askleo.com Open in urlscan Pro
18.159.80.129 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Submission: On August 09 via manual (August 9th 2021, 12:44:52 pm UTC) from GB

Summary HTTP 283 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 37 IPs in 11 countries across 46 domains to perform 283 HTTP transactions. The main IP is 18.159.80.129, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is askleo.com.
TLS certificate: Issued by R3 on July 30th 2021. Valid for: 3 months.

This is the only time askleo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
40	18.159.80.129 18.159.80.129	16509 (AMAZON-02) (AMAZON-02)
20	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3036::ac43:a1d1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	13.32.21.201 13.32.21.201	16509 (AMAZON-02) (AMAZON-02)
49	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2600:9000:205... 2600:9000:2057:9a00:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
7	3.66.136.156 3.66.136.156	16509 (AMAZON-02) (AMAZON-02)
2	91.228.74.134 91.228.74.134	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
1	2600:9000:211... 2600:9000:211e:ce00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
21	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
1 5	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
34	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
6	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2006	15169 (GOOGLE) (GOOGLE)
8 34	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
3 7	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
3 5	185.33.220.241 185.33.220.241	29990 (ASN-APPNEX) (ASN-APPNEX)
10	2606:4700::68... 2606:4700::6810:c40	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
2 2	213.155.156.165 213.155.156.165	1299 (TELIANET ...) (TELIANET Telia Carrier)
2 2	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	18.185.208.29 18.185.208.29	16509 (AMAZON-02) (AMAZON-02)
2	52.198.4.47 52.198.4.47	16509 (AMAZON-02) (AMAZON-02)
2 2	217.66.147.169 217.66.147.169	29209 (SPBMTS-AS...) (SPBMTS-AS Malaya Monetnaya Street 2-A)
1 1	213.87.44.187 213.87.44.187	13174 (MTSNET Mo...) (MTSNET Moscow)
3 4	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
2	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
2 2	2a05:d018:24:... 2a05:d018:24:b001:197c:8ea4:869f:2648	16509 (AMAZON-02) (AMAZON-02)
1 1	185.86.138.131 185.86.138.131	201081 (SMARTADSE...) (SMARTADSERVER)
4 4	35.157.177.200 35.157.177.200	16509 (AMAZON-02) (AMAZON-02)
4 4	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	174.137.133.49 174.137.133.49	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1 1	81.222.128.213 81.222.128.213	20597 (ELTEL-AS) (ELTEL-AS)
2 2	37.157.2.236 37.157.2.236	198622 (ADFORM) (ADFORM)
2 2	216.52.2.39 216.52.2.39	30282 (AS-INAPCD...) (AS-INAPCDN-OCY)
1 1	2.18.235.93 2.18.235.93	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2606:4700::68... 2606:4700::6812:c05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
2 2	72.251.244.141 72.251.244.141	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
3 3	35.157.0.85 35.157.0.85	16509 (AMAZON-02) (AMAZON-02)
2 2	54.171.74.241 54.171.74.241	16509 (AMAZON-02) (AMAZON-02)
2 2	64.202.112.63 64.202.112.63	23352 (SERVERCEN...) (SERVERCENTRAL)
1 1	34.205.3.24 34.205.3.24	14618 (AMAZON-AES) (AMAZON-AES)
1	34.255.77.149 34.255.77.149	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
283	37

40 18.159.80.129 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com

askleo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:a1d1 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.21.201 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-21-201.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

49 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

askleo.askleomedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:9a00:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 3.66.136.156 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.228.74.134 (United Kingdom)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.se	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:ce00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.se	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 142.250.74.194 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.18.234.21 (Frankfurt am Main, Germany) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.33.220.241 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6810:c40 (United States)

ASN13335 (CLOUDFLARENET, US)

c.bannerflow.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1400 (United States)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.155.156.165 (Uppsala, Sweden) 2 redirects

ASN1299 (TELIANET Telia Carrier, SE)
PTR: 213-155-156-165.teliacarrier-cust.com

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.185.208.29 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-208-29.eu-central-1.compute.amazonaws.com

match.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.198.4.47 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-198-4-47.ap-northeast-1.compute.amazonaws.com

cc.adingo.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.66.147.169 (St Petersburg, Russian Federation) 2 redirects

ASN29209 (SPBMTS-AS Malaya Monetnaya Street 2-A, RU)
PTR: host-169-147-66-217.spbmts.ru

sm.rtb.mts.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.87.44.187 (Moscow, Russian Federation) 1 redirects

ASN13174 (MTSNET Moscow, Russia, RU)
PTR: infrastructure-187-44.mts.ru

tech.rtb.mts.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.64.218 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:d018:24:b001:197c:8ea4:869f:2648 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

sync.tidaltv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.138.131 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.157.177.200 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-177-200.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.126.56.137 (Frankfurt am Main, Germany) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)

rtb2-useast.e-volution.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.222.128.213 (Russian Federation) 1 redirects

ASN20597 (ELTEL-AS, RU)
PTR: ad13.adriver.ru

ssp.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.2.236 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.2.39 (United States) 2 redirects

ASN30282 (AS-INAPCDN-OCY, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.93 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com

cs.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:c05 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.49 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.244.141 (Amsterdam, Netherlands) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)
PTR: tracking-failover-02.ams2.m6r.eu

tracking.m6r.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.157.0.85 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.171.74.241 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-74-241.eu-west-1.compute.amazonaws.com

r.scoota.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.202.112.63 (United States) 2 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.205.3.24 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-205-3-24.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.77.149 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-77-149.eu-west-1.compute.amazonaws.com

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
68	doubleclick.net 8 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net googleads4.g.doubleclick.net cm.g.doubleclick.net	265 KB
54	googlesyndication.com 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	253 KB
49	askleomedia.com askleo.askleomedia.com	290 KB
40	askleo.com askleo.com	106 KB
11	google.com 1 redirects adservice.google.com www.google.com	2 KB
10	bannerflow.net c.bannerflow.net	115 KB
8	ezoic.net go.ezoic.net g.ezoic.net	2 KB
7	casalemedia.com 3 redirects dsum-sec.casalemedia.com	7 KB
6	2mdn.net s0.2mdn.net	398 KB
6	google.se adservice.google.se	818 B
5	ampproject.org cdn.ampproject.org	101 KB
5	adnxs.com 3 redirects ib.adnxs.com	5 KB
5	googletagservices.com www.googletagservices.com	178 KB
4	yahoo.com 4 redirects ups.analytics.yahoo.com	4 KB
4	advertising.com 4 redirects pixel.advertising.com	2 KB
4	openx.net 3 redirects us-u.openx.net	1 KB
4	amazon-adsystem.com c.amazon-adsystem.com	36 KB
3	bidswitch.net 3 redirects x.bidswitch.net	1 KB
3	mts.ru 3 redirects sm.rtb.mts.ru tech.rtb.mts.ru	2 KB
2	gstatic.com fonts.gstatic.com	31 KB
2	googleapis.com fonts.googleapis.com	1 KB
2	zemanta.com 2 redirects b1sync.zemanta.com	1 KB
2	scoota.co 2 redirects r.scoota.co	1 KB
2	m6r.eu 2 redirects tracking.m6r.eu	1 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com s.tribalfusion.com	1 KB
2	lijit.com 2 redirects ap.lijit.com	1 KB
2	adform.net 2 redirects c1.adform.net	1 KB
2	tidaltv.com 2 redirects sync.tidaltv.com	828 B
2	teads.tv sync.teads.tv	344 B
2	adingo.jp cc.adingo.jp	87 B
2	360yield.com 2 redirects match.360yield.com	788 B
2	pubmatic.com 2 redirects image6.pubmatic.com	1 KB
2	de17a.com 2 redirects d5p.de17a.com	722 B
2	quantserve.com secure.quantserve.com pixel.quantserve.com	9 KB
1	yieldmo.com ads.yieldmo.com	35 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com	731 B
1	everesttech.net 1 redirects sync-tm.everesttech.net	538 B
1	media.net 1 redirects cs.media.net	1 KB
1	adriver.ru 1 redirects ssp.adriver.ru	339 B
1	e-volution.ai rtb2-useast.e-volution.ai	233 B
1	smartadserver.com 1 redirects ssbsync.smartadserver.com	457 B
1	ctnsnet.com 1 redirects gcm.ctnsnet.com	479 B
1	dotomi.com dclk-match.dotomi.com	104 B
1	quantcount.com rules.quantcount.com	431 B
1	ezodn.com go.ezodn.com	106 KB
0	netmng.com Failed google2waycm.netmng.com Failed
283	46

	Domain	Requested by
49	askleo.askleomedia.com	askleo.com askleo.askleomedia.com
40	askleo.com	askleo.com askleo.askleomedia.com
34	cm.g.doubleclick.net	8 redirects googleads.g.doubleclick.net 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
27	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
22	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com googleads.g.doubleclick.net askleo.com cdn.ampproject.org
20	securepubads.g.doubleclick.net	askleo.com securepubads.g.doubleclick.net
10	c.bannerflow.net	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com c.bannerflow.net
8	googleads.g.doubleclick.net	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com askleo.com
7	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
7	g.ezoic.net	askleo.com
6	s0.2mdn.net	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com googleads.g.doubleclick.net askleo.com cdn.ampproject.org
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
6	adservice.google.com	securepubads.g.doubleclick.net
6	adservice.google.se	securepubads.g.doubleclick.net
5	cdn.ampproject.org	securepubads.g.doubleclick.net
5	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
5	www.googletagservices.com	securepubads.g.doubleclick.net 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
5	www.google.com	1 redirects tpc.googlesyndication.com 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com askleo.com
5	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	ups.analytics.yahoo.com	4 redirects
4	pixel.advertising.com	4 redirects
4	us-u.openx.net	3 redirects googleads.g.doubleclick.net
4	c.amazon-adsystem.com	askleo.com c.amazon-adsystem.com
3	x.bidswitch.net	3 redirects
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	securepubads.g.doubleclick.net
2	b1sync.zemanta.com	2 redirects
2	r.scoota.co	2 redirects
2	tracking.m6r.eu	2 redirects
2	ap.lijit.com	2 redirects
2	c1.adform.net	2 redirects
2	sync.tidaltv.com	2 redirects
2	sync.teads.tv	googleads.g.doubleclick.net
2	sm.rtb.mts.ru	2 redirects
2	cc.adingo.jp	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
2	match.360yield.com	2 redirects
2	image6.pubmatic.com	2 redirects
2	d5p.de17a.com	2 redirects
1	ads.yieldmo.com	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
1	sync.srv.stackadapt.com	1 redirects
1	sync-tm.everesttech.net	1 redirects
1	s.tribalfusion.com
1	a.tribalfusion.com	1 redirects
1	cs.media.net	1 redirects
1	ssp.adriver.ru	1 redirects
1	rtb2-useast.e-volution.ai	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
1	ssbsync.smartadserver.com	1 redirects
1	gcm.ctnsnet.com	1 redirects
1	tech.rtb.mts.ru	1 redirects
1	dclk-match.dotomi.com	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
1	pixel.quantserve.com	askleo.com
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	askleo.com
1	go.ezoic.net	askleo.com
1	go.ezodn.com	askleo.com
0	google2waycm.netmng.com Failed	0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
283	56

This site contains links to these domains. Also see Links.

