 52490
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 cac-kieu-toc-ngan-dep-cho-nu-nam-2020-768x432.jpg
www.35express.org/wp-content/uploads/2020/01/ 61 KB
62 KB 407ms
407ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2020/01/cac-kieu-toc-ngan-dep-cho-nu-nam-2020-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 3c09a2eccdafbc0971d87f57ed866507674299c6269a49b3fd308e04b9a995e7

Request headers

:path: /wp-content/uploads/2020/01/cac-kieu-toc-ngan-dep-cho-nu-nam-2020-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Sat, 28 Nov 2020 01:03:09 GMT
server: nginx
etag: "5fc1a1cd-f56a"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 62826
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 top-10-bo-phim-oan-gia-ngo-hep-dang-xem-nhat-35express.jpg
www.35express.org/wp-content/uploads/2021/06/ 63 KB
64 KB 234ms
233ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-10-bo-phim-oan-gia-ngo-hep-dang-xem-nhat-35express.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: fe377c5b5f11d6fa14a0340e4320e797185f1f07ec9f11f571682fd71b001533

Request headers

:path: /wp-content/uploads/2021/06/top-10-bo-phim-oan-gia-ngo-hep-dang-xem-nhat-35express.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Sat, 12 Jun 2021 04:01:57 GMT
server: nginx
etag: "60c431b5-fd38"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 64824
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 top-10-phim-co-trang-trung-quoc-hai-huoc-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 47 KB
47 KB 389ms
389ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-10-phim-co-trang-trung-quoc-hai-huoc-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 2830b441d067ac75d93857153918fe503792017a01e4f9282397d7f323147dc3

Request headers

:path: /wp-content/uploads/2021/06/top-10-phim-co-trang-trung-quoc-hai-huoc-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Thu, 10 Jun 2021 08:10:32 GMT
server: nginx
etag: "60c1c8f8-bb93"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 48019
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 top-10-phim-khoa-hoc-vien-tuong-khong-nen-bo-qua-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 46 KB
46 KB 412ms
412ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-10-phim-khoa-hoc-vien-tuong-khong-nen-bo-qua-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 50c0a319d9bbb73da78515cd6d20220014565c1e823dfb1266fd7449667591dc

Request headers

:path: /wp-content/uploads/2021/06/top-10-phim-khoa-hoc-vien-tuong-khong-nen-bo-qua-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Mon, 14 Jun 2021 02:57:18 GMT
server: nginx
etag: "60c6c58e-b88c"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 47244
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 top-10-bo-phim-hoat-hinh-ve-bong-ro-ban-khong-nen-bo-qua-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 48 KB
48 KB 237ms
236ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-10-bo-phim-hoat-hinh-ve-bong-ro-ban-khong-nen-bo-qua-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 9d7e5b470c3ee93dbc150a2d6bb534d9806f62b5217c2c4c9af9ababa3cf230b

Request headers

:path: /wp-content/uploads/2021/06/top-10-bo-phim-hoat-hinh-ve-bong-ro-ban-khong-nen-bo-qua-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Wed, 02 Jun 2021 09:41:00 GMT
server: nginx
etag: "60b7522c-c0b9"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 49337
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 top-10-phim-hay-cua-luu-khai-uy-dong-hay-nhat-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 34 KB
34 KB 272ms
271ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-10-phim-hay-cua-luu-khai-uy-dong-hay-nhat-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: fea91442f053cb7939c3d95b16b2eda5122146bb1a7cac1e36d2729618c720c6

Request headers

:path: /wp-content/uploads/2021/06/top-10-phim-hay-cua-luu-khai-uy-dong-hay-nhat-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Wed, 02 Jun 2021 04:33:05 GMT
server: nginx
etag: "60b70a01-8662"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 34402
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 top-10-bo-phim-bi-cam-chieu-tai-nhieu-quoc-gia-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/06/ 65 KB
65 KB 380ms
380ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/06/top-10-bo-phim-bi-cam-chieu-tai-nhieu-quoc-gia-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 501b5751464daa62b090649d8d06cc1c81ade14578ef9bb546f39d34a2ca9767

Request headers

:path: /wp-content/uploads/2021/06/top-10-bo-phim-bi-cam-chieu-tai-nhieu-quoc-gia-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Thu, 03 Jun 2021 03:59:58 GMT
server: nginx
etag: "60b853be-10458"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 66648
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210720/r20190131/ 250 KB
93 KB 45ms
30ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210720/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3017291129464697&plah=www.35express.org&amaexp=1&bust=31061978

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c83eae7a38656b387443bacfd93af203e31b66bf687c21af1ef00fab98507aef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95151
x-xss-protection: 0
server: cafe
etag: 4826816153601596757
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 25 Jul 2021 05:15:49 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/ Frame 4CC2 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1310353e02e0a006b79b7d607131cb6d9411543a8957b772f565816fdf3ce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210720/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 25 Jul 2021 01:27:57 GMT
expires: Sun, 08 Aug 2021 01:27:57 GMT
content-type: text/html; charset=UTF-8
etag: 4389807852502320046
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 13672
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 2-nu-streamer-kc-va-tm-co-mat-trong-kho-anh-nong-len-tieng-xac-nhan-3-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 52 KB
52 KB 227ms
227ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/2-nu-streamer-kc-va-tm-co-mat-trong-kho-anh-nong-len-tieng-xac-nhan-3-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 0f1f76e8320104d807d287053df510ed404a7b078e71e75bbadc79052de9840a

Request headers

:path: /wp-content/uploads/2021/07/2-nu-streamer-kc-va-tm-co-mat-trong-kho-anh-nong-len-tieng-xac-nhan-3-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Sat, 24 Jul 2021 02:43:47 GMT
server: nginx
etag: "60fb7e63-d0d1"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 53457
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 bo-cu-cua-rapper-so-1-viet-nam-la-ai-35express-768x432.jpg
www.35express.org/wp-content/uploads/2021/07/ 54 KB
54 KB 220ms
220ms Image
image/jpeg 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.35express.org/wp-content/uploads/2021/07/bo-cu-cua-rapper-so-1-viet-nam-la-ai-35express-768x432.jpg
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),
Reverse DNS: 139.180.156.24.vultr.com
Software: nginx /
Resource Hash: 090c5b122fa90db5c9c12b243543e632b55c23804f342b3bebe4bab2dbb4b042

Request headers

:path: /wp-content/uploads/2021/07/bo-cu-cua-rapper-so-1-viet-nam-la-ai-35express-768x432.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.35express.org
referer: https://www.35express.org/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: public
date: Sun, 25 Jul 2021 05:15:54 GMT
last-modified: Sat, 24 Jul 2021 01:59:37 GMT
server: nginx
etag: "60fb7409-d694"
content-type: image/jpeg
cache-control: max-age=2592000 public, must-revalidate, proxy-revalidate
accept-ranges: bytes
content-length: 54932
expires: Tue, 24 Aug 2021 05:15:54 GMT

GET
H2 200 /
secure.gravatar.com/avatar/ 1 KB
2 KB 18ms
5ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/?s=96&d=mm&r=g
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="none.png"
accept-ranges: bytes
link: <http://www.gravatar.com/avatar/?s=96&d=mm&r=g>; rel="canonical"
content-length: 1528
expires: Sun, 25 Jul 2021 05:20:49 GMT

GET
H2 200 e1fcadaecdb6a8e6c9d8cf6a586bd7b2
secure.gravatar.com/avatar/ 1 KB
2 KB 19ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/e1fcadaecdb6a8e6c9d8cf6a586bd7b2?s=96&d=mm&r=g
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="e1fcadaecdb6a8e6c9d8cf6a586bd7b2.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/e1fcadaecdb6a8e6c9d8cf6a586bd7b2?s=96&d=mm&r=g>; rel="canonical"
content-length: 1528
expires: Sun, 25 Jul 2021 05:20:49 GMT

GET
H2 200 105e6df4c5357836a190a5c2c4e3eae4
secure.gravatar.com/avatar/ 1 KB
2 KB 18ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/105e6df4c5357836a190a5c2c4e3eae4?s=96&d=mm&r=g
Requested by: Host: www.35express.org
URL: https://www.35express.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="105e6df4c5357836a190a5c2c4e3eae4.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/105e6df4c5357836a190a5c2c4e3eae4?s=96&d=mm&r=g>; rel="canonical"
content-length: 1528
expires: Sun, 25 Jul 2021 05:20:49 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-186463932-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 5441
date: Sun, 25 Jul 2021 03:45:08 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Sun, 25 Jul 2021 05:45:08 GMT

GET
H2 200 fa-brands-400.woff2
www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/webfonts/ 63 KB
63 KB 1021ms
1020ms Font
font/woff2 139.180.156.24
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/webfonts/fa-brands-400.woff2

Requested by

Host: www.35express.org
URL: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/brands.css?ver=5.7.2

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

139.180.156.24 Singapore, Singapore, ASN20473 (AS-CHOOPA, US),

Reverse DNS

139.180.156.24.vultr.com

Software

nginx /

Resource Hash

4d0130d314f1669c9ea5a911d401d6250f96386a52b0c38f7b3fb43cdcd10589

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-fetch-mode: cors
origin: https://www.35express.org
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: PHPSESSID=tusn2b3nclvn1p98ji9e21sq06
:path: /wp-content/themes/zota_blog/libs/font-awesome/webfonts/fa-brands-400.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.35express.org
referer: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/brands.css?ver=5.7.2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://www.35express.org
Referer: https://www.35express.org/wp-content/themes/zota_blog/libs/font-awesome/css/brands.css?ver=5.7.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
last-modified: Tue, 07 Jul 2020 08:18:32 GMT
server: nginx
etag: "5f042fd8-fa90"
strict-transport-security: max-age=31536000
content-type: font/woff2
accept-ranges: bytes
content-length: 64144

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 203 B
659 B 92ms
33ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.35express.org&callback=_gfp_s_&client=ca-pub-3017291129464697

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210720/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-3017291129464697&plah=www.35express.org&amaexp=1&bust=31061978

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

389269854812ed7d202c023ee15cc8518939dab7dfcd3965740d0320c19dd105

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 193
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 35ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 37ms
17ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6074 175 KB
41 KB 593ms
592ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&adk=1812271804&adf=3025194257&lmt=1627190149&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.35express.org%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149453&bpp=3&bdt=733&idt=109&shv=r20210720&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2425018222993&frm=20&pv=2&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=126

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

965844e8f824d7fb3dfc06fe9e5b110a2c372e91fbb376d21a65ca98e9c62d64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&adk=1812271804&adf=3025194257&lmt=1627190149&plat=8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.35express.org%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149453&bpp=3&bdt=733&idt=109&shv=r20210720&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2425018222993&frm=20&pv=2&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=126
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 41944
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 38ms
15ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5073fab4fddb9f037315ac9c663dce6681b03976250cab681638dfe17475466f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039897272555"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27998
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:49 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9F7C 129 KB
40 KB 597ms
597ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52c36503857982302ab781e7b031939319bd600452b90096db84f9869251ffea