Domain
newsletter.askleo.com
askleo.askleomedia.com
med.askleomedia.com
aud.askleomedia.com
itunes.apple.com
youtu.be
ask-leo.com
www.openpec.org
www.poste-certificate.it
en.wikipedia.org
generatepress.com
www.ezoic.com
creativecommons.org

Subject Issuer	Validity	Valid
askleo.com R3	`2021-07-30` - `2021-10-28`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-05` - `2022-07-04`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
askleo.askleomedia.com R3	`2021-07-12` - `2021-10-10`	3 months	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
ezoic.net R3	`2021-07-22` - `2021-10-20`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.google.se GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.adingo.jp DigiCert TLS RSA SHA256 2020 CA1	`2021-03-26` - `2022-04-14`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
teads.tv R3	`2021-06-14` - `2021-09-12`	3 months	crt.sh
*.e-volution.ai Sectigo RSA Domain Validation Secure Server CA	`2020-09-14` - `2021-09-14`	a year	crt.sh
*.yieldmo.com Amazon	`2021-05-25` - `2022-06-23`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-12` - `2021-10-04`	3 months	crt.sh

This page contains 20 frames:

Primary Page: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Frame ID: 4702D31494A334B88D22D676BBF0394D
Requests: 145 HTTP requests in this frame

Frame: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 853EE57FF32CDF7B9A9F7B4388C9CA4A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: D2327A409A47E1E9703AE8020E4CA097
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 948221A53E6178821AEC126ED30BD4B7
Requests: 1 HTTP requests in this frame

Frame: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: BFFDD90A315108153ECCDC081BC6A038
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXkRIQs9JQITCcZRfmTiGEf_bpirvIszeP5v6i5jdJYdlO2HSd9MWEwboMmWSqSXEaMm2CHqggr7HqLbmE5DB_S5PKWgOtYqai4X9JGjl6-Od0_FZPBI0fPuFUpWt-2mZqcFLyjR0JTvwmtjIzq65AQZs4d9A_FfjW4vnPEPl0-COjSEe-x9tP28yzkkMVGPeoF65YHFNwWn5b5euImPPvjoWCBEQ
Frame ID: 372079931BB6BD4B61B99A4274E4212B
Requests: 5 HTTP requests in this frame

Frame: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: F26913115A8AE108AD5CB13B75D5248A
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 7489DA0F2FBD05FD25D27606CA1D5676
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 6661DDC1E8E43C5AAA05CE25BB9F4348
Requests: 9 HTTP requests in this frame

Frame: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 280D2C9A77257993B464ABABBD4D06AD
Requests: 15 HTTP requests in this frame

Frame: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 3FCB43A9FF5E4ED3F2D8B7C43E5EADE8
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXnIiQbeye4fHnPMW4wPmdTkWem7aTseplhpMJ4NnEAgYZp6cC5bfgmSTEVfjIBMPw4oBjLN0SxWHBMyL9DBgxU1LyOhSEKJfjQyPltWo58ZL1mVsqdqHQSneThIVl7MtMAFd318i7Iptc0qe5RorT5NkQ39KhDzexIliJlTB3ZHHvKyjwNymyd867HsbBuu8c97CJMVgxHRLvuG4_J8eHMtF-f3A
Frame ID: EDFD8F61ED378714452D1C24D83E2DE7
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg
Frame ID: 6B87E427EF082D353F1EEEE2E8BCB0B1
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 5300F490D3F751B9A7B741E6E0FC3A39
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D014D03A4BB6074089BAFDA1D7C71CAE
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E7102EF3E7D95C5F4F48880C3EA978BB
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4EF2BA6FFE21AE6D2E0162AE91494250
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 3276832E71610CE9D02889A786E17651
Requests: 9 HTTP requests in this frame

Frame: https://c.bannerflow.net/io/api/image/optimizepositionedimage?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fsvea-ekonomi%2F5992fc9c5aa6dc1994b532b6%2Fimages%2F06af0316-b97d-4bbd-a63e-b0d0f2a06a23.jpg&w=220&h=115&q=90&f=webp&positionX=0&positionY=56
Frame ID: 7F671459D9BFA95A0BFAC2456E9437E9
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012107240354000/amp4ads-v0.mjs
Frame ID: 5108F1AB4F2B4296EA2EC1F140615E9A
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

Page Statistics

283
Requests

99 %
HTTPS

39 %
IPv6

46
Domains

56
Subdomains

37
IPs

11
Countries

1900 kB
Transfer

5143 kB
Size

8
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://newsletter.askleo.com/
Title: Newsletter

Search URL Search Domain Scan URL

URL: https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1.png
Title: <picture class="wp-image-80432 size-600x"> <source type="image/webp" srcset="https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-600x854.png.webp 600w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-105x150.png.webp 105w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-300x427.png.webp 300w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-768x1093.png.webp 768w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-1200x1708.png.webp 1200w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1.png.webp 1454w" sizes="(max-width: 600px) 100vw, 600px"/> <img src="https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-600x854.png" alt="Add an Account in the Windows Mail program" width="600" height="854" srcset="https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-600x854.png 600w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-105x150.png 105w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-300x427.png 300w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-768x1093.png 768w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1-1200x1708.png 1200w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-an-account-1.png 1454w" sizes="(max-width: 600px) 100vw, 600px"/> </picture>

Search URL Search Domain Scan URL

URL: https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account.png
Title: <picture class="wp-image-80433 size-600x"> <source type="image/webp" srcset="https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-600x854.png.webp 600w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-105x150.png.webp 105w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-300x427.png.webp 300w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-768x1093.png.webp 768w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-1200x1708.png.webp 1200w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account.png.webp 1454w" sizes="(max-width: 600px) 100vw, 600px"/> <img src="https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-600x854.png" alt="Adding a fake From: to an account configuration" width="600" height="854" srcset="https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-600x854.png 600w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-105x150.png 105w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-300x427.png 300w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-768x1093.png 768w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account-1200x1708.png 1200w, https://askleo.askleomedia.com/wp-content/uploads/2015/02/add-a-fake-account.png 1454w" sizes="(max-width: 600px) 100vw, 600px"/> </picture>

Search URL Search Domain Scan URL

URL: https://med.askleomedia.com/2020/10_reasons_your_computer_is_slow_v2.pdf
Title: <img src="https://img.askleomedia.com/2020/slowcomp-3d-thumb.png" alt="10 Reasons Your Computer is Slow" title="10 Reasons Your Computer is Slow" style="width:200px; float: right"/>

Search URL Search Domain Scan URL

URL: https://aud.askleomedia.com/2019/3370.mp3
Title: <img src="https://askleo.askleomedia.com/wp-content/plugins/powerpress/play_audio.png" title="Play" alt="Play" style="border:0;" width="23px" height="24px"/>

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/the-ask-leo!-podcast/id933458901?mt=2&ls=1#episodeGuid=http%3A%2F%2Fask-leo.com%2Fhow_do_spammers_send_email_that_looks_like_it_comes_from_me.html
Title: Apple Podcasts

Search URL Search Domain Scan URL

URL: https://youtu.be/vt5p7JgSBVs
Title: <img src="https://vid.askleomedia.com/yt2019/3370-360.jpg" height="360" width="640" style="position:relative; left:0; top:0;"/><img src="https://img.askleomedia.com/i/playbutton33.png" height="360" width="640" style="position:absolute; top:0; left:0"/>

Search URL Search Domain Scan URL

URL: http://ask-leo.com/someones_sending_email_that_looks_like_its_from_me_to_my_contacts_what_can_i_do.html
Title: Someone’s sending email that looks like it’s from me to my contacts, what can I do?

Search URL Search Domain Scan URL

URL: http://ask-leo.com/is_changing_my_password_enough.html
Title: change much more than your password

Search URL Search Domain Scan URL

URL: http://ask-leo.com/thunderbird_a_free_open_source_and_powerful_email_client.html
Title: Thunderbird

Search URL Search Domain Scan URL

URL: http://ask-leo.com/are_free_email_services_worth_it.html
Title: I avoid free

Search URL Search Domain Scan URL

URL: http://ask-leo.com/what_forpay_email_providers_do_you_recommend.html
Title: those with customer service

Search URL Search Domain Scan URL

URL: http://ask-leo.com/google_mail_free_email_that_works_and_leaves_you_in_control.html
Title: Gmail

Search URL Search Domain Scan URL

URL: http://www.openpec.org/eng/index.shtml
Title: http://www.openpec.org/eng/index.shtml

Search URL Search Domain Scan URL

URL: http://www.poste-certificate.it/
Title: PEC aziende

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Email_spoofing
Title: https://en.wikipedia.org/wiki/Email_spoofing

Search URL Search Domain Scan URL

URL: https://generatepress.com/
Title: GeneratePress

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

URL: http://creativecommons.org/licenses/by-nc-nd/4.0/
Title: <img alt="Creative Commons License" style="border-width:0" src="https://img.askleomedia.com/2020/ccbyncnd88x31.png" />

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENMPmM6Xx82j1iapvLh25pY&google_cver=1

Request Chain 123

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YREjNJ2jDfJTkAkNeh-oiwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1

Request Chain 124

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESENFkMRpNr-MI0XcTRAnAfDk&google_cver=1

Request Chain 125

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D

Request Chain 171

https://d5p.de17a.com/cookies/google?google_gid=CAESEFyeeLwwD_xHxZUZPlssepg&google_cver=1&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJVGkDAr HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEFyeeLwwD_xHxZUZPlssepg&google_cver=1&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJVGkDAr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJVGkDAr

Request Chain 172

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEAHC9t_aRgZS1o2gn0Gajfc&google_cver=1&google_push=AYg5qPJsaxxRISzFWB3SwjrmdohBmui4jIM_HOfCAaSreFK-Ni3Qn5MVT9j0uhaYo_god_WA_p44ENKcKBcZfQshvaPqp5gOxPlN HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEAHC9t_aRgZS1o2gn0Gajfc&google_cver=1&google_push=AYg5qPJsaxxRISzFWB3SwjrmdohBmui4jIM_HOfCAaSreFK-Ni3Qn5MVT9j0uhaYo_god_WA_p44ENKcKBcZfQshvaPqp5gOxPlN&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tsOrzOSiQyScRv8-ll94FA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJsaxxRISzFWB3SwjrmdohBmui4jIM_HOfCAaSreFK-Ni3Qn5MVT9j0uhaYo_god_WA_p44ENKcKBcZfQshvaPqp5gOxPlN

Request Chain 173

https://match.360yield.com/match/ebda?google_gid=CAESEOymQufsRhv0l-vcJdTC5UU&google_cver=1&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDSNLvpBbyQjI8 HTTP 302
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEOymQufsRhv0l-vcJdTC5UU&google_cver=1&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDSNLvpBbyQjI8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=c3LyrumMRmqfSVyY2xsIug&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDSNLvpBbyQjI8

Request Chain 175

https://sm.rtb.mts.ru/p?ssp=googleban&pm=1&google_gid=CAESEOmMbWGhs0rNncRtGOYi240&google_cver=1&google_push=AYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSkDqqN9pufkEYPA HTTP 301
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Da15cd32e-288a-4d31-8fc2-10952e8d8120%26google_push%3DAYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSkDqqN9pufkEYPA&ssp=googleban&exu=CAESEOmMbWGhs0rNncRtGOYi240 HTTP 301
https://tech.rtb.mts.ru/?dsp_uid=a15cd32e-288a-4d31-8fc2-10952e8d8120&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Da15cd32e-288a-4d31-8fc2-10952e8d8120%26google_push%3DAYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSkDqqN9pufkEYPA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=a15cd32e-288a-4d31-8fc2-10952e8d8120&google_push=AYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSkDqqN9pufkEYPA

Request Chain 183

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1

Request Chain 184

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YREjNJ2jDfJTkAkNeh-oiwAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1

Request Chain 185

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEF9EkP8eds1ko6MnRv8612M&google_cver=1

Request Chain 186

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D

Request Chain 194

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKgGM07CMNAhMig0djbjJdw&google_cver=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKgGM07CMNAhMig0djbjJdw&google_cver=1

Request Chain 195

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTQ0YTU1YTItOGIyZS0yYzc5LWNlM2ItMjJlYzQ1MDQwNTRl

Request Chain 196

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESENBHqIlAzB2mdSYWTc51qNc&google_cver=1

Request Chain 210

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEFGDZFTTLt4aITxdYbw7riM&google_cver=1&google_push=AYg5qPIhu19Qd5EUJvwoQWEaUwUS_OM_KaSB5FVa7WSG-cN1eT2gEMPGwd4VqsLTes8Gh301gAGvM4F4466Law3KpsBVIYjz9tCf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIhu19Qd5EUJvwoQWEaUwUS_OM_KaSB5FVa7WSG-cN1eT2gEMPGwd4VqsLTes8Gh301gAGvM4F4466Law3KpsBVIYjz9tCf&google_hm=x8Q6gqpSRoSEm1yPG70Bvbw

Request Chain 211

https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESENcPARH-AW61vlFTnDZje-8&google_cver=1&google_push=AYg5qPLwYJjUlD7aUBDJbkxt2e9H_TJrQ7c0KPKUQ_5YUEpHjmxipuZNZy_e1Io30td1KUzdIjoZdeXRjX1u4PQ1omx1ZwJMFYRt HTTP 302
https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESENcPARH-AW61vlFTnDZje-8&google_cver=1&google_push=AYg5qPLwYJjUlD7aUBDJbkxt2e9H_TJrQ7c0KPKUQ_5YUEpHjmxipuZNZy_e1Io30td1KUzdIjoZdeXRjX1u4PQ1omx1ZwJMFYRt&s_h=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=eF0Y8qrxTBGVsbdH20NyNA&gdpr=1&gdpr_consent=

Request Chain 213

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEN8Dmd7TyUzE2gad-_s8V08&google_cver=1&google_push=AYg5qPLcmf5EFCe682M3xF3pxMiswimXSiTSimkkAskyEI-b5cyOlbhKdrLpFYPN9Oj-95BHO5FmuQpJsxk_0bNNzfUXOplsm1Dr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLcmf5EFCe682M3xF3pxMiswimXSiTSimkkAskyEI-b5cyOlbhKdrLpFYPN9Oj-95BHO5FmuQpJsxk_0bNNzfUXOplsm1Dr&google_hm=MTE5MDQ0ODMxNzcxNTM5NzY3Mg%3D%3D

Request Chain 214

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEG3izMgWshuo1588DNAgouQ&google_cver=1&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1Am8SsiYT54da1jAJ1SNdA6jSo_zKuavHTzQw HTTP 302
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEG3izMgWshuo1588DNAgouQ&google_cver=1&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1Am8SsiYT54da1jAJ1SNdA6jSo_zKuavHTzQw&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEG3izMgWshuo1588DNAgouQ&google_cver=1&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1Am8SsiYT54da1jAJ1SNdA6jSo_zKuavHTzQw&apid=UP8e844258-f90f-11eb-a6a5-02902a482d8c HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1Am8SsiYT54da1jAJ1SNdA6jSo_zKuavHTzQw

Request Chain 216

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJdEzlw7gNyNbCsnkFpBApE&google_cver=1&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1Dk8Ogk00bY0qs2U4CL7U--1Jrbd7Q HTTP 302
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJdEzlw7gNyNbCsnkFpBApE&google_cver=1&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1Dk8Ogk00bY0qs2U4CL7U--1Jrbd7Q&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uLjdVRm5ORTJ1RTFDNDdVaHp4M0cwUGQzVWlRdGo0N35B&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1Dk8Ogk00bY0qs2U4CL7U--1Jrbd7Q

Request Chain 218

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEDHxYMdgFjhBCzvGg6yEbjo&google_cver=1&google_push=AYg5qPL_JSs0keOwo5qyTFKVjqZWjp8o1HoDH8joNdkAGoK10KRtLscE4YxJc__d8JbClpZxKdhkqq8aOj-GB7G6A3CcfMmd20M HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL_JSs0keOwo5qyTFKVjqZWjp8o1HoDH8joNdkAGoK10KRtLscE4YxJc__d8JbClpZxKdhkqq8aOj-GB7G6A3CcfMmd20M&google_hm=QXhqemtjekFnbzZGbHB4UGlBYkl0Ymc=

Request Chain 219

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGW1DvMRey_4LpFaPO6xmbw&google_cver=1&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP1EZAaxNVuH367FZx_zWG9v HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEGW1DvMRey_4LpFaPO6xmbw&google_cver=1&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP1EZAaxNVuH367FZx_zWG9v HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjkxNjcyNjI3NDg2MzYwODUxMQ&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP1EZAaxNVuH367FZx_zWG9v

Request Chain 220

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENvgo0HrxLmpxVGxm4Ciwrk&google_cver=1&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5ejywyZAE7PST HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENvgo0HrxLmpxVGxm4Ciwrk&google_cver=1&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5ejywyZAE7PST&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5ejywyZAE7PST&google_hm=4cb1d35a7f5f360c72963d83

Request Chain 221

https://cs.media.net/cksync?type=g&google_gid=CAESEDupsQ4ypaaqX6UOP6LokrM&google_cver=1&google_push=AYg5qPJGz1OZ2iW8o2Ba5diVw8n0V41pxPwKc1ORQ3R7h_jUcZOl6WmducEn_AUzR3SeIVd8y7FDs2rM_nRXKqGj3WtgGoWsVoMB HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&mn_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJGz1OZ2iW8o2Ba5diVw8n0V41pxPwKc1ORQ3R7h_jUcZOl6WmducEn_AUzR3SeIVd8y7FDs2rM_nRXKqGj3WtgGoWsVoMB&gdpr=&gdpr_consent=

Request Chain 223

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPQU8fsTq5pMBZIv8FVE_PU&google_cver=1&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lAQXOvX6hBIXDmJ2LKasQ86Wd_No03rBmjP6vA HTTP 302
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPQU8fsTq5pMBZIv8FVE_PU&google_cver=1&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lAQXOvX6hBIXDmJ2LKasQ86Wd_No03rBmjP6vA&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPQU8fsTq5pMBZIv8FVE_PU&google_cver=1&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lAQXOvX6hBIXDmJ2LKasQ86Wd_No03rBmjP6vA&apid=UP8e844258-f90f-11eb-a6a5-02902a482d8c HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lAQXOvX6hBIXDmJ2LKasQ86Wd_No03rBmjP6vA

Request Chain 224

https://ads.avads.net/sync/ggl?google_gid=CAESEKiqR1Gn6tHhuW2QQNEJE4A&google_cver=1&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://ads.avads.net/sync/ggl?google_gid=CAESEKiqR1Gn6tHhuW2QQNEJE4A&google_cver=1&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w&av_tc=True HTTP 302
https://ads.avads.net/sync/ggl?google_gid=CAESEKiqR1Gn6tHhuW2QQNEJE4A&google_cver=1&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w&google_tc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w&google_tc=

Request Chain 227

https://a.tribalfusion.com/i.match?p=b6&u=CAESEIA0Rl_VFUbEKFxYe_UpyDc&google_cver=1&google_push=AYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIA0Rl_VFUbEKFxYe_UpyDc&google_cver=1&google_push=AYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 228

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEGS3Yhvx9r0mqwejBgXeuTU&google_cver=1&google_push=AYg5qPL2Z2N6HbRMkHJtz0lnnxsBiO_40xlubPENM1NdH4EdYoGMEg1_dxrtjw6u0nTYrawwNJUKLZxS_eXZZaquYR1-3LuiyFYB HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGS3Yhvx9r0mqwejBgXeuTU&google_push=AYg5qPL2Z2N6HbRMkHJtz0lnnxsBiO_40xlubPENM1NdH4EdYoGMEg1_dxrtjw6u0nTYrawwNJUKLZxS_eXZZaquYR1-3LuiyFYB

Request Chain 229

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEBDic7k8daY0J_q4AAEnRxk&google_cver=1&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j2z3JAGXQ_pVe_JK0Ge0Od5zw0MzCPFq40Nncz8 HTTP 302
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEBDic7k8daY0J_q4AAEnRxk&google_cver=1&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j2z3JAGXQ_pVe_JK0Ge0Od5zw0MzCPFq40Nncz8&checkcookies=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=KUh8XJW5seUIlWSdTfcv6A&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j2z3JAGXQ_pVe_JK0Ge0Od5zw0MzCPFq40Nncz8

Request Chain 230

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEC-FI_hVZAIFapnXak-qn5c&google_cver=1&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ5OCOlnAN HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEC-FI_hVZAIFapnXak-qn5c&google_cver=1&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ5OCOlnAN HTTP 302
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google HTTP 302
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=5391d056-113f-40af-b8d7-3382391a01bd&ssp=google HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ5OCOlnAN&google_hm=OO3rHX9iS1W6MiXVKLZ_Fg==

Request Chain 231

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEP-MDyoX0i3NDUuyFv1OTPw&google_cver=1&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeAdGWxxVnUsOuHmuG HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEP-MDyoX0i3NDUuyFv1OTPw&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeAdGWxxVnUsOuHmuG&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeAdGWxxVnUsOuHmuG&google_hm=V2QybU1GNUNydWpWRzJWZ2lKczQ=

Request Chain 232

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESECmmoMgZ4Nfq4asBpMjz82E&google_cver=1&google_push=AYg5qPKNQf3du4s1lP69f1tHDGDi4TKndZ5twp0A7yWeeiWxcdFEpZpH2gpXYMP3smBJ0Rd2wnHWSaqmHX_YsIv6kAHuKCs90dUh HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=A3q4D32mSKFqIgxZlHl6jCV40bw&google_push=AYg5qPKNQf3du4s1lP69f1tHDGDi4TKndZ5twp0A7yWeeiWxcdFEpZpH2gpXYMP3smBJ0Rd2wnHWSaqmHX_YsIv6kAHuKCs90dUh

Request Chain 285

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

283 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/ 378 KB
65 KB 1156ms
1013ms Document
text/html 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 677e71301ff7f0d87fe843b9f36498b4a17fe55e586678ae1f28a1ace250a7e0

Request headers

:method: GET
:authority: askleo.com
:scheme: https
:path: /from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control: max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 09 Aug 2021 12:44:30 GMT
display: pub_site_sol
expires: Sun, 08 Aug 2021 12:44:30 GMT
last-modified: Fri, 06 Aug 2021 02:23:55 GMT
pagespeed: off
response: 200
server: nginx
set-cookie: ezoadgid_173078=-1; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 13:14:29 UTC ezoref_173078=; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 14:44:29 UTC ezoab_173078=mod32-c; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 14:44:29 UTC active_template::173078=pub_site.1628513069; Path=/; Domain=askleo.com; Expires=Wed, 11 Aug 2021 12:44:29 UTC ezopvc_173078=1; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 13:14:30 UTC ezepvv=1063; Path=/; Domain=askleo.com; Expires=Tue, 10 Aug 2021 12:44:30 UTC ezovid_173078=741881402; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 13:14:30 UTC lp_173078=https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 13:14:30 UTC ezovuuidtime_173078=1628513070; Path=/; Domain=askleo.com; Expires=Wed, 11 Aug 2021 12:44:30 UTC ezovuuid_173078=3f71c7d9-9de9-4d45-6006-60e4bb248cfd; Path=/; Domain=askleo.com; Expires=Mon, 09 Aug 2021 13:14:30 UTC ezCMPCCS=true; Path=/; Domain=askleo.com; Expires=Tue, 09 Aug 2022 12:44:30 GMT
vary: Accept-Encoding Accept-Encoding,Cookie,User-Agent
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-sol: pub_site

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 71 KB
25 KB 225ms
64ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

3308cdd33248924ba53448a8bd037fe04c77df79bc773b50198a071dde70d511

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "953 / 519 of 1000 / last-modified: 1628507628"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24965
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:30 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 350 KB
106 KB 49ms
29ms Script
application/javascript 2606:4700:3036::ac43:a1d1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,ix,luponmedia,oftmedia,oneVideo,onetag,pubmatic,pubmatic,rhythmone,rubicon,spotx,unruly&cb=195-2-26
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:a1d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d20d28ad499e12da822dbbcba173c9a455951c98db09566e9e382634ad5ec402

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1067703
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v7TKkyoZJeLaADdWl%2BjraKDrkqRLoBQFJev2fZC%2FXWoTPyHRWOmJaqQBYfJzAu%2FcKqlfISGkIaBiveeQMqpV4xlZEo5LjJvd3O00e4pQs3sennkFXMgiCuNPT9no2azyQTnoAZ4NCPlVrB4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 67c113826a8e4eeb-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 123 KB
33 KB 194ms
64ms Script
application/javascript 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.21.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-21-201.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: cdBhoWYDE8U.miXtMaq72_QdUztpgDZw
content-encoding: gzip
server: Server
age: 161
etag: f8520ea4ebd91256d6b4f461d472242a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 7d3c59ee1b45f72158a8cbce053c8978.cloudfront.net (CloudFront)
cache-control: public, max-age=900
date: Mon, 09 Aug 2021 12:41:49 GMT
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: gbxkKMEG5qUUCLR6B8d5MM3OyUvzromGi2tEEQKzvCcnOy9fXXepag==

GET
H2 200 banger.js Show response
askleo.com/porpoiseant/ 45 KB
10 KB 63ms
54ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 46fe1e70ee65fb4c830d4c6ed315119e499efc0b8e18245f5b26a9860ae55f16

Request headers

:path: /porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 style.min.css
askleo.askleomedia.com/wp-includes/css/dist/block-library/ 79 KB
10 KB 120ms
30ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 9945
response: 200
last-modified: Wed, 21 Jul 2021 04:58:05 GMT
server: nginx
etag: "1626843485"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds225.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 vendors-style.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/ 3 KB
1009 B 125ms
35ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-style.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ae707ec81b142f04b6d5f785a5d4f7e8301bdb62a95288dee1f3e58930d21c7a

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 909
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds041.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 style.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/ 177 KB
17 KB 124ms
35ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7a69a2ab7aa55e3e41ba63a625ecfd3b6c00933a7e18d1f33275b83abd3bd8d

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 17488
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds068.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 tooltip.min.css
askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/css/ 11 KB
3 KB 170ms
81ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/css/tooltip.min.css?ver=5.8
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 8a12cd1ba53519b9b8f531f062e149c5b29ddcf92c45df0c873ca6a21aa086f8

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 2663
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "1626185109"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds003.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 dashicons.min.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-includes/css/ 58 KB
34 KB 147ms
58ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-includes/css/dashicons.min.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 8276d99808a3a111dcb2dc61c895388c21341d48be9c3f87d905787a49c2b832

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 35138
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds234.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 animate.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/TooltipProEcommerce/assets/css/ 57 KB
4 KB 167ms
79ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/TooltipProEcommerce/assets/css/animate.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: edaa305a75e55c4bc4687fc43cc9778cb8c86cff4fae321402ea9494a0a605b4

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 3848
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds207.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 askleo.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/askleo-internal/ 8 KB
2 KB 176ms
88ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/askleo-internal/askleo.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ad1daeb0c017c11c68df7e8c08916788e2dcf248e26df4f032ba6c1e148b481e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 1878
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds224.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 foobox.min.css
askleo.askleomedia.com/wp-content/plugins/foobox-image-lightbox-premium/pro/css/ 102 KB
10 KB 176ms
88ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/foobox-image-lightbox-premium/pro/css/foobox.min.css?ver=2.7.16
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 2620ea80d4b627207ed8ee055d6db3b460e241936dbede10f54cd5bf26653c6b

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 10211
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "1626185109"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds023.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 1-popupally-pro-style.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/popupally-pro-scripts/ 20 KB
2 KB 179ms
91ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/popupally-pro-scripts/1-popupally-pro-style.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 39d5cdc19374a44077c4246db6f442209b230d42642019e056574a20090403c4