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COjT5da7_fECFc0W4AodzKwCsQ&gqi=hfP8YJmxJKO5lQehuaTwBQ&layout=/sadbundle/%24csp%253Der3%24/16670075431216831549/grammarly_04_300x250_a_04/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COjT5da7_fECFc0W4AodzKwCsQ&gqi=hfP8YJmxJKO5lQehuaTwBQ&layout=/sadbundle/%24csp%253Der3%24/16670075431216831549/grammarly_04_300x250_a_04/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 41307
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 27ms
13ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1263823846&t=pageview&_s=1&dl=https%3A%2F%2Fwww.35express.org%2F&ul=en-us&de=UTF-8&dt=The%2035Express%20-%20Blog%20chia%20s%E1%BA%BD%20ki%E1%BA%BFn%20th%E1%BB%A9c%20th%C3%BA%20v%E1%BB%8B%20100%25%20FREE&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=990536880&gjid=1076077482&cid=1259153762.1627190150&tid=UA-186463932-1&_gid=713580532.1627190150&_r=1&gtm=2ou7l1&z=419590245

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Jul 2021 05:15:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.35express.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F88C 440 KB
52 KB 518ms
517ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61507b7c80f760c1e5c96596e46ff1aaa72cbd4da4cc5342c52de57a9e054ce2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-expose-headers: x-google-amp-ad-validated-version
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 52741
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2EB8 83 KB
26 KB 506ms
506ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da18d8c8a79968ba28abb038239b23114e82bce251317ce5f7c38dc9181a352b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 26682
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0265 83 KB
26 KB 490ms
490ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38e9df1e24f08aa976bc676ffad251c6356fa822cf2969a82191dd5b7744fb6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 26768
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 28ms
14ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 29ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8C4E 117 KB
36 KB 433ms
432ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c007293d22677fd66efe09125ea18bb703d867935c4b4bfb58ac25b00f564869

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COWE6ta7_fECFQM84AodTH0GyA&gqi=hfP8YJLqKPSslQfiqp-gBQ&layout=/sadbundle/%24csp%253Der3%24/16670075431216831549/grammarly_04_300x250_a_04/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=COWE6ta7_fECFQM84AodTH0GyA&gqi=hfP8YJLqKPSslQfiqp-gBQ&layout=/sadbundle/%24csp%253Der3%24/16670075431216831549/grammarly_04_300x250_a_04/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 36600
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E4CD 92 KB
28 KB 673ms
673ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

506d7c21cdb00032e81acf251024f7a64f28be5b0b201a857abd22bbf1b26c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:50 GMT
server: cafe
content-length: 29080
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 25-Jul-2021 05:30:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 75 KB
18 KB 39ms
13ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ed5657881da42ebfb43526a5957cb7ea8612221b8b62a0d56ea6aa21f643e8

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Mon, 19 Jul 2021 17:58:59 GMT
expires: Tue, 19 Jul 2022 17:58:59 GMT
last-modified: Tue, 18 May 2021 19:41:05 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 17595
age: 472611
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame E28F 0
0 24ms
23ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZaQRhfP8YKWuKYP4gAfM-pnADJmP4vdj8O-ZtZsOxru29rgDEAEg5c3MNWCVAqAB_9uKyAPIAQmoAwHIA0iqBNwBT9DZRx0mwmCEaOgPYNUKDS2ZsrAnyAxDAPdDOjsYy_CKFbM2eseoKeShj1Z1txHz1fENslADBvGp8WqOczn19HGMiDgvrjfSRTxaEu8mE31zAVHfu7EaiX3Iu7mg3R_cDLxCgdxAh7ziLDFMR2z40rZdqgrRogV29v6MxNRuYsdnDT0N_HHiAnPDbe6pkLqXhJqkDcf8frEK1JO5i_lllU0QC6uXt9doovzILpUaZUyr_RnW2TZyXkmbSDLW64iVmG1kJ23X32Dx9-dz1Ia_HPhHb28sQjc4v7jLJMAE09vO98IDkgUECAQYAZIFBAgFGASgBi6AB_DurKICqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEOmCKNIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi0zMDE3MjkxMTI5NDY0Njk3&sigh=qSYE56njiuQ&template_id=419

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame E28F 18 KB
8 KB 31ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame E28F 2 KB
1 KB 37ms
12ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E28F 124 KB
37 KB 28ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame E28F 14 KB
6 KB 32ms
8ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 2EB8 3 KB
674 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 03:52:12 GMT
server: ESF
date: Sun, 25 Jul 2021 05:15:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 2EB8 1 KB
938 B 26ms
16ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 04:46:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1754
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 04:46:36 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame 2EB8 18 KB
8 KB 17ms
11ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 2EB8 2 KB
1 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2EB8 124 KB
37 KB 19ms
17ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 2EB8 14 KB
6 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H2 200 4661e2b537cafc373934756b83790a75.js Show response
www.gstatic.com/mysidia/ Frame 2EB8 26 KB
11 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4661e2b537cafc373934756b83790a75.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d450db79b0f7039b6486a399d93ebe1efa7a81e0f7b1170931b8b3dddf4a31d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 04:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10780
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 05:53:23 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 23 Oct 2021 04:43:50 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/12042407392739998367/ Frame 2EB8 14 KB
14 KB 18ms
16ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12042407392739998367/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15a5bd8d803b7eb0d5cae2f73616f8e92cbefc1ba5c04d2a7f282f3d76fc29e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 11:08:19 GMT
x-content-type-options: nosniff
age: 410851
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13943
x-xss-protection: 0
last-modified: Mon, 14 Jun 2021 06:55:33 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 11:08:19 GMT

GET
DATA 200
OK truncated
/ Frame 2EB8 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1fc322e402725e574ed8d6cbe52904a48c6ae55a1676719a63dc762c2b90fc4c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2EB8 0
0 17ms
16ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cu8OOhfP8YJKIJ_C2x_APweqnkAuW56LGYrPkjaHKDJaCzYWIFhABIOXNzDVglQKgAfD4iNEDyAEJqQI14cShLMCzPqgDAcgDywSqBNABT9BSgFYjmFhaeMqkuOgc7pAKxrZPCZjSKwhNQbKa7VcQnWTsQBLi2D3oHAHnUchcl3PaFHFrQcH47BfP5cwGlS7Kqzv6HrnSxD0g_IctORiXZdbmGIct7hIzB_U5HqGNX6yYo1xNNROrCIWOEv1chlQiW0FvIW_cP1hnoG-_RJoK4KysgA0IEm6kD_FWnpt0QBhFijwSoynkNW15vWYv6F1BfPmveMwKVa3e_MZOunT3HHf62_CQkjjICEz4uiaVztfNH7uLmmOol3u-VKhDLcAE0YSNrIcDkgUECAQYAZIFBAgFGASgBi6AB_iG9y6oB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQ0Okc0ggJCIDhgBAQARgfgAoByAsBuBOIJ9gTDYgUBtAVAZgWAYAXAbIXGgoYCAASFHB1Yi0zMDE3MjkxMTI5NDY0Njk3&sigh=o5Jy2BPFfy0&template_id=5000

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6644 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=28061905&adf=445784539&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149484&bpp=1&bdt=764&idt=173&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=566&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=6&uci=a!6&fsb=1&xpc=vxn5S3fV9w&p=https%3A//www.35express.org&dtd=178

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 25 Jul 2021 04:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1974
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E28F 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82f1e779705f509c8d7f861306d5f62c0629f6dcc5042a6e8cc6041cb61323d5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 css
fonts.googleapis.com/ Frame 0265 3 KB
578 B 29ms
15ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 03:50:49 GMT
server: ESF
date: Sun, 25 Jul 2021 05:15:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
DATA 200
OK truncated
/ Frame 2EB8 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6606453ed7c48c96a8ab4d2c99557bcb5cf8f842061c67118016c837fe345985

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 2EB8 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 02:22:18 GMT
x-content-type-options: nosniff
age: 442412
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 02:22:18 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 2EB8 21 KB
21 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 13:46:22 GMT
x-content-type-options: nosniff
age: 401368
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 13:46:22 GMT

GET
H3-29 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame F88C 67 B
91 B 21ms
6ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 12:06:16 GMT
x-content-type-options: nosniff
server: cafe
age: 61774
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Sun, 25 Jul 2021 12:06:16 GMT

GET
H3-29 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 0265 1 KB
857 B 15ms
5ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 04:46:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1754
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 04:46:36 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame 0265 18 KB
7 KB 16ms
9ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 0265 2 KB
1 KB 14ms
7ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0265 124 KB
37 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 0265 14 KB
6 KB 16ms
9ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H3-29 200 4661e2b537cafc373934756b83790a75.js Show response
www.gstatic.com/mysidia/ Frame 0265 26 KB
11 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4661e2b537cafc373934756b83790a75.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d450db79b0f7039b6486a399d93ebe1efa7a81e0f7b1170931b8b3dddf4a31d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 04:43:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1920
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10780
x-xss-protection: 0
last-modified: Tue, 20 Jul 2021 05:53:23 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 23 Oct 2021 04:43:50 GMT

GET
H3-29 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 0C22 16 KB
6 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39723
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 18:13:47 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 0C22 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 12:37:33 GMT

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/12042407392739998367/ Frame 0265 14 KB
14 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12042407392739998367/downsize_200k_v1?w=400&h=209

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15a5bd8d803b7eb0d5cae2f73616f8e92cbefc1ba5c04d2a7f282f3d76fc29e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 11:08:19 GMT
x-content-type-options: nosniff
age: 410851
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13943
x-xss-protection: 0
last-modified: Mon, 14 Jun 2021 06:55:33 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 11:08:19 GMT

GET
DATA 200
OK truncated
/ Frame 0265 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1fc322e402725e574ed8d6cbe52904a48c6ae55a1676719a63dc762c2b90fc4c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0265 0
0 20ms
20ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CzxHmhfP8YJPMKMqG7gPDyqtQlueixmKz5I2hygyWgs2FiBYQASDlzcw1YJUCoAHw-IjRA8gBCakCNeHEoSzAsz6oAwHIA8sEqgTQAU_QeTxmec9TcNE5oe7jByIIWsfITXiJbVfN5e0yppZqtseV7xQAt-03OSm5pk2t2RKkrh5SrEDpXd8s9bxaHAf8LP3xK4I5EJu27SaGvafje_Mj7jHJ-koBSSqpWBmUFsHp0BgBt3N-M0oGApe0biKhUB3MrPmqgFeZx1kOAhQIA_ft9-M9sCR1CH5GYWn6UD2Y7EWnu-zIf40fkidT_2m0lL-ouGYSA1y4_1ECFSRt8gRCLG89WObYGDoIU2WAW9fP5z9Iab0NAL6XvoeQ91bABNGEjayHA5IFBAgEGAGSBQQIBRgEoAYugAf4hvcuqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEJmuJ9IICQiA4YAQEAEYH4AKAcgLAbgTiCfYEw2IFAbQFQGYFgGAFwGyFxoKGAgAEhRwdWItMzAxNzI5MTEyOTQ2NDY5Nw&sigh=lcPwNUJFmWg&template_id=5000