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 1688
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds226.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 woocommerce-layout.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/assets/css/ 18 KB
2 KB 167ms
79ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 48052f6267b2e21fb086ad26457c715b3b8b5e8c6fcbcdea42589da06b05e9be

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 2374
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds067.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 woocommerce.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/assets/css/ 62 KB
8 KB 180ms
93ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/woocommerce/assets/css/woocommerce.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: c3b9547ad5efb844125a3f9751483384a257a2a3a33d34b461ef62ca61f0845d

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 8481
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds231.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 wc-memberships-frontend.min.css
askleo.askleomedia.com/wp-content/plugins/woocommerce-memberships/assets/css/frontend/ 4 KB
772 B 168ms
80ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/woocommerce-memberships/assets/css/frontend/wc-memberships-frontend.min.css?ver=1.21.8
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: cef56cfb50af106eee13a8077d15efd46d114217ffa7446463414fb8b25e028e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 660
response: 200
last-modified: Tue, 29 Jun 2021 16:36:38 GMT
server: nginx
etag: "1624984598"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds046.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 unsemantic-grid.min.css
askleo.askleomedia.com/wp-content/themes/generatepress/assets/css/ 12 KB
2 KB 183ms
96ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/themes/generatepress/assets/css/unsemantic-grid.min.css?ver=3.0.4
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 7ee7784d217b273bd847dcc83ca3451f76f63cc1b619805dbdb297197bb44eb8

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 1652
response: 200
last-modified: Wed, 14 Jul 2021 15:11:48 GMT
server: nginx
etag: "1626275508"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds212.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 style.min.css
askleo.askleomedia.com/wp-content/themes/generatepress/assets/css/ 21 KB
5 KB 170ms
83ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/themes/generatepress/assets/css/style.min.css?ver=3.0.4
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 83d6a90d1dee1d91b0513febd572f8b5c807454c5c1c7baedf3cd5251ac7de07

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 4852
response: 200
last-modified: Wed, 14 Jul 2021 15:11:48 GMT
server: nginx
etag: "1626275508"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds203.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 mobile.min.css
askleo.askleomedia.com/wp-content/themes/generatepress/assets/css/ 4 KB
1 KB 169ms
82ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/themes/generatepress/assets/css/mobile.min.css?ver=3.0.4
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 5b29f10d6e7c79c2f7f11b0abe16a4fb45e29673dababd29a0313d72aeaa90b5

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 973
response: 200
last-modified: Wed, 14 Jul 2021 15:11:48 GMT
server: nginx
etag: "1626275508"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds055.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 font-icons.min.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/themes/generatepress/assets/css/components/ 3 KB
791 B 171ms
85ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/themes/generatepress/assets/css/components/font-icons.min.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: dd4993e5c6015cb663a4ff917d77897ed71deda6eedaed515b41326305b3ed72

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 691
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds053.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 style.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/themes/askleo-generatepress/ 4 KB
1 KB 171ms
85ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/themes/askleo-generatepress/style.css?ver=1628216471
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ca365af1bccae26f47327961da261d6851977cd77fdade42589a3c8839cbdb75

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 983
response: 200
last-modified: Fri, 06 Aug 2021 02:21:11 GMT
server: nginx
etag: "1628216471"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds041.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 navigation-branding.min.css
askleo.askleomedia.com/wp-content/plugins/gp-premium/menu-plus/functions/css/ 3 KB
698 B 170ms
85ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/gp-premium/menu-plus/functions/css/navigation-branding.min.css?ver=2.0.3
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 1cc5fba1b17b26c8975d63d581f375152c583264b4ba58a2d2eacac2d11d90ee

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 586
response: 200
last-modified: Wed, 21 Jul 2021 17:04:29 GMT
server: nginx
etag: "1626887069"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds073.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 woocommerce.min.css
askleo.askleomedia.com/wp-content/plugins/gp-premium/woocommerce/functions/css/ 24 KB
5 KB 171ms
86ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/gp-premium/woocommerce/functions/css/woocommerce.min.css?ver=2.0.3
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 2087d023c149cf3b8c828e94c7c057c759648209f45447774b40c67f1b288ba1

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 4596
response: 200
last-modified: Wed, 21 Jul 2021 17:04:29 GMT
server: nginx
etag: "1626887069"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds028.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 icons.min.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/gp-premium/general/icons/ 575 B
285 B 167ms
82ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/gp-premium/general/icons/icons.min.css?ver=1628216472
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ed1449a3d34f0c975f912645da2e304003524c91ba5c80e3ab9907cf2768654e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 173
response: 200
last-modified: Fri, 06 Aug 2021 02:21:12 GMT
server: nginx
etag: "1628216472"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds228.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 jquery.min.js Show response
askleo.askleomedia.com/wp-includes/js/jquery/ 87 KB
30 KB 181ms
96ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 30310
response: 200
last-modified: Wed, 21 Jul 2021 04:58:05 GMT
server: nginx
etag: "1626843485"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds040.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 jquery-migrate.min.js Show response
askleo.askleomedia.com/wp-includes/js/jquery/ 11 KB
4 KB 37ms
28ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 3998
response: 200
last-modified: Sat, 13 Feb 2021 08:47:26 GMT
server: nginx/1.16.0
etag: "1613206046"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds201.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public
accept-ranges: bytes

GET
H2 200 core.min.js Show response
askleo.askleomedia.com/wp-includes/js/jquery/ui/ 20 KB
7 KB 37ms
29ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 0cd851e5b33af0fbb354df65506da39807b998e07723f3d08aba5179fa2ed97e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 6596
response: 200
last-modified: Fri, 23 Apr 2021 18:46:13 GMT
server: nginx/1.16.0
etag: "1619203573"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds206.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public
accept-ranges: bytes

GET
H2 200 cm-related-articles.js Show response
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/TooltipProEcommerce/assets/js/ 2 KB
653 B 38ms
30ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/TooltipProEcommerce/assets/js/cm-related-articles.js?ver=1628216472
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: dbdbacda218432f315ac3e50c11c793d3b095afce52955d97a56ef7bd680bd8e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 554
response: 200
last-modified: Fri, 06 Aug 2021 02:21:12 GMT
server: nginx
etag: "1628216472"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds218.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 modernizr.min.js Show response
askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/js/ 2 KB
1 KB 38ms
30ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/js/modernizr.min.js?ver=3.9.14
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 1d679474c62830d6a3e51724af7fb034d9151eea7168bf3b02a715a4dfdb3fd5

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;f4282a73b14ac36d609d4cb6870b672a;2-173078-2;3ae504a7-a720-4f7f-75b1-1ad6c7e0e358
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1082
response: 200
last-modified: Mon, 10 May 2021 18:15:33 GMT
server: nginx/1.16.0
etag: "1620670533"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds211.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public,max-age=2591998
accept-ranges: bytes

GET
H2 200 jquery.flip.min.js Show response
askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/js/ 5 KB
2 KB 44ms
37ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/js/jquery.flip.min.js?ver=3.9.14
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: c460b99f65b6c9db943bdee926064c37d4e1ea4f7f6309c958861e97d22f23d2

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;f5bf78b33216592eb4772139e7a8ae4f;2-173078-2;ec3d7d47-4569-467a-7e08-42e565af1988
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1662
response: 200
last-modified: Mon, 10 May 2021 18:15:33 GMT
server: nginx/1.16.0
etag: "1620670533"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds010.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public,max-age=2591998
accept-ranges: bytes

GET
H2 200 mediaelement-and-player.min.js Show response
askleo.askleomedia.com/wp-includes/js/mediaelement/ 154 KB
35 KB 40ms
33ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.16
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 35851
response: 200
last-modified: Fri, 11 Dec 2020 16:33:07 GMT
server: nginx/1.16.0
etag: "1607704387"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds227.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public
accept-ranges: bytes

GET
H2 200 mediaelement-migrate.min.js Show response
askleo.askleomedia.com/wp-includes/js/mediaelement/ 1 KB
580 B 44ms
37ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=5.8
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 481
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "1626185109"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds045.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 tooltip.min.js Show response
askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/js/ 23 KB
6 KB 44ms
37ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/TooltipProEcommerce/assets/js/tooltip.min.js?ver=3.9.14
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 85f1dc7c35f47c67b139453f0221075ccd0848b444a1039fb1d2ba25a59b7e01

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;05797394f4a05f1c713cc9c6abb0f60f;2-173078-2;9ad99906-5dc8-4879-61da-2e919ea82f5e
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 5792
response: 200
last-modified: Mon, 10 May 2021 18:15:33 GMT
server: nginx/1.16.0
etag: "1620670533"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds236.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public,max-age=2591998
accept-ranges: bytes

GET
H2 200 check-source.min.js Show response
askleo.askleomedia.com/wp-content/plugins/popupally-pro/resource/frontend/ 540 B
363 B 45ms
38ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/popupally-pro/resource/frontend/check-source.min.js?ver=3.2.2
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: ec4be0f885f8bf796aa356fc6e4fca12d0e620b3e160ee3a8b26f6ad2f877d2e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 288
response: 200
last-modified: Fri, 11 Jun 2021 22:48:32 GMT
server: nginx/1.16.0
etag: "1623451712"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds226.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 1-popupally-pro-code.js Show response
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/popupally-pro-scripts/ 5 KB
1 KB 45ms
38ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/popupally-pro-scripts/1-popupally-pro-code.js?ver=1628216472
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ee6cb4482225d6c4f47f4db5011d22a38a4248a59063d7b4cde53ad1fea1723

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 964
response: 200
last-modified: Fri, 06 Aug 2021 02:21:12 GMT
server: nginx
etag: "1628216472"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds226.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 popup.min.js Show response
askleo.askleomedia.com/wp-content/plugins/popupally-pro/resource/frontend/ 18 KB
5 KB 45ms
38ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/popupally-pro/resource/frontend/popup.min.js?ver=3.2.2
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: a3c216cefae59e5da3e9fd500ac9c3e09112a11ec45fd633d4f30ff3fb43f5e0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 5191
response: 200
last-modified: Fri, 11 Jun 2021 22:48:32 GMT
server: nginx/1.16.0
etag: "1623451712"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds236.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 59ms
11ms Image
image/png 2600:9000:2057:9a00:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:9a00:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 10:44:18 GMT
via: 1.1 87b272b7d9b97f38da15c91c833c3292.cloudfront.net (CloudFront)
x-sol: middleton
age: 266412
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: Kj1QlE4Cu2QCLoJ16bnV-R379oS7ZqSiSivWPt1U_4aj67oFQev66A==
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "49d-5bd497273b080-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA6-C1
display: staticcontent_sol
expires: Fri, 13 Aug 2021 10:44:18 GMT

GET
H2 200 related.css
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/yet-another-related-posts-plugin/style/ 495 B
305 B 28ms
28ms Stylesheet
text/css 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/yet-another-related-posts-plugin/style/related.css?ver=1628216472
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: a48e3091c3e26309f1329bb7ee2812cf158deb93cd80fe6439e53e8d57e58d3d

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 206
response: 200
last-modified: Fri, 06 Aug 2021 02:21:12 GMT
server: nginx
etag: "1628216472"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds230.sk1.c
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 jquery.blockUI.min.js Show response
askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/ 9 KB
3 KB 46ms
39ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.70
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: b49498d1142de7f2e16afc2cd4250d2ba30c5df4de5d291f51d7cf69727efdbe

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 3246
response: 200
last-modified: Wed, 14 Jul 2021 23:23:39 GMT
server: nginx
etag: "1626305019"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds026.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 add-to-cart.min.js Show response
askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/frontend/ 3 KB
1 KB 46ms
40ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.2
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 8634aa7a3ac0bc6d359b458c8922e9d3269f64c1355b329bfe215beb12773af8

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 974
response: 200
last-modified: Fri, 23 Jul 2021 16:03:00 GMT
server: nginx
etag: "1627056180"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds236.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 js.cookie.min.js Show response
askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/js-cookie/ 2 KB
1001 B 48ms
41ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 3b1384ff918d4b7f95f9ee5c8fc388203dedff7344d3d96598c9562162788612

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 900
response: 200
last-modified: Fri, 23 Jul 2021 16:03:00 GMT
server: nginx
etag: "1627056180"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds214.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 woocommerce.min.js Show response
askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/frontend/ 2 KB
746 B 48ms
41ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.5.2
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: a256fccecac3b32ab73c91d79a18747519a1a18023be05465c933b03523a82e8

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 679
response: 200
last-modified: Fri, 23 Jul 2021 16:03:00 GMT
server: nginx
etag: "1627056180"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds234.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 cart-fragments.min.js Show response
askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/frontend/ 3 KB
1 KB 49ms
43ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5.5.2
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c7c023f91428234ca0ea4df1199758686f4dcd04da96ba63571788fb3389c0b

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 934
response: 200
last-modified: Fri, 23 Jul 2021 16:03:00 GMT
server: nginx
etag: "1627056180"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds209.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 main.min.js Show response
askleo.askleomedia.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 51ms
45ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/themes/generatepress/assets/js/main.min.js?ver=3.0.4
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: c0901279dec1117310802c450665b34a60788da4a00e066d2de367327cd13456

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1618
response: 200
last-modified: Wed, 14 Jul 2021 15:11:48 GMT
server: nginx
etag: "1626275508"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds023.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 comment-reply.min.js Show response
askleo.askleomedia.com/wp-includes/js/ 3 KB
1 KB 51ms
46ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-includes/js/comment-reply.min.js?ver=5.8
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1230
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "1626185109"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds065.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 foobox.min.js Show response
askleo.askleomedia.com/wp-content/plugins/foobox-image-lightbox-premium/pro/js/ 146 KB
36 KB 51ms
46ms Script
application/x-javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/foobox-image-lightbox-premium/pro/js/foobox.min.js?ver=2.7.16
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 73d269abb8a6ba50a6393840c5c5cff3bd149a14d638434b09cd38ff1268f08e

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;4a517dd961f951e2f843b168d8bb0def;2-173078-2;286fdcb4-a226-4b5b-4b18-35de160a8148
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 36481
response: 200
last-modified: Thu, 06 May 2021 21:03:29 GMT
server: nginx/1.16.0
etag: "1620335009"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds230.sk1.c
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, public,max-age=2591999
accept-ranges: bytes

GET
H2 200 woocommerce.min.js Show response
askleo.askleomedia.com/wp-content/plugins/gp-premium/woocommerce/functions/js/ 4 KB
1 KB 56ms
50ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/gp-premium/woocommerce/functions/js/woocommerce.min.js?ver=2.0.3
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: d325476db806449106ec43620c920e7aae14b5193de849534ca479aebe8982ff

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 1200
response: 200
last-modified: Wed, 21 Jul 2021 17:04:29 GMT
server: nginx
etag: "1626887069"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds215.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 player.min.js Show response
askleo.askleomedia.com/wp-content/plugins/powerpress/ 3 KB
1002 B 56ms
51ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/powerpress/player.min.js?ver=5.8
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 629db7e286c97c88af572b9ee82bf16a937f8916093adbe89f14f77ebf3ee79d

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 921
response: 200
last-modified: Wed, 21 Jul 2021 04:57:28 GMT
server: nginx
etag: "1626843448"
vary: Accept-Encoding
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds026.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 form.js Show response
askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/akismet/_inc/ 589 B
292 B 56ms
51ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/akismet/_inc/form.js?ver=1628216475
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 7bf99bd072ef2181aaa53f2e5cebd463ff723828c971d8527a450ac48fcc54ff

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 211
response: 200
last-modified: Fri, 06 Aug 2021 02:21:15 GMT
server: nginx
etag: "1628216475"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds028.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 lazyload.min.js Show response
askleo.askleomedia.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/ 8 KB
3 KB 57ms
52ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/wp-rocket/assets/js/lazyload/16.1/lazyload.min.js
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 2570
response: 200
last-modified: Wed, 21 Jul 2021 17:04:16 GMT
server: nginx
etag: "1626887056"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds073.sk1.hn,1628513070.cds009.sk1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 ezosuigeneris.js Show response
g.ezoic.net/ 555 B
557 B 177ms
55ms Script
text/javascript 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigeneris.js
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 290bfec620bfd7765ed1aca8daf780e26da80d53f90baaa412d54c043f816673

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: 35590a724061e197809658bd35dfdc30
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cache-control: max-age=999999, private
content-length: 275
expires: Mon, 29 Apr 2020 21:44:55 GMT

GET
H2 200 cmbv2.js Show response
askleo.com/detroitchicago/ 41 KB
11 KB 63ms
58ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 769b19eab3e84c033798de35413dbdfb568d10ed2df959fb2a6d08ad9b1e30f2

Request headers

:path: /detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f6cacd54975e047a9bb152841f8fa870b1797366cd5993462f121ee77711e13

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 generatepress.woff2
askleo.askleomedia.com/wp-content/themes/generatepress/assets/fonts/ 1 KB
2 KB 83ms
27ms Font
font/woff2 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/themes/generatepress/assets/fonts/generatepress.woff2
Requested by: Host: askleo.askleomedia.com
URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/themes/generatepress/assets/css/components/font-icons.min.css?ver=1628216471
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: ac990171fc2a8993d659ce8f10bc0a7815c43835ba1dc00c2246f3556c6eeecd

Request headers

Origin: https://askleo.com
Referer: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/themes/generatepress/assets/css/components/font-icons.min.css?ver=1628216471
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
x-middleton-response: 200
content-length: 1264
response: 200
last-modified: Wed, 14 Jul 2021 15:11:48 GMT
server: nginx
etag: "1626275508"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds041.sk1.hn,1628513070.cds221.sk1.c
content-type: font/woff2
access-control-allow-origin: https://askleo.com
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 gp-premium.ttf
askleo.askleomedia.com/wp-content/plugins/gp-premium/general/icons/ 3 KB
2 KB 84ms
29ms Font
font/ttf 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.askleomedia.com/wp-content/plugins/gp-premium/general/icons/gp-premium.ttf
Requested by: Host: askleo.askleomedia.com
URL: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/gp-premium/general/icons/icons.min.css?ver=1628216472
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: e5bdc8836e401144476fe22b6fd05b2c6d1a94aea39564bc356ac9d09c39673c

Request headers

Origin: https://askleo.com
Referer: https://askleo.askleomedia.com/wp-content/cache/min/1/wp-content/plugins/gp-premium/general/icons/icons.min.css?ver=1628216472
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
x-middleton-response: 200
content-length: 1597
response: 200
last-modified: Wed, 21 Jul 2021 17:04:29 GMT
server: nginx
etag: "1626887069"
vary: Accept-Encoding,Origin
x-hw: 1628513070.cds041.sk1.hn,1628513070.cds235.sk1.c
content-type: font/ttf
access-control-allow-origin: https://askleo.com
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 891a6edbc3040f9b3b23062108409d20b4345e3179f3a9da3e5fdc195782befd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c00cb5412b8f34872361648db5c1ebab807985da31527f526d6148dbbf7e307c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 pubads_impl_2021080401.js Show response
securepubads.g.doubleclick.net/gpt/ 328 KB
114 KB 73ms
71ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

sffe /

Resource Hash

d3722344dc2b0b07af6a39d0594966bede1a0dbdf0e524795cc6aaab2a6e2845

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 04 Aug 2021 08:37:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117056
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:30 GMT

GET
H3-29 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 60 B
90 B 71ms
70ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

92f7c80607a7572d0ea06eb93f05e6e8e694b5f1ba282358d1f84c808ad42ff5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:30 GMT

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b5d0eed1e60aa4445314f7e0be635f86d2e6a23ad316e79f2a1581e1f4dc1bfa

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3391b26fd634859b900670bddcdd8ef22a819e3581da050f15f48c85a15ba5c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 imp.gif Show response
askleo.com/detroitchicago/ 43 B
128 B 54ms
54ms XHR
image/gif 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A0%2C%22ad_lazyload_version%22%3A5%2C%22ad_load_version%22%3A2%2C%22ad_location_ids%22%3A%222%2C2%2C2%2C5%2C34%2C34%2C22%2C22%2C22%2C4%2C36%2C700%2C21%2C1%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A14%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A4%2C%22city%22%3A%22Stockholm%22%2C%22country%22%3A%22SE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A8%2C%22domain_id%22%3A173078%2C%22domain_test_group%22%3A20210307%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22596%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A30%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1101%2C1102%2C1103%2C1104%2C1104%2C1104%2C1105%2C1105%2C1107%2C1107%2C1107%2C1108%2C1109%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22327dea31-bdc5-453f-716e-33f7dede7959%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22173%2011%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A277369%2C%22response_time_orig%22%3A760%2C%22serverid%22%3A%2235.159.28.139%3A18673%22%2C%22state%22%3A%22AB%22%2C%22sub_page_ad_positions%22%3A%221100%2C1101%2C1102%2C1103%2C1104%2C1104%2C1104%2C1105%2C1105%2C1107%2C1107%2C1107%2C1108%2C1109%22%2C%22t_epoch%22%3A1628513069%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A8417%2C%22worst_bad_word_level%22%3A1%7D
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_count_adjustment%22%3A0%2C%22ad_lazyload_version%22%3A5%2C%22ad_load_version%22%3A2%2C%22ad_location_ids%22%3A%222%2C2%2C2%2C5%2C34%2C34%2C22%2C22%2C22%2C4%2C36%2C700%2C21%2C1%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A14%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A4%2C%22city%22%3A%22Stockholm%22%2C%22country%22%3A%22SE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A8%2C%22domain_id%22%3A173078%2C%22domain_test_group%22%3A20210307%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22596%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A30%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1101%2C1102%2C1103%2C1104%2C1104%2C1104%2C1105%2C1105%2C1107%2C1107%2C1107%2C1108%2C1109%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22327dea31-bdc5-453f-716e-33f7dede7959%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22173%2011%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A277369%2C%22response_time_orig%22%3A760%2C%22serverid%22%3A%2235.159.28.139%3A18673%22%2C%22state%22%3A%22AB%22%2C%22sub_page_ad_positions%22%3A%221100%2C1101%2C1102%2C1103%2C1104%2C1104%2C1104%2C1105%2C1105%2C1107%2C1107%2C1107%2C1108%2C1109%22%2C%22t_epoch%22%3A1628513069%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A8417%2C%22worst_bad_word_level%22%3A1%7D
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 47

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 466ms
70ms Script
application/javascript 91.228.74.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.228.74.134 , United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:31 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Mon, 16 Aug 2021 12:44:31 GMT

GET
H2 200 ezosuigenerisc.js Show response
g.ezoic.net/ 0
54 B 55ms
54ms Script
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigenerisc.js?nogen=1
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
cache-control: max-age=300, private
server: nginx
content-length: 0
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H2 200 cmbdv2.js Show response
askleo.com/detroitchicago/ 46 KB
10 KB 64ms
64ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/cmbdv2.js?gcb=195-2&cb=03-4y0c-5y18-3y34-15y57-21&cmbcb=20&sj=x03x0cx18x34x57
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 55b58281bbc9f83501945a904f3654d22a370fc8506c4e0763537f2ee7531efd

Request headers

:path: /detroitchicago/cmbdv2.js?gcb=195-2&cb=03-4y0c-5y18-3y34-15y57-21&cmbcb=20&sj=x03x0cx18x34x57
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 nmash.js
askleo.com/porpoiseant/ 24 KB
6 KB 54ms
53ms Other
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/nmash.js?v=52
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 155f5f740759b681ffb0e20f52f8755242fbe2e5f73984765242b3c0bbe458de

Request headers

:path: /porpoiseant/nmash.js?v=52
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:30 GMT
content-encoding: br
last-modified: Mon, 09 Aug 2021 05:22:41 GMT
server: nginx
etag: "60b0-5c9199309c455;5c701b9c2cf40-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 greenoaks.gif Show response
askleo.com/detroitchicago/ 0
93 B 52ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidF9lcG9jaCI6MTYyODUxMzA2OSwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDgtMDkifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6IjM1NTkwYTcyNDA2MWUxOTc4MDk2NThiZDM1ZGZkYzMwIn1dfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidF9lcG9jaCI6MTYyODUxMzA2OSwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDgtMDkifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6IjM1NTkwYTcyNDA2MWUxOTc4MDk2NThiZDM1ZGZkYzMwIn1dfV0=
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:31 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:32 UTC

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
300 B 154ms
154ms XHR
text/plain 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.21.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-21-201.fra56.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:31 GMT
via: 1.1 7d3c59ee1b45f72158a8cbce053c8978.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
access-control-allow-origin: https://askleo.com
cache-control: max-age=86087, s-maxage=86400
access-control-allow-credentials: true
x-amz-cf-id: hqOKSWAKzZJIvBeVrQ9LjIiv3WZOD5zIdy8SXmfI6MV5ns_ZR_VoeA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
367 B 128ms
128ms XHR
text/javascript 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&pid=6MnsVlZoXQAKM&cb=0&ws=1600x1200&v=7.67.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-box-3%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-box-3%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-box-3%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-medrectangle-2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-large-billboard-2%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-large-billboard-2%22%7D%2C%7B%22sd%22%3A%226%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-medrectangle-4%22%7D%2C%7B%22sd%22%3A%227%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-medrectangle-4%22%7D%2C%7B%22sd%22%3A%228%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-medrectangle-4%22%7D%2C%7B%22sd%22%3A%229%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-medrectangle-1%22%7D%2C%7B%22sd%22%3A%2210%22%2C%22s%22%3A%5B%22580x400%22%2C%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-large-leaderboard-2%22%7D%2C%7B%22sd%22%3A%2211%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-large-mobile-banner-1%22%7D%2C%7B%22sd%22%3A%2212%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-medrectangle-3%22%7D%2C%7B%22sd%22%3A%2213%22%2C%22s%22%3A%5B%22468x60%22%5D%2C%22sn%22%3A%22%2F1254144%2Faskleo_com-box-2%22%7D%5D&cfgv=0&schain=1.0%2C1!ezoic.ai%2C0d933186705efdb55cfbfa127978ddae%2C1%2C%2C%2C&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.21.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-21-201.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:31 GMT
via: 1.1 7d3c59ee1b45f72158a8cbce053c8978.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C2
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://askleo.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: l_pbRQ--XwOc_FYjRwvVGCkyIk5H9oha_8cfWfSrzHdGfFG1Eree3Q==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 173ms
59ms XHR
application/javascript 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.21.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-21-201.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 08 Aug 2021 21:00:31 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 56641
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 01 Jul 2021 22:05:10 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: UwMoja_wiYmXZ_L.v58hX8_8XzeYFzV9
via: 1.1 0a4e8f7c3d348e526848328c55dd452b.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-C2
content-type: application/javascript
x-amz-cf-id: jRFZRxymSWUZ6M8YKYpuZ094d_Eh5CZGQrtHO7SArhLDnvSebTDb5g==