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame AB31 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=481543928&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=158&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=3943&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=nGeIYkiV48&p=https%3A//www.35express.org&dtd=161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18177
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame 9F7C 67 B
91 B 6ms
5ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 12:06:16 GMT
x-content-type-options: nosniff
server: cafe
age: 61774
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Sun, 25 Jul 2021 12:06:16 GMT

GET
DATA 200
OK truncated
/ Frame 0265 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7dfc213439c7517b00ba2d0f65e7aa60876536786baefa812acbbe5c15330be5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210720/r20190131/ 144 KB
52 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210720/r20190131/reactive_library_fy2019.js?bust=31061978

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c053c60edef45e18664552a406ef938b1dc386591fe24f860902aa708ea46ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52828
x-xss-protection: 0
server: cafe
etag: 15311301234316086152
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A7F7 119 KB
38 KB 640ms
640ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5b12af1e79fa15b35c3213017de64df0fb7c2c59c7f3882403a8180bd94647eb

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL3MmNe7_fECFQGL3god2oAP-A&gqi=hvP8YLmXGtuH7_UPkZaX4Ac&layout=/sadbundle/%24csp%253Der3%24/13751210848470804493/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL3MmNe7_fECFQGL3god2oAP-A&gqi=hvP8YLmXGtuH7_UPkZaX4Ac&layout=/sadbundle/%24csp%253Der3%24/13751210848470804493/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 25 Jul 2021 05:15:51 GMT
server: cafe
content-length: 38529
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 0265 21 KB
21 KB 15ms
14ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 02:22:18 GMT
x-content-type-options: nosniff
age: 442412
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 02:22:18 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame 0265 21 KB
21 KB 19ms
17ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 13:46:22 GMT
x-content-type-options: nosniff
age: 401368
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 13:46:22 GMT

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 75 KB
17 KB 8ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ed5657881da42ebfb43526a5957cb7ea8612221b8b62a0d56ea6aa21f643e8

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Mon, 19 Jul 2021 17:58:59 GMT
expires: Tue, 19 Jul 2022 17:58:59 GMT
last-modified: Tue, 18 May 2021 19:41:05 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 17595
age: 472611
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame ED60 0
0 18ms
16ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-sL9hfP8YKj9JM2tgAfM2YqIC5mP4vdj8O-ZtZsOxru29rgDEAEg5c3MNWCVAqAB_9uKyAPIAQmoAwHIA0iqBNYBT9Akik0VFqdtD09kPKTTFUPJIqijJoQglm-C-lqRFEIfYbM6TSXy4WDDYZe5lykMs4WcxpTG6LF019ocdUZVulqLfkCEeGYXCZVl-TELkGWwTvkchWwKXv6q3oAVLr6ew0Xffe5d67_UgCW6fJyuHpAfc3hZr7j9z8-HpVPCt0BHKjwGADQPLV-ROrRX-LBAIdslL_34ZbbJ8a4S0ekKQSx4986Ji88BGEAHCkziyg44J9u31NddvHenq-O7kVYfCyLGEzRo24ww0tPdw3JwKryMa0kPYcAE09vO98IDkgUECAQYAZIFBAgFGASgBi6AB_DurKICqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEMrJHdIICQiA4YAQEAEYH4AKAcgLAdgTDNAVAYAXAbIXGgoYCAASFHB1Yi0zMDE3MjkxMTI5NDY0Njk3&sigh=2Bd50scni2M&template_id=419

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame ED60 18 KB
7 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame ED60 2 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ED60 124 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame ED60 14 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame EEE5 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=1186805349&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149462&bpp=1&bdt=742&idt=185&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=4708&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=MaueDEeAX4&p=https%3A//www.35express.org&dtd=188

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18177
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6644
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
13ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 25-Jul-2021 06:15:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012107130206000/ Frame BD91 188 KB
55 KB 40ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1caacdebd86c67f86ab89cdbd30b056a8c1141638aafdd35ec453c4bae91692b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 229850
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55160
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:25:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b724d3ee8cec1601"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:25:00 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame BD91 13 KB
5 KB 49ms
17ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b16e9c1da7045c9057350282766a114be2070b065e5e8a42ae635d0610ba6d0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 229851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4795
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:24:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "392d0f0d5f27c169"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:24:59 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame BD91 87 KB
27 KB 50ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-analytics-0.1.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

faf5e994ddbada86a873b5d14c1bc0f449a097e61e6fbe0c04e0691b70ec5644

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 229850
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27843
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:25:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f120bcb28bbafed0"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:25:00 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame BD91 71 KB
16 KB 54ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-animation-0.1.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3039e343bc61cc16fc587e063d92cf190c34823df58e3fe5caf5717198a49fc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 475611
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16734
x-xss-protection: 0
server: sffe
date: Mon, 19 Jul 2021 17:08:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "b05480813bd9b7e9"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 17:08:59 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame BD91 4 KB
2 KB 54ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-fit-text-0.1.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d398520ac47945ab429cf02b444202f4db1cf7fee5b5335cf98fb009ce56ab8e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 229851
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1658
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:24:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6fba3cabb8cd86f8"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:24:59 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012107130206000/v0/ Frame BD91 40 KB
13 KB 55ms
23ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/v0/amp-form-0.1.mjs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29d096500cc94cbe347c613cb34199c274da1fe8b5df04fdb49ee75ace5edbec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 229850
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12840
x-xss-protection: 0
server: sffe
date: Thu, 22 Jul 2021 13:25:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6d4edf2414c2591f"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jul 2022 13:25:00 GMT

GET
DATA 200
OK truncated
/ Frame BD91 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 359033c47a4ddf3b412ae0370114965ce2a01757ca8834db04f7f10205374674

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 vi.png
tpc.googlesyndication.com/pagead/images/abg/ Frame BD91 3 KB
3 KB 17ms
14ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/vi.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b123d3cd853f7cd9c7d7c92b0ca99a37b4fa7e654fca65be5f1a15fd9253635e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 19:09:57 GMT
x-content-type-options: nosniff
server: cafe
age: 36353
etag: 10932518847931040692
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3099
x-xss-protection: 0
expires: Sun, 25 Jul 2021 19:09:57 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame BD91 344 B
370 B 12ms
8ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:40:15 GMT
x-content-type-options: nosniff
server: cafe
age: 38135
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Sun, 25 Jul 2021 18:40:15 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame BD91 0
17 B 25ms
21ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CFpiHhfP8YLjcJvSI4gHn06uQDODFkexjgPbouuENqbCA4JcOEAEg5c3MNWCVAqABr4SDzgPIAQmpAjXhxKEswLM-qAMByAMIqgThAU_QG10lCAl2m25VXq_XvksQ_gyUYuKcu93EPosoGrr3O8TtoSx9y_WBjUGFMnyl_GJV-djyjCMW8VFOgDGMCWI_1Pkcfss7DnyTDPNbPYHgmfmu5ESsPmhydfNN3ELH2myrUuYz_hxlkA8u4zzTWWYztL94lT5WfiTySWTTwayooSO5iNBTEGj9y288_QVtyyZ_jFo01UhvvaALmuKA1bj4_jmQ63-pwt7JmngH2pVXBr-wGsdncqAO-FuVMbPGRd9JCAkFPKUgurZ-kHN-D_QCo5pcn6nZRFCWSvNXlDLfE8AEx7HEiNADkgUECAQYAZIFBAgFGASgBi6AB7n7_DGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQuogU0ggJCIDhgBAQARgfgAoByAsB2BMM0BUBmBYBgBcBshcaChgIABIUcHViLTMwMTcyOTExMjk0NjQ2OTc&sigh=5rgX-cNhjMw&template_id=419

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 bg.jpg
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 50 KB
50 KB 17ms
13ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/bg.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6c80a313dd4fbcfda137f0182f7e8e726e3106774a147449ab5b1b56039019

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 18 Jul 2021 22:00:35 GMT
x-content-type-options: nosniff
age: 544515
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51067
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 18 Jul 2022 22:00:35 GMT

GET
H3-29 200 cta.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 12 KB
12 KB 18ms
14ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/cta.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33fb7aedb8ae8e252bdea5dc7af698dc14e4a82191af04857d7d0d915586e273

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 22:08:54 GMT
x-content-type-options: nosniff
age: 371216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12045
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:08:54 GMT

GET
H3-29 200 wolfgang.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 13 KB
13 KB 22ms
18ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/wolfgang.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc3f2235114a081ef5f832128de0352241d7b5ec7f068f59e88650403791955

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:06:47 GMT
x-content-type-options: nosniff
age: 457743
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12938
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:06:47 GMT

GET
H3-29 200 brandneu.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 7 KB
7 KB 22ms
18ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/brandneu.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

885bf51facb08f4397ae64cceb98ddd51544a4089f9d8b58613f9f7a6aa47e02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 22:08:54 GMT
x-content-type-options: nosniff
age: 371216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6901
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:08:54 GMT

GET
H3-29 200 leben.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 12 KB
12 KB 20ms
17ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/leben.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fc461a4257b067512e27eec3bc3ea1c76363096ad0ad10bd40e7a45b533185b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 08:03:40 GMT
x-content-type-options: nosniff
age: 421930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11873
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 08:03:40 GMT

GET
H3-29 200 packshot.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 27 KB
27 KB 20ms
18ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/packshot.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457aa7b48c2e4296b799e3d37a6196bbd6b1a5fb85199773469a5b9b2f69b9b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 22:08:54 GMT
x-content-type-options: nosniff
age: 371216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28033
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:08:54 GMT

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame 0C22 35 KB
13 KB 14ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18177
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 200 pointer-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 1 KB
1 KB 15ms
11ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/pointer-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d3cc82ca8a344a89151b68c3b7432fd2a54209bbe93757c942e52c258b8adc9

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 412435
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1237
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 10:41:55 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 10:41:55 GMT

GET
H3-29 200 528-300X250-D_overlay-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 2 KB
2 KB 14ms
10ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_overlay-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

993f650f8c1c7c1b6e23686656746f49b1a7010a58ec4d2be7d0767c6527f577

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 408000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1978
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 11:55:50 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 11:55:50 GMT

GET
H3-29 200 528-300X250-D_text_03-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 3 KB
3 KB 12ms
9ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_text_03-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23b286f54a4065531e2bd545a99bc9063ff687548de21f39bc0dea97b9d08f34

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 442473
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2975
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 02:21:17 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 02:21:17 GMT

GET
H3-29 200 528-300X250-D_text_02-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 3 KB
3 KB 13ms
9ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_text_02-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

add570e69e254749b8873f4c53c0da183f5778294a3b4b693450a6b29b755688

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 408000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2993
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 11:55:50 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 11:55:50 GMT

GET
H3-29 200 528-300X250-D_highlight-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 269 B
298 B 12ms
8ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_highlight-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73f7e2403e05e368ccc0da0e3f793ae99c63a85338e177cb3450b04874a0e77b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 398524
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 269
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 14:33:46 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 14:33:46 GMT

GET
H3-29 200 528-300X250-D_frame-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 2 KB
2 KB 16ms
12ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_frame-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad39fa212e1924f91ab6e051d53bbf0d439e7a941d7814c78f4ad8416706efb7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 394171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2141
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 15:46:19 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 15:46:19 GMT