GET
H2 200 denver.js Show response
askleo.com/detroitchicago/ 4 KB
1 KB 53ms
52ms Script
application/javascript 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/denver.js?gcb=2&cb=1
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e45818350fb6700935c0dce924d8317b166845c5516bc391a1dbda39203f143a

Request headers

:path: /detroitchicago/denver.js?gcb=2&cb=1
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0; ezosuigeneris=35590a724061e197809658bd35dfdc30
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:31 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex
content-length: 1273

POST
H2 200 / Show response
askleo.com/ 574 B
506 B 597ms
597ms XHR
application/json 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/?wc-ajax=get_refreshed_fragments
Requested by: Host: askleo.askleomedia.com
URL: https://askleo.askleomedia.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 859e7bdcd95e7481128e01b5a7ff2fcf34a963198abaea0f0c483e40d22b2986

Request headers

sec-fetch-mode: cors
origin: https://askleo.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: ezouspvv=0; ezouspva=0; ezosuigeneris=35590a724061e197809658bd35dfdc30; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
content-length: 18
:path: /?wc-ajax=get_refreshed_fragments
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept: */*
cache-control: no-cache
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: POST
Accept: */*
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 09 Aug 2021 12:44:32 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
x-sol: pub_site
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 253
response: 200
server: nginx
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: max-age=0, must-revalidate, no-cache, no-store
expires: Sun, 08 Aug 2021 12:44:32 GMT

GET
H2 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 456 B
272 B 398ms
398ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=3295654849194206&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=a%3D%257C3%257C%26iid1%3D8001652120664878%26eid%3D8001652120664878%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Daskleo_com-medrectangle-2-8001652120664878%26eb_br%3D39abb99448d54704c4afa42efe76e15d%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D1100%26br2%3D550%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C193%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082&eri=1&cust_params=amznbid%3D1%26amznp%3D1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513071957&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=404481011&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

bb658d457ec9eac56e6c768b60984d74305f43f074b86b195fca535de22fc19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:32 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 242
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 853E 6 KB
3 KB 49ms
14ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 09 Aug 2021 12:44:32 GMT
expires: Tue, 09 Aug 2022 12:44:32 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
292 B 615ms
615ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=2314038584059216&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-2%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F2%2C%2F0%2F2&prev_iu_szs=468x60%2C300x250%2C300x250%2C300x250&prev_scp=a%3D%257C251%257C%26iid1%3D9113725436610209%26eid%3D9113725436610209%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D13%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Daskleo_com-box-2-9113725436610209%26eb_br%3Dc5429b6ddd929d0bc40a832a87789a7c%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D1000%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C996%2C988%2C783%26ax_ssid%3D10082%7Ca%3D%257C3%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3Dc5429b6ddd929d0bc40a832a87789a7c%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D1000%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D2%2C152%2C176%2C4%2C161%2C122%2C196%2C20%2C26%2C171%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%26ax_ssid%3D10082%7Ca%3D%257C5%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3Dc5429b6ddd929d0bc40a832a87789a7c%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D1000%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D74%2C193%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%26ax_ssid%3D10082%7Ca%3D%257C6%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3Dc5429b6ddd929d0bc40a832a87789a7c%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D1000%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D2%2C152%2C176%2C4%2C161%2C122%2C196%2C20%2C26%2C171%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%26ax_ssid%3D10082&eri=1&cust_params=amznbid%3D1%26amznp%3D1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513071972&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=566%2C320%2C644%2C967&adys=285%2C493%2C493%2C493&adks=1875650461%2C3425419279%2C922330153%2C922330152&ucis=2%7C3%7C4%7C5&ifi=2&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x60%7C323x250%7C323x250%7C323x250&msz=468x60%7C323x250%7C323x250%7C323x250&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&btvi=0%7C0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

c8c8822e94a2b3c5499c8f59b28b11e83d2c31231806c11a7920e2f8e3457423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:32 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 262
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
431 B 194ms
12ms Script
application/javascript 2600:9000:211e:ce00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:ce00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 06:10:05 GMT
via: 1.1 f891d17fa862cc74a05434e03fa58dcb.cloudfront.net (CloudFront)
age: 23668
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
x-amz-cf-id: v9JnOP_h5ZdyTCYYuWznF25xv5XQKj15RLbAHSXxng8zFmGYqlOzNw==

GET
H2 200 logo2019-400w.png.webp
askleo.askleomedia.com/wp-content/uploads/2019/05/ 9 KB
9 KB 27ms
27ms Image
image/webp 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://askleo.askleomedia.com/wp-content/uploads/2019/05/logo2019-400w.png.webp
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: cc3533e181e6e2e97e0bcfd2c8bbe98becc92d6b4338953ee4afdba5bc3dc10b

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:31 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-ezoic-cdn: Hit ds;mm;d2dad5751a2ea6650255d494826ccc60;2-173078-2;def49e6d-21ed-4d5b-7b18-3ca17c5767c0
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 9054
response: 200
last-modified: Fri, 23 Apr 2021 18:46:13 GMT
server: nginx/1.16.0
etag: "1619203573"
vary: Accept-Encoding
x-hw: 1628513072.cds073.sk1.hn,1628513071.cds228.sk1.c
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=15552000
accept-ranges: bytes

GET
H2 200 fake-1200x630.jpg.webp
askleo.askleomedia.com/wp-content/uploads/2020/04/ 25 KB
25 KB 28ms
28ms Image
image/webp 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://askleo.askleomedia.com/wp-content/uploads/2020/04/fake-1200x630.jpg.webp
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 4883cdcfd267a93c48c03f2af24a342223239176f49abd440982e450e417a42c

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:32 GMT
content-encoding: br
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 25491
response: 200
last-modified: Tue, 13 Jul 2021 14:05:09 GMT
server: nginx
etag: "1626185109"
vary: Accept-Encoding,Origin
x-hw: 1628513072.cds073.sk1.hn,1628513072.cds224.sk1.c
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=2592000
accept-ranges: bytes

GET
H2 200 pixel;r=316827695;labels=Domain.askleo_com%2CDomainId.173078;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F;uht=2;fp...
pixel.quantserve.com/ 35 B
371 B 64ms
51ms Image
image/gif 91.228.74.134
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=316827695;labels=Domain.askleo_com%2CDomainId.173078;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F;uht=2;fpan=1;fpa=P0-764320549-1628513072184;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=askleo.com;je=0;sr=1600x1200x24;dst=1;et=1628513072184;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.%22From%22%20Spoofing%3A%20How%20Spammers%20Send%20Email%20that%20Looks%20Like%20It%20Came%20from%20You%2Cdescription.%22From%22%20spoofing%20is%20how%20spammers%20send%20email%20that%20looks%20like%20it%20comes%20from%20you%20tha%2Curl.https%3A%2F%2Faskleo%252Ecom%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came%2Csite_name.Ask%20Leo!%2Cimage.https%3A%2F%2Faskleo%252Easkleomedia%252Ecom%2Fwp-content%2Fuploads%2F2020%2F04%2Ffake%252Ejpg%2Cimage%3Awidth.2400%2Cimage%3Aheight.1260

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.134 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:32 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 greenoaks.gif Show response
askleo.com/detroitchicago/ 0
53 B 55ms
55ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjE0MyJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiMTE1NyJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiNjQifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiNTQ0In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMTI2MyJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiIxNzU0In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidF9lcG9jaCI6MTYyODUxMzA2OSwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X3BhaW50IiwidmFsIjoiMTQ5OCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMTQ5OCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifV19XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjE0MyJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiMTE1NyJ9LHsibmFtZSI6InBlcmZfcmVzcF90aW1lIiwidmFsIjoiNjQifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiNTQ0In0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMTI2MyJ9LHsibmFtZSI6InBlcmZfY29tcGxldGUiLCJ2YWwiOiIxNzU0In1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidF9lcG9jaCI6MTYyODUxMzA2OSwiZGF0YSI6W3sibmFtZSI6ImZpcnN0X3BhaW50IiwidmFsIjoiMTQ5OCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMTQ5OCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX2VmZmVjdGl2ZV90eXBlIiwidmFsIjoiNGcifV19XQ==
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0; ezosuigeneris=35590a724061e197809658bd35dfdc30; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; __qca=P0-764320549-1628513072184; ezux_lpl_173078=1628513072254|327dea31-bdc5-453f-716e-33f7dede7959|false; __gads=ID=ab7ced84da9cf4d2-22cd47869ac80030:T=1628513071:S=ALNI_MYOszVlAlUkxFeQ2Cn1a6i--O_kXQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:32 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:32 UTC

GET
H2 200 greenoaks.gif Show response
askleo.com/detroitchicago/ 0
19 B 55ms
55ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjEwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidF9lcG9jaCI6MTYyODUxMzA2OSwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fcnR0IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTkyMSJ9XX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjEwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidF9lcG9jaCI6MTYyODUxMzA2OSwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fcnR0IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTkyMSJ9XX1d
pragma: no-cache
cookie: ezouspvv=0; ezouspva=0; ezosuigeneris=35590a724061e197809658bd35dfdc30; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; __qca=P0-764320549-1628513072184; ezux_lpl_173078=1628513072254|327dea31-bdc5-453f-716e-33f7dede7959|false; __gads=ID=ab7ced84da9cf4d2-22cd47869ac80030:T=1628513071:S=ALNI_MYOszVlAlUkxFeQ2Cn1a6i--O_kXQ
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:32 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:32 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 20ms
20ms XHR
application/json 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021080401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7b3466c38556660dac35c703097a6eaae49ff457b9fc028a1bb7f60cbdf1494

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8590
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 2027ms
2027ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:34 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame D232 12 KB
5 KB 19ms
14ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Mon, 09 Aug 2021 12:37:02 GMT
expires: Tue, 09 Aug 2022 12:37:02 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 452
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9482 783 B
757 B 16ms
15ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

91f129dffdeeaeb889451c4e154e5ff8f1bef7b75aae9fbeb609240134db3f79

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BMwYmlQyNtlrZblJjQf/9A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

expires: Mon, 09 Aug 2021 12:44:34 GMT
date: Mon, 09 Aug 2021 12:44:34 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-BMwYmlQyNtlrZblJjQf/9A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame D232 35 KB
13 KB 34ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 466
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 09 Aug 2022 12:36:48 GMT

GET
H2 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 448 B
412 B 476ms
475ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=2924027448375915&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=a%3D%257C6%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3D76163170a8636ae5b88417f095893e08%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D400%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D2%2C152%2C176%2C4%2C161%2C122%2C196%2C20%2C26%2C171%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D800%26reqt%3D1628513074512&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513074533&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=967&adys=493&adks=922330152&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

8c355a8b5683f9eb27b0c246df99fe03a3dd4a272cbc1f07c3e9e24a7102c105

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:34 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 456 B
418 B 649ms
643ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=2268612837870278&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid1%3D8001652120664878%26eid%3D8001652120664878%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Daskleo_com-medrectangle-2-8001652120664878%26eb_br%3D26dfa00588543c52511429ade391f561%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D550%26br2%3D550%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C193%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D1100%26reqt%3D1628513074528&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513074538&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=404481011&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

c9c508491a1780fe34dab43fcf7d248d76caf9008bba8b6d1d4cb30c1e2b1e45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 241
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 448 B
775 B 360ms
360ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=196495664471495&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=a%3D%257C3%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3D76163170a8636ae5b88417f095893e08%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D400%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D2%2C152%2C176%2C4%2C161%2C122%2C196%2C20%2C26%2C171%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D800%26reqt%3D1628513074522&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513074542&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=320&adys=493&adks=3425419279&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

67ff6efde17ddcd4d62c6c88b51c5abbe7611ed2660c19475907cae9d6dc8b87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:34 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 238
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 447 B
414 B 501ms
501ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=3166880111448200&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=3&rcs=1&prev_scp=a%3D%257C251%257C%26iid1%3D9113725436610209%26eid%3D9113725436610209%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D13%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Daskleo_com-box-2-9113725436610209%26eb_br%3D76163170a8636ae5b88417f095893e08%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D400%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C996%2C988%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D800%26reqt%3D1628513074524&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513074551&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=285&adks=1875650461&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x60&msz=468x60&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

09b56f997a02246f1af68bb00f2e1c634572510712e3ff82e9dc151bd226c376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 236
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 448 B
410 B 547ms
547ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=3064061746715656&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=3&rcs=1&prev_scp=a%3D%257C5%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3D76163170a8636ae5b88417f095893e08%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D400%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D74%2C193%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D800%26reqt%3D1628513074517&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1628216635&dt=1628513074556&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=644&adys=493&adks=922330153&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

4d3c7f9d4e2b85c5a04a382911211f91906e8c342a0641bb9d8175629924b2dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:35 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 236
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 38ms
37ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021080401&jk=162110459216175&bg=!ysmlyY3NAAals0SOpbM7ACkAdvg8WrN2My66dS9kj9jHagxJ9v5BRun79QROrKcJT9nV9AjGaA5eawIAAAB_UgAAAApoAQcKASltygzPdr3qDwzEoPTy4TZy0Wfbv-6FBggyM6b4Xc0B6E0B6mSNsRayW3bVbeFdWrcg8vqo19KEVp3vYd0LeybXbwYO9S2dcs1XcE1ZraezvvppVk0H5uey7QayWWE0FYMoA_RL3JFdWzWB4a7E01wjwQaStXk2k5fkHxaFzlvNs9nOUcuw0H6fcQXLd6FABluGqOI4Cqi1gG_r8rwHfbtFl_XeYBTO-wTwqBOfgkKtW6Tnvx3vF0mo0y8-rEZKS7CHssM1TYzeuZ1KrAcfiz5SK1B7j1NSeCvkmqTTcYta7cModbs9TUovJk70aY_x4zUpsHlbTPNSy-fNekiblZEAYpQLH0RGbVDvutVBe7Y0madTzW5J2DOM1-CRWBLIrsvi8vLIw17HCsuZAmY4cO7oVQZBRcu55AHyDRL3u2rIeKj6YJJCe_dPE3qmQ2J8UM2ZTqWQb8sjQoCyaiuEBZLgEocu2SPcRPcSpWk80m2qEq4d07CFHAmqkjilByHA-ToA6dSq1dLNyifOvhEGVJPLbyrx04hIVj2miCmtEkBh87ZNKoszV_27fAFiLD96aIV-p2SMDE9zKEMAcvczS-aVlDf7D0OBFogwfEXvhnKZ09rvuxqY1mK0QEXQLIgIcZHFbaT_kxq6tLOuHCoBWencAbcQ247avrTxSBeJ2017jA1IDhjjFAKCLT_GNX0A7DAm8hstK6OkPvptrmFXQkvz80A1JMlA_IGXdFLlKW_39Y1JTjElhmpAqgc1jUMNwtNpqk_7pRmCe7uWjMczbhMa8UUDXGuq5GzRavVIsDbHkPUvzhcsHJa4X66_9uMl5_7bmy8u4sfxrMdyZ5yIXVgj2F4tIERsmJjslBegVwPw8amizfMAykjFaYyQAmQM5o-EiS6_V-hMkaPq8se0H-Yx7smkUMwmXc4gNon7MBGINIErhjXBndvI2uvlcYUR2PoAzRw9Oofhy0TTRseTzoWZu32KvegfmTZT608e2EQZVnmO8vPejFPquA-LXKXvPy2Nkx4zGsq9OPS9ePug07NYPeQuOTS7zo3gA16C-N7TEu_9-nbeUgYOyawgkUEEuhc6-f78iIGXHBSdebqxDbaCsh1UTDC-A3R-9yVzeqrhAYDDgTBGaMSfpym5U5nplPaXjeMptW-75XMsSE4suSnL5IX2WwZEJdppU_hebdgxknJH4ptXQwRQF1pmrwjPARCwsg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 30ms
16ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 37ms
16ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 536ms
536ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=2669295147215586&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C6%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D260%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D2%2C152%2C176%2C4%2C161%2C122%2C196%2C20%2C26%2C171%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D400%26reqt%3D1628513075037&eri=1&cookie=ID%3D339de4d2466eabd0-22657b579bc80016%3AT%3D1628513074%3AS%3DALNI_MaaBMVYQBGgE0dClIiTN4UTq8p-Gg&bc=31&abxe=1&lmt=1628216635&dt=1628513076044&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=967&adys=493&adks=922330152&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

f7cb5beff11c072e487958613fdbb03c7386e1651906c5f45b76856dc901be7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8756
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 397ms
396ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=4070649343730266&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C3%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D260%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D2%2C152%2C176%2C4%2C161%2C122%2C196%2C20%2C26%2C171%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D400%26reqt%3D1628513075051&eri=1&cookie=ID%3D339de4d2466eabd0-22657b579bc80016%3AT%3D1628513074%3AS%3DALNI_MaaBMVYQBGgE0dClIiTN4UTq8p-Gg&bc=31&abxe=1&lmt=1628216635&dt=1628513076055&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=320&adys=493&adks=3425419279&ucis=c&ifi=12&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

0608fb292b35aeda9a58753b14a45c86796d2b58596d7ff2af67e5f692a77de8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8998
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 430 B
257 B 344ms
343ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=4129835046681563&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=2&rcs=2&prev_scp=a%3D%257C251%257C%26iid1%3D9113725436610209%26eid%3D9113725436610209%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D13%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Daskleo_com-box-2-9113725436610209%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D260%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C996%2C988%2C783%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D400%26reqt%3D1628513075060&eri=1&cookie=ID%3D339de4d2466eabd0-22657b579bc80016%3AT%3D1628513074%3AS%3DALNI_MaaBMVYQBGgE0dClIiTN4UTq8p-Gg&bc=31&abxe=1&lmt=1628216635&dt=1628513076065&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=285&adks=1875650461&ucis=d&ifi=13&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x60&msz=468x60&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

889cdf19beb7becdeb19afc351dfd5e4e8f105757855c3302ddbc72736cd8cb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 226
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
9 KB 515ms
515ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=2896267089532692&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C5%257C%26iid1%3D115347484630730%26eid%3D115347484630730%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Daskleo_com-box-3-115347484630730%26eb_br%3D57914c3716312cb7e954090f0717ea25%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D1%26bvm%3D0%26bvr%3D7%26shp%3D3%26ftsn%3D3%26br1%3D260%26br2%3D500%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D74%2C193%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C899%2C919%2C783%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D400%26reqt%3D1628513075112&eri=1&cookie=ID%3D339de4d2466eabd0-22657b579bc80016%3AT%3D1628513074%3AS%3DALNI_MaaBMVYQBGgE0dClIiTN4UTq8p-Gg&bc=31&abxe=1&lmt=1628216635&dt=1628513076116&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=644&adys=493&adks=922330153&ucis=e&ifi=14&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

85966d6ad60f407bebf565323325b29af0843549f174e3997a18fd5aa2c28d40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9074
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 24 KB
9 KB 419ms
418ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=3042413983408329&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=2&prev_scp=a%3D%257C3%257C%26iid1%3D8001652120664878%26eid%3D8001652120664878%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Daskleo_com-medrectangle-2-8001652120664878%26eb_br%3D86802a923a1f32517e4c5d3b6d550271%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D23%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D200%26br2%3D550%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C193%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C783%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D550%26reqt%3D1628513075194&eri=1&cookie=ID%3D339de4d2466eabd0-22657b579bc80016%3AT%3D1628513074%3AS%3DALNI_MaaBMVYQBGgE0dClIiTN4UTq8p-Gg&bc=31&abxe=1&lmt=1628216635&dt=1628513076199&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1110&adks=404481011&ucis=f&ifi=15&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

7ee9c0ca7888ff1dd612d41bdadd615d125f39e418e302938ee1826fcf397618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9663
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BFFD 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 09 Aug 2021 12:44:32 GMT
expires: Tue, 09 Aug 2022 12:44:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b68bad79742705a9e7a436733a8fd2278f9923f48fc304ce9aecd97205ad642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628249289658065"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28112
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:36 GMT

GET
H2 200 greenoaks.gif Show response
askleo.com/detroitchicago/ 0
65 B 59ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYwNDAifV19XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjYwNDAifV19XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 54ms
53ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiNTc5MTRjMzcxNjMxMmNiN2U5NTQwOTBmMDcxN2VhMjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1NTMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiNTc5MTRjMzcxNjMxMmNiN2U5NTQwOTBmMDcxN2VhMjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1NTMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
88 B 166ms
55ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: askleo.com
URL: https://askleo.com/porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 54ms
52ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDgtMDkifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDgtMDkifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
42 B 53ms
52ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYXVjdGlvbl9lcG9jaCI6MTYyODUxMzA3NiwiYWRfcG9zaXRpb24iOjExMDQsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJiaWRfZmxvb3JfaW5pdGlhbCI6ODAwLCJiaWRfZmxvb3JfcHJldiI6NDAwLCJiaWRfZmxvb3JfZmlsbGVkIjoyNjAsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjQyMCwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjMsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYXVjdGlvbl9lcG9jaCI6MTYyODUxMzA3NiwiYWRfcG9zaXRpb24iOjExMDQsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJiaWRfZmxvb3JfaW5pdGlhbCI6ODAwLCJiaWRfZmxvb3JfcHJldiI6NDAwLCJiaWRfZmxvb3JfZmlsbGVkIjoyNjAsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjQyMCwibXVsdGlfYWRfdW5pdCI6MCwibXVsdGlfYWRfY291bnQiOjMsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvv=260; ezouspva=1; ezouspvh=260
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:34 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3720 624 B
350 B 17ms
16ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXkRIQs9JQITCcZRfmTiGEf_bpirvIszeP5v6i5jdJYdlO2HSd9MWEwboMmWSqSXEaMm2CHqggr7HqLbmE5DB_S5PKWgOtYqai4X9JGjl6-Od0_FZPBI0fPuFUpWt-2mZqcFLyjR0JTvwmtjIzq65AQZs4d9A_FfjW4vnPEPl0-COjSEe-x9tP28yzkkMVGPeoF65YHFNwWn5b5euImPPvjoWCBEQ