GET
H3-29 200 528-300X250-D_text_01-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 4 KB
4 KB 15ms
11ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_text_01-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d575acdda8c631d5f8ab572b8e230d6c2cb398dba984e85897d25106ec1e293e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 457194
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4220
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Mon, 19 Jul 2021 22:15:56 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:15:56 GMT

GET
H3-29 200 528-300X250-D_background-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 0C22 33 KB
33 KB 14ms
11ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_background-min.png

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

090e4c88041c73758f38bae1aa22f78af949638250928b4b6656bfb358d25e41

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 402807
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33664
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 13:22:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 13:22:23 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 61B4 143 B
163 B 10ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 25 Jul 2021 04:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1974
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.35express.org

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/ Frame 5CA3 10 KB
4 KB 9ms
8ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5d1310353e02e0a006b79b7d607131cb6d9411543a8957b772f565816fdf3ce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 25 Jul 2021 01:38:31 GMT
expires: Sun, 08 Aug 2021 01:38:31 GMT
content-type: text/html; charset=UTF-8
etag: 4389807852502320046
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 13039
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 13929622880911379888
tpc.googlesyndication.com/simgad/ Frame E4CD 34 KB
34 KB 8ms
7ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13929622880911379888?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qkHpVCCHrtqTb_GejMsgZYB45S-lQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67a3c4978e7efdda4b971af48147fa1617020ff9f82b5147deab310d9729c089

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 18 Jul 2021 22:06:57 GMT
x-content-type-options: nosniff
last-modified: Mon, 21 Jun 2021 22:36:34 GMT
server: sffe
age: 544133
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35250
x-xss-protection: 0
expires: Mon, 18 Jul 2022 22:06:57 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame E4CD 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame E4CD 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H3-29 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame E4CD 67 B
91 B 6ms
6ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 12:06:16 GMT
x-content-type-options: nosniff
server: cafe
age: 61774
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Sun, 25 Jul 2021 12:06:16 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame E4CD 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CPgV5hfP8YK-ULcaBgQf0iaCgDpXNzfRhpdja74kO243M_ZEOEAEg5c3MNWCVAqABponrjAPIAQKoAwHIA8kEqgTPAU_QLZGToZPpJSDsL6kGMWbVtNQQ2nlMy1dm4ShFGgSHRXmLlikw1y3P8QfxXaWhFe6W7K6wa8uQrtai__5lSzeDcMcxf7GqGBtdPWwVxvM0l52ZZI-4XeIJ0QPj5ysUMNh6dbvE9OV5QXR-SPaLc3w-TgGnOsBsDcIht1G7OFoCuOpqi4XMtZmikTi6RqB9wvbxIv_Bh9gPcteygNojaB8NPY3jyRQwS1c2GTTXMVBoQ4SISC7TA7TgR0qH7Na0IRywTRwF-IDTxgfMNy_9P8AE9IGH7scDkgUECAQYAZIFBAgFGASgBgKAB57igDeoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwHyBwQQh-0V0ggJCIDhgBAQARgfgAoByAsB2BMM0BUBgBcBshcaChgIABIUcHViLTMwMTcyOTExMjk0NjQ2OTc&sigh=tLDHavgf8oI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E4CD 124 KB
37 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame E4CD 14 KB
6 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame E4CD 26 KB
11 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

095673de1d39cecc95882eab9c8d418a6349794fb21bf8d2048bc65f7b7e7271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 03:16:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7174
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10758
x-xss-protection: 0
server: cafe
etag: 16827398886876637458
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 03:16:16 GMT

GET
DATA 200
OK truncated
/ Frame ED60 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 992dff0fcb2c9351be82a6481e768166e9fd17559ef73317402d5f2e53371bed

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 753B 16 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 18:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 39723
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 18:13:47 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 753B 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 12:37:33 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 231F 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 25 Jul 2021 04:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1974
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E4CD 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 35deb717e277e0eebeb5ef0f3f4bc1fa1fe70ba5cb5019e66162c922000d542a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/ Frame 454B 13 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d6c86aa41fcebfaf806bb0ae0ec797122a01b304e793e454d0e429b718a6d9a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/12795255224190292139/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3419
date: Tue, 20 Jul 2021 22:11:16 GMT
expires: Wed, 20 Jul 2022 22:11:16 GMT
last-modified: Fri, 20 Nov 2020 13:33:27 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
age: 371074
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5CA3 0
0 20ms
20ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CzMGGhfP8YMG8JJTKgAfyjoTQDuvY9PVj_cK-7NMMg6T-mfQlEAEg5c3MNWCVAqABv4TY5APIAQmpAjXhxKEswLM-qAMByANIqgTRAU_Qigdzc6ooxXcKumyFqsbDgCSBbo_HPa8rkgAL1xiZtU97z53LXDWlQIdTBxhAkycr_SJwWBZg8Xr2KvjVvW3acYCX__cankKd5eyk2_T-taej34mYVC8sXti-x5hq5SqaMDqCZH4X5SU5uzJNNCSWn9PChK96ljmAk_r3ItdGVHgFfyNjo0wpT6-4ohpWZV5uoMVSxmgQUc0e5JK_GpuRbAVmT9Rc0st57U48RA7HZ64irKwDlhOESh0gCLeMz3lpgxFLzRRBiTnkG101u8KawATossvSkwOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAHqfunG6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAPIHBBCwqm7SCAkIgOGAEBABGB-ACgHICwHYEw3QFQGAFwGyFxoKGAgAEhRwdWItMzAxNzI5MTEyOTQ2NDY5Nw&sigh=xlu96Q3y9eA&template_id=419

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame 5CA3 18 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 477
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 5CA3 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 272
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5CA3 124 KB
37 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:50 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame 5CA3 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H3-29 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012107130206000/ 20 KB
7 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107130206000/amp4ads-host-v0.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efbfaee418ddbc99a9dd6ba614d9288ef68ab53d89a06a782905ce47c11e450a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 475612
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7340
x-xss-protection: 0
server: sffe
date: Mon, 19 Jul 2021 17:08:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "231829aeddfa638c"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 17:08:58 GMT

GET
H3-29 200 vi.png
tpc.googlesyndication.com/pagead/images/abg/ Frame BD91 3 KB
3 KB 6ms
5ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/vi.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b123d3cd853f7cd9c7d7c92b0ca99a37b4fa7e654fca65be5f1a15fd9253635e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 19:09:57 GMT
x-content-type-options: nosniff
server: cafe
age: 36353
etag: 10932518847931040692
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3099
x-xss-protection: 0
expires: Sun, 25 Jul 2021 19:09:57 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame BD91 344 B
370 B 6ms
5ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 24 Jul 2021 18:40:15 GMT
x-content-type-options: nosniff
server: cafe
age: 38135
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 344
x-xss-protection: 0
expires: Sun, 25 Jul 2021 18:40:15 GMT

GET
H3-29 200 bg.jpg
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 50 KB
50 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/bg.jpg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f6c80a313dd4fbcfda137f0182f7e8e726e3106774a147449ab5b1b56039019

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 18 Jul 2021 22:00:35 GMT
x-content-type-options: nosniff
age: 544515
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51067
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 18 Jul 2022 22:00:35 GMT

GET
H3-29 200 cta.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 12 KB
12 KB 7ms
6ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/cta.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33fb7aedb8ae8e252bdea5dc7af698dc14e4a82191af04857d7d0d915586e273

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 22:08:54 GMT
x-content-type-options: nosniff
age: 371216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12045
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:08:54 GMT

GET
H3-29 200 wolfgang.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 13 KB
13 KB 8ms
7ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/wolfgang.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc3f2235114a081ef5f832128de0352241d7b5ec7f068f59e88650403791955

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:06:47 GMT
x-content-type-options: nosniff
age: 457743
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12938
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:06:47 GMT

GET
H3-29 200 brandneu.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 7 KB
7 KB 8ms
7ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/brandneu.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

885bf51facb08f4397ae64cceb98ddd51544a4089f9d8b58613f9f7a6aa47e02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 22:08:54 GMT
x-content-type-options: nosniff
age: 371216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6901
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:08:54 GMT

GET
H3-29 200 leben.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 12 KB
12 KB 8ms
7ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/leben.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fc461a4257b067512e27eec3bc3ea1c76363096ad0ad10bd40e7a45b533185b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 08:03:40 GMT
x-content-type-options: nosniff
age: 421930
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11873
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 08:03:40 GMT

GET
H3-29 200 packshot.png
tpc.googlesyndication.com/sadbundle/841565693599893593/ Frame BD91 27 KB
27 KB 8ms
8ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/841565693599893593/packshot.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457aa7b48c2e4296b799e3d37a6196bbd6b1a5fb85199773469a5b9b2f69b9b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 22:08:54 GMT
x-content-type-options: nosniff
age: 371216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28033
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 14:23:49 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:08:54 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 61B4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

16ms
16ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=720303164&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149456&bpp=5&bdt=736&idt=129&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2085&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=iBkvIy4EfL&p=https%3A//www.35express.org&dtd=133

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 25-Jul-2021 06:15:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 454B 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 19:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34800
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 19:35:50 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 454B 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 12:37:33 GMT

GET
H3-29 200 bcdb1195ce23dbf973644b8d716587b9.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/ Frame 454B 71 KB
19 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/bcdb1195ce23dbf973644b8d716587b9.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f65b5508c2f9bbd3c710004406377e2abe4b16d10cec73817efa063f9b23e49d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 371074
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19018
x-xss-protection: 0
last-modified: Fri, 20 Nov 2020 13:33:27 GMT
server: sffe
date: Tue, 20 Jul 2021 22:11:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:11:16 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6145 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 25 Jul 2021 04:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1974
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 5CA3 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 92d7e64688aea01a3520d10a3d4d8c01bc71183c0ea7558da112466e6a7884ae

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame 753B 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18177
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 200 pointer-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 1 KB
1 KB 7ms
5ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/pointer-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d3cc82ca8a344a89151b68c3b7432fd2a54209bbe93757c942e52c258b8adc9

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 412435
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1237
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 10:41:55 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 10:41:55 GMT

GET
H3-29 200 528-300X250-D_overlay-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_overlay-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

993f650f8c1c7c1b6e23686656746f49b1a7010a58ec4d2be7d0767c6527f577

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 408000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1978
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 11:55:50 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 11:55:50 GMT

GET
H3-29 200 528-300X250-D_text_03-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 3 KB
3 KB 8ms
6ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_text_03-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23b286f54a4065531e2bd545a99bc9063ff687548de21f39bc0dea97b9d08f34

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 442473
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2975
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 02:21:17 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 02:21:17 GMT

GET
H3-29 200 528-300X250-D_text_02-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 3 KB
3 KB 8ms
7ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_text_02-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

add570e69e254749b8873f4c53c0da183f5778294a3b4b693450a6b29b755688

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 408000
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2993
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 11:55:50 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 11:55:50 GMT

GET
H3-29 200 528-300X250-D_highlight-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 269 B
298 B 10ms
8ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_highlight-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73f7e2403e05e368ccc0da0e3f793ae99c63a85338e177cb3450b04874a0e77b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 398524
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 269
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 14:33:46 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 14:33:46 GMT

GET
H3-29 200 528-300X250-D_frame-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_frame-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad39fa212e1924f91ab6e051d53bbf0d439e7a941d7814c78f4ad8416706efb7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 394171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2141
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 15:46:19 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 15:46:19 GMT

GET
H3-29 200 528-300X250-D_text_01-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 4 KB
4 KB 11ms
9ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_text_01-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d575acdda8c631d5f8ab572b8e230d6c2cb398dba984e85897d25106ec1e293e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 457194
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4220
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Mon, 19 Jul 2021 22:15:56 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:15:56 GMT

GET
H3-29 200 528-300X250-D_background-min.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/ Frame 753B 33 KB
33 KB 11ms
9ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/528-300X250-D_background-min.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/16670075431216831549/grammarly_04_300x250_a_04/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

090e4c88041c73758f38bae1aa22f78af949638250928b4b6656bfb358d25e41

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 402807
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33664
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:41:05 GMT
server: sffe
date: Tue, 20 Jul 2021 13:22:23 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 13:22:23 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 231F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

14ms
13ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn03HoswK3MyZYMUv7YvlPttVqVtA5QoX2vwD7GHtdyXghcoAT_FIYFZCPyP1Q; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:50 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 25-Jul-2021 06:15:50 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:50 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:50 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame 979B 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=2503434622&adf=3964530746&pi=t.ma~as.5199041233&w=345&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149499&bpp=1&bdt=779&idt=191&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1516&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=Z3G6Higgjv&p=https%3A//www.35express.org&dtd=223

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18177
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 454B 3 KB
603 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=DM+Sans:700|Open+Sans:600

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/bcdb1195ce23dbf973644b8d716587b9.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

05332208e33944a37f1f479a7db82dace8121fd93cdab72e5dfd68b47b345b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 05:15:50 GMT
server: ESF
date: Sun, 25 Jul 2021 05:15:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 25 Jul 2021 05:15:50 GMT

GET
H3-29 200 dfee96191409dc1101de92869238400f.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/media/ Frame 454B 2 KB
2 KB 8ms
6ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/media/dfee96191409dc1101de92869238400f.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ea9de4e9257a294f8b0301d0280198b88f4c1b8622cfab904c12039ca076e80

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 371074
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1620
x-xss-protection: 0
last-modified: Fri, 20 Nov 2020 13:33:27 GMT
server: sffe
date: Tue, 20 Jul 2021 22:11:16 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:11:16 GMT

GET
H3-29 200 adae8113b9310d3cdc1b0fbcbdb69242.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/media/ Frame 454B 6 KB
6 KB 10ms
9ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/media/adae8113b9310d3cdc1b0fbcbdb69242.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

12b4fdd29f68294364797ad27115b02da1bb43528d0d42104c395b3f7318607b

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 371074
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6027
x-xss-protection: 0
last-modified: Fri, 20 Nov 2020 13:33:27 GMT
server: sffe
date: Tue, 20 Jul 2021 22:11:16 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 22:11:16 GMT

GET
H3-29 200 50efefe392c2482cc919b1cc37ab736d.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/media/ Frame 454B 6 KB
6 KB 9ms
8ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/media/50efefe392c2482cc919b1cc37ab736d.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/12795255224190292139/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b01b9bbda39a04773d77c9c6be8cea8442878ec7bb20697f3cc987934dd03653

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 456870
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6360
x-xss-protection: 0
last-modified: Fri, 20 Nov 2020 13:33:27 GMT
server: sffe
date: Mon, 19 Jul 2021 22:21:20 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:21:20 GMT

GET
H3-29 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v20/ Frame 454B 15 KB
15 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=DM+Sans:700|Open+Sans:600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 22:08:26 GMT
x-content-type-options: nosniff
age: 457645
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14956
x-xss-protection: 0
last-modified: Tue, 18 May 2021 21:21:26 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 22:08:26 GMT

GET
H3-29 200 rP2Cp2ywxg089UriASitCBimCw.woff2
fonts.gstatic.com/s/dmsans/v6/ Frame 454B 18 KB
18 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v6/rP2Cp2ywxg089UriASitCBimCw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=DM+Sans:700|Open+Sans:600

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8e5a0c39f7371f633203c6e77de59b3fff273bc2c1a5df9c1356e6dc24ad92d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Tue, 20 Jul 2021 04:57:51 GMT
x-content-type-options: nosniff
age: 433080
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18244
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:00:14 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Jul 2022 04:57:51 GMT

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6145
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
177 B

15ms
14ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210720/r20190131/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:51 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 25-Jul-2021 06:15:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:51 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:51 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/ Frame 1FE5 60 KB
15 KB 10ms
7ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a7d0ccccbd09989d1d835112816d9de9aaee8e9be919f37a042abe86e532946

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sadbundle/$csp%3Der3$/13751210848470804493/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
date: Fri, 23 Jul 2021 22:49:06 GMT
expires: Sat, 23 Jul 2022 22:49:06 GMT
last-modified: Fri, 23 Jul 2021 14:59:34 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 15127
age: 109605
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame C2CD 0
0 21ms
19ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CrMwhhvP8YL3xGoGW-gbagb7AD-Da3ORj8P-i54IO-cj93wUQASDlzcw1YJUCoAHS_O-KA8gBCakCNeHEoSzAsz6oAwHIA0iqBNYBT9AelkQ8mwb4kifcwD2rv48dm0lLjNl1Y3BNkJ9ltNWGUVThRvcp2nJpIpDLhFMqkiJkx90ynssMAqzkNx-J--cyERPcG2_RRIlrudkKvyegfePGhNFSx3UN0Qf7N2vlhnpgqXUXF_b7Y78xV7U0gg_WidlJCJlnISDJYWJk7OdjC8uKPM94vC7lsMCvJqqjJuOnvSYnRklqhG557KHywvxc3RB43g758Gx7z5Ax0f7yR4cYuoHY1y01VcfKdRPN672-MlS_Lag6EjQGugT66lOUBKOK28AEot-sn9ADkgUECAQYAZIFBAgFGASgBi6AB5aDkHWoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4bqAfs1RvYBwDyBwQQsOIF0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBgBcBshcaChgIABIUcHViLTMwMTcyOTExMjk0NjQ2OTc&sigh=CMZpqBiOW90&template_id=419

Requested by

Host: www.35express.org
URL: https://www.35express.org/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 25 Jul 2021 05:15:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:51 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/ Frame C2CD 18 KB
8 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:07:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 478
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7622
x-xss-protection: 0
server: cafe
etag: 16178317465966918049
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:07:53 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame C2CD 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:11:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 273
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:11:18 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C2CD 124 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:51 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1627039891503395"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38153
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:51 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/ Frame C2CD 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210720/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:06:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 586
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 10716856519410487149
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 08 Aug 2021 05:06:05 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame C2CD 0
0 14ms
13ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTIeIpofTz9GbLHlJlBmQe-Jqe9xMGobtStM9-r1qa8pffmAwGS22WfNsx-lLFQ4KKC3fcZhHRlGwIjIt4mSj3V6VHy2w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

GET
H2 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame 454B 35 KB
13 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18178
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AEF1 143 B
163 B 6ms
5ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&adk=46654071&adf=582571307&pi=t.aa~a.1219642081~rp.4&w=345&fwrn=4&fwrnh=100&lmt=1627190150&rafmt=1&to=qs&pwprc=4869916450&psa=0&format=345x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190150410&bpp=1&bdt=1690&idt=1&shv=r20210720&ptt=9&saldr=aa&abxe=1&cookie=ID%3D054784007c310034-220bdc028cc800f1%3AT%3D1627190149%3ART%3D1627190149%3AS%3DALNI_MbMf_Hiqws8JFuKOWQl2ysZ5AFjEg&prev_fmts=0x0%2C719x280%2C719x280%2C719x280%2C719x280%2C345x280%2C345x280&nras=2&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1002&ady=1518&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&psts=AGkb-H-GciCOWghpNyhH4h4EycGeGSoWUIAErBpQ4jPYtPaDQs9TxYEvQ2ER2UaqHSQdkAAs5SrnojwOaSw%2CAGkb-H9yXVsCtL3yUbd7LWfi0MJIywsgEnQuXbxCfHrnpC4LSAEGIcyPfIQMGXvTAFhwdarTd5_8dw_Hrgo&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=9&uci=a!9&btvi=6&fsb=1&xpc=09uXnkbt1U&p=https%3A//www.35express.org&dtd=12

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 25 Jul 2021 04:42:56 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame C2CD 0
20 B 28ms
15ms Other
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL3MmNe7_fECFQGL3god2oAP-A&gqi=hvP8YLmXGtuH7_UPkZaX4Ac&layout=/sadbundle/%24csp%253Der3%24/13751210848470804493/index.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Sun, 25 Jul 2021 05:15:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame 1FE5 9 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 19:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34801
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 19:35:50 GMT

GET
H3-29 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 1FE5 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sat, 24 Jul 2021 12:37:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59898
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 25 Jul 2021 12:37:33 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 1FE5 2 KB
614 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:600

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fe320334f2be59790333391688d2e6161a969e957e842bd6fdbc0aa73a1f37a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 25 Jul 2021 04:39:41 GMT
server: ESF
date: Sun, 25 Jul 2021 05:15:51 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 25 Jul 2021 05:15:51 GMT

GET
H3-29 200 600x500.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/ Frame 1FE5 42 KB
42 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/600x500.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ebd62f3d971be5ced5132b3e10d4bec0d974cfa0d99010b2b9556d720f111f01

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 119308
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42508
x-xss-protection: 0
last-modified: Fri, 23 Jul 2021 14:59:34 GMT
server: sffe
date: Fri, 23 Jul 2021 20:07:23 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Jul 2022 20:07:23 GMT

GET
H3-29 200 600x500__6_.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/ Frame 1FE5 57 KB
57 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/600x500__6_.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b75ccf4eec3a69514a1a40f413b82cc6250813a66f1ff35c676aed48d11aef5

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 119308
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57925
x-xss-protection: 0
last-modified: Fri, 23 Jul 2021 14:59:34 GMT
server: sffe
date: Fri, 23 Jul 2021 20:07:23 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Jul 2022 20:07:23 GMT

GET
H3-29 200 600x500__9_.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/ Frame 1FE5 24 KB
24 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/600x500__9_.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/13751210848470804493/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42ee55771bbbe5aea9c88cef12430d705c287ccd24f29e9694f9a2ed9f7f74f0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 83018
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24282
x-xss-protection: 0
last-modified: Fri, 23 Jul 2021 14:59:34 GMT
server: sffe
date: Sat, 24 Jul 2021 06:12:13 GMT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Jul 2022 06:12:13 GMT

GET
DATA 200
OK truncated
/ Frame C2CD 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 87ea75529dc1fca7a4ab10bfdb34768c02b04974a182d790f150c0fcbff13b71

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E28F 42 B
64 B 16ms
15ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvIl8x4RE5QE-4Gmb66lfthgmIECVogEfPOXuWczCz1mazrXFnjcKuO4N24M2ldGgx-ek6N5XtDdxH3vVsOrnSu7OAosc9tL54_qRBwghfZjhBAyek-_8kKDv7oNg&sai=AMfl-YQasFYlNU-ZkWHszscfQVaw9CHpgvdngHNwwhYtbRE2mKdOXJk_lfucCubYUSxOmJQYJ8aqKOMTXCnY&sig=Cg0ArKJSzFDo8DlGHwozEAE&id=lidar2&mcvt=1024&p=566,1002,846,1338&mtos=1024,1024,1024,1024,1024&tos=1024,0,0,0,0&v=20210723&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=28061905&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1627190150105&dlt=440&rpt=114&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Jul 2021 05:15:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1Ptxg8zYS_SKggPN4iEgvnHyvveLxVsEpbCIPrE.woff2
fonts.gstatic.com/s/raleway/v22/ Frame 1FE5 21 KB
21 KB 8ms
5ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v22/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVsEpbCIPrE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4012fdcbe9804fb76be489414b5d7fa6fc0a492ac676d9105b41e1dc73208395

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: null
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:01:36 GMT
x-content-type-options: nosniff
age: 465255
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21364
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 19:40:50 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 19 Jul 2022 20:01:36 GMT

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame AEF1
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

16ms
15ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:51 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 25-Jul-2021 06:15:51 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 25 Jul 2021 05:15:51 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 25 Jul 2021 05:15:51 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame 1FE5 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18178
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5CA3 42 B
64 B 16ms
16ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstGXXYmE6ThYwLRHM105yx5cpt8BL9J7nLV7lAo0E7QkQ_S4t6OWBxAvckcmJprfgX-WozZBrjtumnrVUoZjJB-KAPAuqh42Z2MMUqqimMph0qqG4K0qDAjHKo5eg&sai=AMfl-YTpTqSyXGGXKsHX6rir_ndkqj7C-m67ztqriBT9vj5SrMskJFSfyCgaQZT3S-aBf18RprzTz3fpXuvN&sig=Cg0ArKJSzO_zHpTJ77nREAE&id=lidar2&mcvt=1000&p=1103,299,1228,1304&mtos=0,765,1000,1076,1076&tos=0,765,235,76,0&v=20210723&bin=7&avms=nio&bs=0,0&mc=0.78&if=1&app=0&itpl=2&adk=1812271801&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1627190150582&dlt=116&rpt=1&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Jul 2021 05:15:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 2.5cf3cbfd.chunk.css
menu.metu.vn/static/css/ 20 KB
3 KB 646ms
644ms Stylesheet
text/css 2606:4700:3036::ac43:dcbd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://menu.metu.vn/static/css/2.5cf3cbfd.chunk.css
Requested by: Host: menu.metu.vn
URL: https://menu.metu.vn/static/js/sdk.js?container=body
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dcbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: eab371324c7bbbd47ed2e5cf380e6b4659cdf1e5ea0955938bda61221e91dc42

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:53 GMT
content-encoding: br
etag: W/"5087-175d9a57a30"
cf-cache-status: EXPIRED
last-modified: Wed, 18 Nov 2020 04:38:22 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qkny2qlrr5x20AvZER%2F0YRFTyUNMiiLAZDt1NFdQK%2FrqQEr0%2FlmwQfC0bHhMgrfAGehMdudy9IwcITTvtx9H8YcqYHVOBEx%2F4%2BnRx0PrEk8LYXo9cQ1ekrDcvEOo6IDDmXuG4QwPBr3IVyk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6742e9b6f8a10605-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 main.f37137d4.chunk.css
menu.metu.vn/static/css/ 8 KB
2 KB 456ms
455ms Stylesheet
text/css 2606:4700:3036::ac43:dcbd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://menu.metu.vn/static/css/main.f37137d4.chunk.css
Requested by: Host: menu.metu.vn
URL: https://menu.metu.vn/static/js/sdk.js?container=body
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dcbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 4ea7d15059bbbf6055688681a5ece678b659a8a441ce865f088b1da26e52d0ab

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:53 GMT
content-encoding: br
etag: W/"2001-175d9a57a30"
cf-cache-status: EXPIRED
last-modified: Wed, 18 Nov 2020 04:38:22 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IQrw4Grg1ZSCsEXqUdT0Z4EDjm9JSY3%2Bbq1b67wRWVJHTS%2FzXhIf7MW%2B07L1x1QfDw0WqCbK5JzSgDRE5pN7NWkBMVkHFG3%2BJjji7wEsiwEJeN6YgNJg7T1BkDmmt4LbHoMqQjADsA%2BgfQI%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6742e9b6f8a20605-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 2.fd56d826.chunk.js Show response
menu.metu.vn/static/js/ 316 KB
84 KB 1306ms
1305ms Script
application/javascript 2606:4700:3036::ac43:dcbd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://menu.metu.vn/static/js/2.fd56d826.chunk.js
Requested by: Host: menu.metu.vn
URL: https://menu.metu.vn/static/js/sdk.js?container=body
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dcbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 3d2413bf2362759f7b39063aaab5df5ae5368efe4b2a7c853b59c2f363fb0693

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:54 GMT
content-encoding: br
etag: W/"4ee98-175d9a57a30"
cf-cache-status: EXPIRED
last-modified: Wed, 18 Nov 2020 04:38:22 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fe71zW4B82%2FPhTAVIBEzOKEDHzwwDjqVnVOJ517MyQrHPt9NvhN0LPvolbM1Xsotss9r6s%2FDA2mLIQoR4oBUfejjLV2SzxS0QZ%2FFqPKMnXffuH4fBDa%2FWyDNJ0KvUXQ5Lf067w%2BJYENlgWs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6742e9b6f8a40605-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 main.fd498541.chunk.js Show response
menu.metu.vn/static/js/ 28 KB
8 KB 624ms
623ms Script
application/javascript 2606:4700:3036::ac43:dcbd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://menu.metu.vn/static/js/main.fd498541.chunk.js
Requested by: Host: menu.metu.vn
URL: https://menu.metu.vn/static/js/sdk.js?container=body
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dcbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d303c56d00921aaaeca975a118bb500d7bf1cb34f7ffab09feb41395f7c38ead

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:53 GMT
content-encoding: br
etag: W/"709f-175d9a57a30"
cf-cache-status: EXPIRED
last-modified: Wed, 18 Nov 2020 04:38:22 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D91PKjGEHuu4kcfbNYnqtNyglRZ844Jhc4Jt1SOc3atFRt4gwGE83bvyXRhXXhmpnFROqoHPA5tPfYPWuce%2FLGuqJmhxziirRhRQilP0%2FygY5q79a5aOIw3FVrOBwzwNQb05PNqR4CDSX1U%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6742e9b6f8a50605-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 runtime~main.a8a9905a.js Show response
menu.metu.vn/static/js/ 1 KB
1 KB 434ms
434ms Script
application/javascript 2606:4700:3036::ac43:dcbd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://menu.metu.vn/static/js/runtime~main.a8a9905a.js
Requested by: Host: menu.metu.vn
URL: https://menu.metu.vn/static/js/sdk.js?container=body
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:dcbd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b3da2473ccfccc1c5cb1aa8da620c56ecf201b458533007a903e4ee43ee867f1

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:53 GMT
content-encoding: br
etag: W/"5ac-175d9a57a30"
cf-cache-status: EXPIRED
last-modified: Wed, 18 Nov 2020 04:38:22 GMT
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g2RoQ6ix2xZc2ixPZpkGsZVDZO1tTzZG2ItCtFXonUtaHvetVq%2Bjq%2F5U4Qj2jZxc0c0EfsFdKbnjFGdA3jMX7d4yXqy75AV%2Fq4Sg3mypTzv7KZoYC5o9S5lDIb8%2F4WMzMuzrMc7uHtDgwcw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6742e9b6f8a60605-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 26ms
26ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210720&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c99df852e35cb9e519feef69fcf168c47b79a41daeb57f09e3a64541e316b0b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 25 Jul 2021 05:15:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8617
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 05:15:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Sun, 25 Jul 2021 05:15:54 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame B25F 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Sun, 25 Jul 2021 04:03:48 GMT
expires: Mon, 25 Jul 2022 04:03:48 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 4326
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame EFDA 783 B
533 B 17ms
17ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a19c525d1537c58b9f11a2bfea8df66852d7f0378a4a4c9b0ae6d791385a8fed

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MriksaqK2Gs33jqGZAK7Yw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.35express.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36
Referer: https://www.35express.org/

Response headers

expires: Sun, 25 Jul 2021 05:15:54 GMT
date: Sun, 25 Jul 2021 05:15:54 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-MriksaqK2Gs33jqGZAK7Yw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js Show response
pagead2.googlesyndication.com/bg/ Frame B25F 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/rC_9MNdzujh4BoSBgapm_dys7sQE8JDGlsbaQBHCCWU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

date: Sun, 25 Jul 2021 00:12:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18181
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13334
x-xss-protection: 0
last-modified: Wed, 14 Jul 2021 07:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Jul 2022 00:12:53 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
22 B 16ms
16ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210720&jk=1685574038939267&bg=!U1ClUBTNAAbnC78O5ws7ACkAdvg8WgleRzE9BNrf_qP-e2OCXuhsACXtar84p3Jc6XKKPMHnYYqqgQIAAABYUgAAAAxoAQcKAKj3zaWkLErgXAkl3aD8AOE0plqu4yf-74BIaHkYAZiBZbR_Cr8rWACOPCfsOAI5_HHC4AKvIymIlB82YWtcpQmTgfiquvSoRnnzd0Rwcd0AjvI0OXrGrE4Lbx-dWCVkvxgdAp_JarnoEZP7GwkS_hItlcdpx3tgefeqg7YxJkTKhVFHijtOKvTJwboLTyUFdPZdXX0ROAFbWOZIZQA8GyNArQq-1CowEpWZAnAWFvAuIGjFYsx2z74F16O9loLM-k6W0MGHbxuHzaeXYe_hXNyVUFfFyiLD8uSOq-l0i3gHt4k21jQcULONxbhtMCqFfQbL_gTv56EHik_oEE-cnUsCg_DNvkTuTUJpZxn7CyYCUbDLJOHnx9hu7w4H46ql0EHD9of_uli_XbaH_wkH9jsxVogNSftfhO5LZ4mTPrCFpbilx0plTdZ7LRu3wLcwtXKJd2e07B-vrZsKk2bwqbyDjHqZBDQZipNeqWBbSypN10nBoYlL4hgm8YcHIqeQr4ADN1_Pk4wowiRgdF1EEP0ENQbR69c2bds6d9crecZLtElE-MvkH5e1D4B12aguJwZ8eHqB8it0n5F5D2gi8W1BA8_NgfzzzjC_HeBG0YAA1Sl9qX7YRI3-YwJ-kvR_M0J3LaBfK33xDiCHxyy1rozsBF12cWcouDbFZgS1LpMAMc9sdiYoa5W7R2jHMDiI4bDr8XmKdzoUXrprYkTOjiL3mcP_MPJYQzVXGDcHW_d1bssA_KmTzMN535P-YmDAlEVE_pKkIE7BU9zcFh6SDsqov5Bq7BsRsZJGvV6IXK89n3ZwELJ7ti39HOU_fpK_yg5wEZwWM3of_0ibLnGqWlWOi3WjbEbRfK9jBMMWNn8iN5dKqp3bUTALsY1tDg-Q1NI8LOGSZYIaqBZwlOklBwbMF_MQYmvLFdO3ZxbYcBSHrbYmRBP893GUR_3JIS2yireF6bffpyrBgHgT696rx8qVWqmxF0nzoA3ietbYnIoPo4ip709mDuxc0EmJuW9MwVw_MHxhY0t8orypfYnR6FFQZYy_pgyAcPvGkWI

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.35express.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.49 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Jul 2021 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.35express.org
URL: https://www.35express.org/wp-content/uploads/2021/07/ke-phat-tan-kho-anh-nong-loat-streamer-doi-mat-an-phat-nao-3-35express-768x432.jpg

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.doubleclick.net/	1970-01-19 19:59:51	Name: test_cookie Value: CheckForPermission
			.doubleclick.net/	1970-01-19 19:59:53	Name: DSID Value: NO_DATA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	info	URL: https://cdn.ampproject.org/rtv/012107130206000/amp4ads-v0.mjs(Line 6) Message: Powered by AMP ⚡ HTML – Version 2107130206000 https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3017291129464697&output=html&h=280&slotname=5199041233&adk=1980766332&adf=3564838444&pi=t.ma~as.5199041233&w=719&fwrn=4&fwrnh=100&lmt=1627190149&rafmt=1&psa=0&format=719x280&url=https%3A%2F%2Fwww.35express.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..&dt=1627190149461&bpp=1&bdt=741&idt=149&shv=r20210720&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C719x280&nras=1&correlator=2425018222993&frm=20&pv=1&ga_vid=1259153762.1627190150&ga_sid=1627190150&ga_hid=1263823846&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=253&ady=2850&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060956%2C31061978%2C20211866&oid=3&pvsid=1685574038939267&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=EvCyw2r9WH&p=https%3A//www.35express.org&dtd=152
console-api	log	URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.7.2(Line 1) Message: OneSignal: Using fallback ES5 Stub for backwards compatibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

35express.org
adservice.google.com
adservice.google.de
api.trackpush.com
cdn.ampproject.org
cdn.onesignal.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
menu.metu.vn
pagead2.googlesyndication.com
partner.googleadservices.com
secure.gravatar.com
tpc.googlesyndication.com
www.35express.org
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.35express.org
139.180.156.24
142.250.74.194
157.230.253.19
2606:4700:3036::ac43:dcbd
2606:4700::6812:e234
2a00:1450:4001:800::2003
2a00:1450:4001:801::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:810::2002
2a00:1450:4001:812::2003
2a00:1450:4001:813::2002
2a00:1450:4001:827::2002
2a00:1450:4001:828::2004
2a00:1450:4001:828::200e
2a00:1450:4001:829::2008
2a00:1450:4001:831::2001
2a00:1450:4001:831::2003
2a00:1450:4001:831::200a
2a04:fa87:fffe::c000:4902
05332208e33944a37f1f479a7db82dace8121fd93cdab72e5dfd68b47b345b37
070edfef42e0980783d0acf8fa9ca6a9833b994eca13ffaa94e9a2deb47c92cf
0857ce28c182d406d2e3b88e270ba4338a0347b2055becbade3d0c7396ed89ab
090c5b122fa90db5c9c12b243543e632b55c23804f342b3bebe4bab2dbb4b042
090e4c88041c73758f38bae1aa22f78af949638250928b4b6656bfb358d25e41
095673de1d39cecc95882eab9c8d418a6349794fb21bf8d2048bc65f7b7e7271
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0c779ae95a8b1f10dcec474f7d89e001dfc1d27816dfe9e92542efdee4c6dc76
0f1f76e8320104d807d287053df510ed404a7b078e71e75bbadc79052de9840a
10232ad7723403bbb7aa0299d767d5e42d48b78eaefc3967ff082cf948799400
1126b83561c4313b0365ad8c062bf4649e8a55f77a6e67f686ee6936d9560b0a
12b4fdd29f68294364797ad27115b02da1bb43528d0d42104c395b3f7318607b
15a5bd8d803b7eb0d5cae2f73616f8e92cbefc1ba5c04d2a7f282f3d76fc29e5
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a0ea3ba48ef5ada4382b501746b9d9bc263b78e8d6f3527d76de9d97bbdfa37
1b16e9c1da7045c9057350282766a114be2070b065e5e8a42ae635d0610ba6d0
1b1a4081a8a32bc714fbb7a2509141683bc3eb707a421c0db556ed856f6d8e99
1c6863381aad621f26a0c52404c391314acd0f95b745c8ff125181711dd9782e
1caacdebd86c67f86ab89cdbd30b056a8c1141638aafdd35ec453c4bae91692b
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1fc322e402725e574ed8d6cbe52904a48c6ae55a1676719a63dc762c2b90fc4c
1fc461a4257b067512e27eec3bc3ea1c76363096ad0ad10bd40e7a45b533185b
204d5c862d44127428ab4cc5f27ee51c8e5878998c534c5a15f4d02baaa0c982
22af5d3bf749542c2d95975186991b7b8c1e0766449c3fdeab55d57eb0d1ffdc
23b286f54a4065531e2bd545a99bc9063ff687548de21f39bc0dea97b9d08f34
254bc6f633c06fe6077256191c4a595988ac69a2b6d235e93b561fdb1c68e3a3
27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe
2830b441d067ac75d93857153918fe503792017a01e4f9282397d7f323147dc3
29d096500cc94cbe347c613cb34199c274da1fe8b5df04fdb49ee75ace5edbec
2a67286c7403309647cbc15efdbb85d179c541847aa5871da1b496ba20bdeb76
2c053c60edef45e18664552a406ef938b1dc386591fe24f860902aa708ea46ae
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
2d88687758a5d3a385c77fe877ac3e49c7247f8cb845d70dfe6cedbc8ee1c5ca
2ea9de4e9257a294f8b0301d0280198b88f4c1b8622cfab904c12039ca076e80
312b9f5c61ad571fd892cb0391cbc4c27470488214490baf12d53af27ed8f1b6
314d1480d881ee9f99bd0e9acfc27a338a28e35efe38ac346936ad698dbcbc5f
33fb7aedb8ae8e252bdea5dc7af698dc14e4a82191af04857d7d0d915586e273
35705a8c4f27600c1d9d9fe139c4ead072911e424cb6668b884379ac30ed65fc
359033c47a4ddf3b412ae0370114965ce2a01757ca8834db04f7f10205374674
35deb717e277e0eebeb5ef0f3f4bc1fa1fe70ba5cb5019e66162c922000d542a
3618716f55706a405602bae7d865ede3f94f996af8ad2cb1a46a1ad12214b637
389269854812ed7d202c023ee15cc8518939dab7dfcd3965740d0320c19dd105
38e9df1e24f08aa976bc676ffad251c6356fa822cf2969a82191dd5b7744fb6f
3a51d51c183a0030a6e6ef209b0d84a720eca480bcdc10e17f2f693f465cfd57
3afe80b8729301fa408af020233982d44fc86481e3bd1945bb940214e5dde1b4
3b75ccf4eec3a69514a1a40f413b82cc6250813a66f1ff35c676aed48d11aef5
3c09a2eccdafbc0971d87f57ed866507674299c6269a49b3fd308e04b9a995e7
3d2413bf2362759f7b39063aaab5df5ae5368efe4b2a7c853b59c2f363fb0693
3e7a966f00c8a8a2e4e17fe2483d16c146625704f26a085b58f4bc75cb942ff9
3eacc6ed8697fe8437bdcb638b639f336b161865425c43f8e9017f286add77e1
4012fdcbe9804fb76be489414b5d7fa6fc0a492ac676d9105b41e1dc73208395
42ee55771bbbe5aea9c88cef12430d705c287ccd24f29e9694f9a2ed9f7f74f0
4409f886851d18b5071cc08d25845e0d959d51fd1e9eec92118d0f12a44e5eeb
457aa7b48c2e4296b799e3d37a6196bbd6b1a5fb85199773469a5b9b2f69b9b5
47dd690f8f315bea076e92581a7e7147443bb4c847e313ab5a7d50a8c44836d0
4b42b2888201c095a3f32e35add60d8862b2f6320922eda030f4ad928bff77cb
4ca739a13d804ea8806c9878d5b463d2a2c2a75b61a1b2f8a8e104e9b0daecb5
4d0130d314f1669c9ea5a911d401d6250f96386a52b0c38f7b3fb43cdcd10589
4ea7d15059bbbf6055688681a5ece678b659a8a441ce865f088b1da26e52d0ab
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
501b5751464daa62b090649d8d06cc1c81ade14578ef9bb546f39d34a2ca9767
506d7c21cdb00032e81acf251024f7a64f28be5b0b201a857abd22bbf1b26c87
5073fab4fddb9f037315ac9c663dce6681b03976250cab681638dfe17475466f
50c0a319d9bbb73da78515cd6d20220014565c1e823dfb1266fd7449667591dc
50c654f770aa2c7089bf1d590011861ae5aaa5dbabbd1d550f1a79989a87918a
52974e1f2c9fb2f17952ee8185bb18407775682348bf1848083163cf841b10da
52c36503857982302ab781e7b031939319bd600452b90096db84f9869251ffea
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23
5760b0a40e4c7e3aeb440abf5277b546e2af0658fc5bc6659bfb80d6b4711004
578b1a1ab346e8053c9b8d597c5232fada224cf813d462cd70ce0e0d0131c527
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
5a7d0ccccbd09989d1d835112816d9de9aaee8e9be919f37a042abe86e532946
5b12af1e79fa15b35c3213017de64df0fb7c2c59c7f3882403a8180bd94647eb
5b85a6520191159435eda669fdeee77444eb59a885e95b64b330ddddd52dccea
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c7df99df232586111917083a85aa31b82ee29e48ca2990e13fae0c0663a923f
5d1310353e02e0a006b79b7d607131cb6d9411543a8957b772f565816fdf3ce4
5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a
5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f
5f6c80a313dd4fbcfda137f0182f7e8e726e3106774a147449ab5b1b56039019
608b2266e3174718567f6dc3be4cb8bd503c9f1109136a8e4c49ffa227dc4e4c
61507b7c80f760c1e5c96596e46ff1aaa72cbd4da4cc5342c52de57a9e054ce2
6606453ed7c48c96a8ab4d2c99557bcb5cf8f842061c67118016c837fe345985
67a3c4978e7efdda4b971af48147fa1617020ff9f82b5147deab310d9729c089
67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d3cc82ca8a344a89151b68c3b7432fd2a54209bbe93757c942e52c258b8adc9
6d6c86aa41fcebfaf806bb0ae0ec797122a01b304e793e454d0e429b718a6d9a
6fab3ea4a64f8ef2b25500617e97d8e53fea4eadd42ab069de7d9a6db12b1c4f
70211e8296c52b3feb952e99accc2d44101ab3f2d8d20d912a3f544113af17ac
719b12b486c9f39345e5b3f4caf76c3545cb95f89083eb9d120a116bc6dae31a
7203265bf1dddb821475201ac0fc73aa5f62876628dab951ef5da08b74b8368e
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
73f7e2403e05e368ccc0da0e3f793ae99c63a85338e177cb3450b04874a0e77b
74200d8d4f78ec5dc0c272eeb36f3d5f4dc94a4a487e856ba0fbe610dfaa4b74
7438cd6d98fc8e372c9a87e319ab965229ce2ba37798db808c8408f791db86ca
776507af37e7093970722cbf5210af81bcb16dd025f958e7a3dc85d97657b410
7c4a5a83cf4db1f08ec521e1ff1f07a7ae58cbf6d6a076c2da20e2c4f99e5779
7dfc213439c7517b00ba2d0f65e7aa60876536786baefa812acbbe5c15330be5
7e7b0f75251a9768444ee150256c11c0afdaf8cb7ff1c407124ffc2ff364e569
7f69eadb4759b03fe0f99070f06b4811311a56c200f99cd0708edbb833be353e
82f1e779705f509c8d7f861306d5f62c0629f6dcc5042a6e8cc6041cb61323d5
85663dccf5900fa4c9e54364909dd6d67fbe2c03cc3a19215ce307169b89d67e
85a665d8c7688717ecc822af5580eab71600f5bd5501ce506b09380b2d1d6471
87ea75529dc1fca7a4ab10bfdb34768c02b04974a182d790f150c0fcbff13b71
885bf51facb08f4397ae64cceb98ddd51544a4089f9d8b58613f9f7a6aa47e02
892665c4ba08ff7b41d21672b31f00b4cecbaa485c0ee33cbcfd15cd5e83319e
8a77f3887deb60af592efdd0b0da1e70a27dc7a44b7ff1eaef2ac3b8fab8025a
8abbc21521ab2927b47b6578c0c36d85801644919a9bf2b750c337216313bb66
8d450db79b0f7039b6486a399d93ebe1efa7a81e0f7b1170931b8b3dddf4a31d
8db06315fa87e02b4ab308b7651a13f9b3b6c1ba0693b798add33c6a3399aefc
905bd605d1e44330dba4e64ec729cf1cc4679eebc4560e069e1fca6e41430768
927d5436967ebce8a52c4bdcd27cc056c910a72270f74990dfbd1d554840c12d
92d7e64688aea01a3520d10a3d4d8c01bc71183c0ea7558da112466e6a7884ae
9498e12514c0b38bd754ad3326ef8c6ac83be8a9d2f29dba5cb340068fbece99
965844e8f824d7fb3dfc06fe9e5b110a2c372e91fbb376d21a65ca98e9c62d64
96f70be8a41e7a91e9a0338f8c097f954aed84c48a9a1ca7260d0b41d5060e87
992dff0fcb2c9351be82a6481e768166e9fd17559ef73317402d5f2e53371bed
993f650f8c1c7c1b6e23686656746f49b1a7010a58ec4d2be7d0767c6527f577
9a45f5cb86b17127523c133e17b0edb7cb6c3a266fb8d114885744a507a6c008
9afba6521efd9dec8788781d4493284b3e6e2dbbe95b6e6a227cb6cf01c50f14
9d7e5b470c3ee93dbc150a2d6bb534d9806f62b5217c2c4c9af9ababa3cf230b
9f91f4169ec21914c2eb2cc601919b53218dfbbb92208f9a3f0d01f67802736c
a19c525d1537c58b9f11a2bfea8df66852d7f0378a4a4c9b0ae6d791385a8fed
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a7c28020cc614373f347d1642686b35b7f2d52eeccaf7fc1280e5096947151b8
a8e5a0c39f7371f633203c6e77de59b3fff273bc2c1a5df9c1356e6dc24ad92d
aa3fe744fb47d28b1d99ee7b3182c862bc8cfb66b1af622308be5f1ed813f8f4
ac2ffd30d773ba387806848181aa66fddcaceec404f090c696c6da4011c20965
ad39fa212e1924f91ab6e051d53bbf0d439e7a941d7814c78f4ad8416706efb7
add570e69e254749b8873f4c53c0da183f5778294a3b4b693450a6b29b755688
b00834c17c50af103e353ef86a69d90bbcaa819ed92b4d6ed670a425514e3c3a
b01b9bbda39a04773d77c9c6be8cea8442878ec7bb20697f3cc987934dd03653
b07a2bd0c08e2363851192894ac79e426f1a53e37fd16ea3555b9585b864c485
b0db33ffd7e79416a2a26305c56ba8069fce67bc72f4b8eeeda02eb87d7da506
b123d3cd853f7cd9c7d7c92b0ca99a37b4fa7e654fca65be5f1a15fd9253635e
b34914518abae35b58e1147f99c1525f58ae8fcc550efbfa0c0e47eaab7ba488
b364cf5989c8f1cb905d272fb595a5c9a019370c874eec977897831158b9bd14
b3da2473ccfccc1c5cb1aa8da620c56ecf201b458533007a903e4ee43ee867f1
b5757aa153f991c82c949e638c56b4913042196240f3a41cec5a40c3366d1bdd
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b7140a30d39d6e04f4adfcd55e4293d6dc02b0f0ce7408c2ed1a012a181425ac
b7cd883aaa04194a62e6a24024e7cbc62050554abf2e600b9baa62fa347d0342
b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a
b8c0ce32234af999076b48518b249d477718550593a782e170f159477e8b4265
bba459209d2eb1d7f8f21dd8e91037f40bc6b407cd5f503185b3d478159cc574
bbdcb192b10b0f48ada67d79a504bb8c1341645584612b44560f647aa57b440f
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
beec618936d8f6a0cc9da57125553c71d3f212cc4c3c1028979d5523f3380fbd
c007293d22677fd66efe09125ea18bb703d867935c4b4bfb58ac25b00f564869
c22d5e7960949ce5282dff0c8b09dca227ef42d92c862eecee77b925dfdef157
c298433cc9eb86f4c0be0a447b0faf398dee9186d2bcf26683297de2758cddc7
c3ed5657881da42ebfb43526a5957cb7ea8612221b8b62a0d56ea6aa21f643e8
c4b6ed2645519ec2c128badb2a2e7720052f8441ffa94c4f0bceca02311004da
c5081e9c65415a1a3cdde2562c6a522dfdbdb063d23e218395039495f12f6eaf
c7e9c3d33202b4f3d1fdc7ef2d5218209a4c717d39fe29e5f710136d0257b295
c83eae7a38656b387443bacfd93af203e31b66bf687c21af1ef00fab98507aef
c99df852e35cb9e519feef69fcf168c47b79a41daeb57f09e3a64541e316b0b4
cb09ab0572c6a6549a782e2843218c00285cb737ae50fe29a5061ca96aff0234
cbc3f2235114a081ef5f832128de0352241d7b5ec7f068f59e88650403791955
cd1b08e3b1008ec5b6e23644fa1c02b274a033e74a607cf7335aab4f38be4d9b
cd956b1fe1fdb2064dcdd958d0c63581e2a899bd826fe5eb372ff5c11385383f
ce11c542168ce492d1b4ffdbe5bf3ee7026a1632fbf55d7675299b5074b56fec
cf7171f0264b88fef3747c1cad5d65cbb14f7e88eb97f67c6c67929c91c3fdce
d1919f983459281ec9d56b30b9f43d12203cbe7197a75f2b4ccc42f9d8b3e29d
d1b3c56c7f552cd4e1ce9d214be42e8d05a43e53054e65ecc689ed9140e363ae
d303c56d00921aaaeca975a118bb500d7bf1cb34f7ffab09feb41395f7c38ead
d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3
d398520ac47945ab429cf02b444202f4db1cf7fee5b5335cf98fb009ce56ab8e
d495d21bc4d100ed95ddf5a91cd1c06cbdf3cbcaef991ccecd7d4eb18d02e809
d575acdda8c631d5f8ab572b8e230d6c2cb398dba984e85897d25106ec1e293e
d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01
da18d8c8a79968ba28abb038239b23114e82bce251317ce5f7c38dc9181a352b
db6686d4db6ec8f49f7a31a5b42f1ca193c05533426380d9505089d67f6787d0
ddf11d442e5dd8e654731c912a744f6e586d4a327bb46cebffda78d82470effb
deb99d2e55ae5645b1a4e9568536623aeba5bd8a8b1e31a8b542fbee5022abfe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e511216e709c35b8ce12479ebc9300f8e724f37320b25370eced2f3162d401a2
ea1fcf2e7040dfd8c82be3c52be92543261bb856e386e9ce178191a6f8658346
eab371324c7bbbd47ed2e5cf380e6b4659cdf1e5ea0955938bda61221e91dc42
ebd62f3d971be5ced5132b3e10d4bec0d974cfa0d99010b2b9556d720f111f01
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efbfaee418ddbc99a9dd6ba614d9288ef68ab53d89a06a782905ce47c11e450a
f06cbdca806bc6faf9a484f72ccecb9e3a99496eba276e48a714beaea2be248b
f16a935d459a3bf85554bc55742924f23066053190a78a54904b6bf3e8a0140e
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f3039e343bc61cc16fc587e063d92cf190c34823df58e3fe5caf5717198a49fc
f65b5508c2f9bbd3c710004406377e2abe4b16d10cec73817efa063f9b23e49d
f95b3d6693589b312ddb5f07077356084260464af0163acc96319aab5d4f7e8a
faebcdbf65e220945ac2efd3cb7cb2318fd0cf884f3c794884e3a0e65de32fb9
faf5e994ddbada86a873b5d14c1bc0f449a097e61e6fbe0c04e0691b70ec5644
fb4ad401669d7f09714262088d3ad6fdd5a67ec95f8d921f94fa751915e76253
fe320334f2be59790333391688d2e6161a969e957e842bd6fdbc0aa73a1f37a5
fe377c5b5f11d6fa14a0340e4320e797185f1f07ec9f11f571682fd71b001533
fea91442f053cb7939c3d95b16b2eda5122146bb1a7cac1e36d2729618c720c6

www.35express.org Open in urlscan Pro 139.180.156.24 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

282 Requests

99 %HTTPS

84 %IPv6

16 Domains

20 Subdomains

20 IPs

4 Countries

5490 kBTransfer

9602 kBSize

2 Cookies

5 Outgoing links

Page URL History

Redirected requests

282 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.35express.org Open in urlscan Pro
139.180.156.24 Public Scan

Screenshot
Live screenshot

Full Image

282
Requests

99 %
HTTPS

84 %
IPv6

16
Domains

20
Subdomains

20
IPs

4
Countries

5490 kB
Transfer

9602 kB
Size

2
Cookies

282 HTTP transactions
8 data transactions