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXkRIQs9JQITCcZRfmTiGEf_bpirvIszeP5v6i5jdJYdlO2HSd9MWEwboMmWSqSXEaMm2CHqggr7HqLbmE5DB_S5PKWgOtYqai4X9JGjl6-Od0_FZPBI0fPuFUpWt-2mZqcFLyjR0JTvwmtjIzq65AQZs4d9A_FfjW4vnPEPl0-COjSEe-x9tP28yzkkMVGPeoF65YHFNwWn5b5euImPPvjoWCBEQ
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkRCxiJSEFA5HUQRwShJMCOYZog1YUed-QyJJd1r5-VPsJHO9yF85GB-c-i2DU
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 09 Aug 2021 12:44:36 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BFFD 45 KB
22 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A_4coucgmcDQide62IVlFU5TPX-r0O-IPerLUOLSg-rH_iUAbTsMbCvU07ytESAki2362SA-nzf5p3mLjdBmr7n2SQAui4G7MaJpSOJ8d8XRJ-azHzFMVxSsCAJLcND3kOQ2-ktu1kdj6CF8hJw1BGCFP_jg&dbm_d=AKAmf-C942_99v5y6FibC2NVCmuf_GTJKFL5ZTtjewDOLwr-BoXBruiULTJmhRD7gdBCOmqHiMOrzYtEXDUByj7jwwiXtjcvlEpZSKmk19TrNbMtvdudDuZHOxGNvFEsT7xG0K38rL2t2FqyQgq9Lf0jOdZwJJOycN2NUSV4UP-YCPWxq4VqnZPB9C3mEY7jWqtx3vZGF-EOCNoJDOvXUAMvBJgLUgeOhNNjNtcaDir545abrPvYOgt8edaGvxJXC9nLEVWMPv7x-7ClEwZiWS9MQHsuuSJs_7-dV__G-ybCxXvPBiY38b3LRe6V3Zu22gjg3-64vd3FIOMthYsizCNC6NPtoENpeQJ4RxVyEuETJAyrM5yjf5ftPCb_RS6DqSUbQKnS-MOFVdF5uNY8-Yj833rkO4Y-UVKaPgTLRWyN5ArsyNIkj7C-0m0SBj1QbMWpHweTCAfggLy-FBloTv1YIhN7_VejZNBzFQR3zgp0cF7KV8NW6fjJzhO1cklDGBWYGu4NwsXMdUOYOxoX7S2JPBHGzDiddiFzm4ljMju2TzpXd7zcz-DTuPi9NEaX_5MsRN6Sd8_K_lZLICAVxs-bYsQxvIfnRP-1XFeBSdBWG8HnsUdr9sYVgLUUMx17VTKXk_jytaX8Wghi6gWbPt8ACo2-92rzOl4CccH8gAhrTzB2WUExkJGd79w7WL8CmXOeFgYo6eazmicE2_6H2pV0n7Z079aOjCO_YgWjmaMPgkRx_l7s8OY7QQLVWF9yDrsEd09linMogM5j6eRLB2o5pERPszy0yW2MKF8OPh8pVA9TKqXnGXEpovr7Q8iXF15nfdCuIMlp2xQjgs_yk39XYx7XXKFjZSsacVPp4ozGRbMoz6wuznMvK0rl7qPiArkMvHtD9r3byn_bleElBiH4_8iZSOr0kgJ3uc814e6jgOoeoWZbD0grUW2yMHrsbx4Tn80g5Q9XxvepgrnQZcxW_XB6CgE1TmMU_swl8YnXbE2ns9MX58ZR5nVlIh5B4wZqoCx3I9Qnr6OPZhx-bJ_GyYy_Lvm7ECWc2ldXNAmB7i4MOQZj3fUwvufT9WRj3EpWzIDbj7jC1eq_DGFbJNaflNby9kkeMUchnKBTYtTNzIXEtPHpk8Y4ntE24-JMg5_bKAPqr2Vf4kq6GpJgvaj9W2g3OOplEZQ5TdxEXTniiSXkA-EMvxGvMo0Ns5FhctqacYesk5rKkDzhem7A1TvfagdWTzTnd2vcj5jG5r2SgSeZrGAD2O-h1KLpk-TQCnidNVnzjFFuRGBDjVQC1tV67NWL3UDPd-BixofrqixkJPjGkE3m385uKxY0NUg5VQ8J2A5L6yvt_w-X9SxDw-bC8luvQZtBdrYznbPe5omZC7JgherE5Qe0SrAGNmmOactILw026KgfdLVUUbBnsxb50VavnVKwLiI7dLTZy-82gIMpZdpre0oHC5bPKbtHhvWzoo-EWfIpnHnuMglB0-2YemNFBBsI6oQuPK-co1j2ENYrVXRufqKJh0nMVGFCD3uUG-Kng-aviIvzuGcOaOuIn8ob4eI_JXt-2P5CFaip71-B5nXd3P68i8Mzhywgi9D5ig35eibjiamROaz9Q6zhkLZ92J96aiBtHtvqUCi_dImhq83aG6fHNqyg6YT2hAacxih_6HXZwZekmJzKJ3-Le9BsnfayV-zyAAcjoClqichk8lj73H0AnJ-uitGHvCNFSf4Mj79BIVNHrzHZMe_56GNdmy1KRnYmq8PB3I5Kp8kbKCvMsWClS6G6s_QRIaWJVn3whikeKlJ6ueYhHHG3DcGyFVsh4DUt-Xk-9OoKGy6DqLJdlspA658nxh9b2ZKhDqC_kZk2EmtT4C12vvm1Yb3v2Foe4QuNgAeKE-GEr7jfvT-XLP5m5LhfJrB9dqwcTxHSB3rNKP64vFvujU3uC923wpBl3RlN77FbZSGNCbGYs-NLc1PXB-4yM8OxaLWwolSMJ38GJE_QQzlv-TxO1KPnoMnRZgf40IO7pxojHH7FM6A7W5assKRQJQbr7iLPRU2l6jO5OTE1Mc5mQFIXNqMRpAeGT91CH4eP6ZgaJ_CfuIsCBRpXatJXTcYoXUpZxUcdTwin_6tNreUEphhcd94dWkKtYR91UkumApbcLj_W9V-JkZS1Twfn5RgFPFD7oLisrfnq4oe6GpG0fPO7uRa-ycHWZA9u-PoDgOOhkTBL_IwZz094IXNlG9atvup95UjnVtPrYopSLLDA32OjkUQ5FLEANvjTPGk4y3fVKNkIfH02GSHEn_gnqbJ4FWFyTiO38FdXl49irW6JYsWOaxnhMM9XEynvwQZyCoU-B7__DiOohR6r0RP7z-SYcRwIhVMYAaUYwI77vZGeiowo7iPugBz8w_EH83ltyxKsZJ9op3iTE9NYZggi9DQ8ZVbIAp5pzMYUtsQHYc7oXB0E_AvC0XM22ZtwzQYQcjeAiBlemma5fZOujD4JmH3xpK38wt44mC3E_lCbtMjGuw-MIaZN-MV2SoP3REGZLZVpwH3f0aiQbesbf_BmGLmKIEyHk7ntPQ_JVotCjvwzfa2hxlUAGvcTB_rTHwEaNd0CP_ONk0CYI_oI-RJ3nQ11vxC0w1myCyBflJ1rjC_kUmeAocbxwdH2IhiMAFcwVbVHJYpCgR_pipMlp1Rsj5LWsSITIzNDLIYhJIn_W28DugVjxTIiS8ArHUMLWV4nPVRUhv1TU8wCToEr5qz19tf6AgA0GphlDSNymU1TctwbTllw3iQ3jiEgpWPU7N3a2vP8EofPu1mp95wdOujerUc6X4Y2uufnUedCtAFcNB5j-SnVC1Jb5EQXK9_-mHLdF5i1PNO_wXrTDsge38Am7kjn4UwrNt2xpG3ndY-xxeLj8Nyc2h2kpiU_y2zN0bL5JvWrA5rD_SvWfd7Y3S8s6QFqF-791FiCvTNdyPXntBP6Xe_mns2Jp3926UOn9ZLYx1X9bUwLtbWVeWtgn5Fx5aKcBRORdecykytnqkpuwk44F2OsQaT4B3faSQfC0a4uG3ehnYa5DH7FFlpxAB7A93L8IVoVqACO8J6oLTN7KrCF8b0og-QiZFEXkmF0rd2tW2YME2WkSXh4oxo&cid=CAASEuRoXxqHTq8o_PyN3zw8QE3Utw&rfl=1%2Chttps%253A%252F%252Faskleo.com%252F%240

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

408d297d9dc9f508a1a0e80af26e5cba10bc65228ae11bc77040c46891bfd9c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22483
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BFFD 42 B
63 B 27ms
27ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DcGFakcUfbEyeUnz0OhfR6OUK88F1lGJr9PVIoGUPWadMfCAbym_qfKkB7u_deoZ9HAHE6zszAiaQNpGtC2bPfjl3YoVjunawEQKFLgN2RDiwxbk4

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame BFFD 2 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/window_focus_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 454
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:37:02 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BFFD 125 KB
38 KB 31ms
23ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31bd4156e14d269de39d5e4bda8b81140fe74ccf3f91c49103c4ea22c8b4cd90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628249295356546"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38372
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:36 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame BFFD 14 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:36:25 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/ Frame BFFD 24 KB
9 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A_4coucgmcDQide62IVlFU5TPX-r0O-IPerLUOLSg-rH_iUAbTsMbCvU07ytESAki2362SA-nzf5p3mLjdBmr7n2SQAui4G7MaJpSOJ8d8XRJ-azHzFMVxSsCAJLcND3kOQ2-ktu1kdj6CF8hJw1BGCFP_jg&dbm_d=AKAmf-C942_99v5y6FibC2NVCmuf_GTJKFL5ZTtjewDOLwr-BoXBruiULTJmhRD7gdBCOmqHiMOrzYtEXDUByj7jwwiXtjcvlEpZSKmk19TrNbMtvdudDuZHOxGNvFEsT7xG0K38rL2t2FqyQgq9Lf0jOdZwJJOycN2NUSV4UP-YCPWxq4VqnZPB9C3mEY7jWqtx3vZGF-EOCNoJDOvXUAMvBJgLUgeOhNNjNtcaDir545abrPvYOgt8edaGvxJXC9nLEVWMPv7x-7ClEwZiWS9MQHsuuSJs_7-dV__G-ybCxXvPBiY38b3LRe6V3Zu22gjg3-64vd3FIOMthYsizCNC6NPtoENpeQJ4RxVyEuETJAyrM5yjf5ftPCb_RS6DqSUbQKnS-MOFVdF5uNY8-Yj833rkO4Y-UVKaPgTLRWyN5ArsyNIkj7C-0m0SBj1QbMWpHweTCAfggLy-FBloTv1YIhN7_VejZNBzFQR3zgp0cF7KV8NW6fjJzhO1cklDGBWYGu4NwsXMdUOYOxoX7S2JPBHGzDiddiFzm4ljMju2TzpXd7zcz-DTuPi9NEaX_5MsRN6Sd8_K_lZLICAVxs-bYsQxvIfnRP-1XFeBSdBWG8HnsUdr9sYVgLUUMx17VTKXk_jytaX8Wghi6gWbPt8ACo2-92rzOl4CccH8gAhrTzB2WUExkJGd79w7WL8CmXOeFgYo6eazmicE2_6H2pV0n7Z079aOjCO_YgWjmaMPgkRx_l7s8OY7QQLVWF9yDrsEd09linMogM5j6eRLB2o5pERPszy0yW2MKF8OPh8pVA9TKqXnGXEpovr7Q8iXF15nfdCuIMlp2xQjgs_yk39XYx7XXKFjZSsacVPp4ozGRbMoz6wuznMvK0rl7qPiArkMvHtD9r3byn_bleElBiH4_8iZSOr0kgJ3uc814e6jgOoeoWZbD0grUW2yMHrsbx4Tn80g5Q9XxvepgrnQZcxW_XB6CgE1TmMU_swl8YnXbE2ns9MX58ZR5nVlIh5B4wZqoCx3I9Qnr6OPZhx-bJ_GyYy_Lvm7ECWc2ldXNAmB7i4MOQZj3fUwvufT9WRj3EpWzIDbj7jC1eq_DGFbJNaflNby9kkeMUchnKBTYtTNzIXEtPHpk8Y4ntE24-JMg5_bKAPqr2Vf4kq6GpJgvaj9W2g3OOplEZQ5TdxEXTniiSXkA-EMvxGvMo0Ns5FhctqacYesk5rKkDzhem7A1TvfagdWTzTnd2vcj5jG5r2SgSeZrGAD2O-h1KLpk-TQCnidNVnzjFFuRGBDjVQC1tV67NWL3UDPd-BixofrqixkJPjGkE3m385uKxY0NUg5VQ8J2A5L6yvt_w-X9SxDw-bC8luvQZtBdrYznbPe5omZC7JgherE5Qe0SrAGNmmOactILw026KgfdLVUUbBnsxb50VavnVKwLiI7dLTZy-82gIMpZdpre0oHC5bPKbtHhvWzoo-EWfIpnHnuMglB0-2YemNFBBsI6oQuPK-co1j2ENYrVXRufqKJh0nMVGFCD3uUG-Kng-aviIvzuGcOaOuIn8ob4eI_JXt-2P5CFaip71-B5nXd3P68i8Mzhywgi9D5ig35eibjiamROaz9Q6zhkLZ92J96aiBtHtvqUCi_dImhq83aG6fHNqyg6YT2hAacxih_6HXZwZekmJzKJ3-Le9BsnfayV-zyAAcjoClqichk8lj73H0AnJ-uitGHvCNFSf4Mj79BIVNHrzHZMe_56GNdmy1KRnYmq8PB3I5Kp8kbKCvMsWClS6G6s_QRIaWJVn3whikeKlJ6ueYhHHG3DcGyFVsh4DUt-Xk-9OoKGy6DqLJdlspA658nxh9b2ZKhDqC_kZk2EmtT4C12vvm1Yb3v2Foe4QuNgAeKE-GEr7jfvT-XLP5m5LhfJrB9dqwcTxHSB3rNKP64vFvujU3uC923wpBl3RlN77FbZSGNCbGYs-NLc1PXB-4yM8OxaLWwolSMJ38GJE_QQzlv-TxO1KPnoMnRZgf40IO7pxojHH7FM6A7W5assKRQJQbr7iLPRU2l6jO5OTE1Mc5mQFIXNqMRpAeGT91CH4eP6ZgaJ_CfuIsCBRpXatJXTcYoXUpZxUcdTwin_6tNreUEphhcd94dWkKtYR91UkumApbcLj_W9V-JkZS1Twfn5RgFPFD7oLisrfnq4oe6GpG0fPO7uRa-ycHWZA9u-PoDgOOhkTBL_IwZz094IXNlG9atvup95UjnVtPrYopSLLDA32OjkUQ5FLEANvjTPGk4y3fVKNkIfH02GSHEn_gnqbJ4FWFyTiO38FdXl49irW6JYsWOaxnhMM9XEynvwQZyCoU-B7__DiOohR6r0RP7z-SYcRwIhVMYAaUYwI77vZGeiowo7iPugBz8w_EH83ltyxKsZJ9op3iTE9NYZggi9DQ8ZVbIAp5pzMYUtsQHYc7oXB0E_AvC0XM22ZtwzQYQcjeAiBlemma5fZOujD4JmH3xpK38wt44mC3E_lCbtMjGuw-MIaZN-MV2SoP3REGZLZVpwH3f0aiQbesbf_BmGLmKIEyHk7ntPQ_JVotCjvwzfa2hxlUAGvcTB_rTHwEaNd0CP_ONk0CYI_oI-RJ3nQ11vxC0w1myCyBflJ1rjC_kUmeAocbxwdH2IhiMAFcwVbVHJYpCgR_pipMlp1Rsj5LWsSITIzNDLIYhJIn_W28DugVjxTIiS8ArHUMLWV4nPVRUhv1TU8wCToEr5qz19tf6AgA0GphlDSNymU1TctwbTllw3iQ3jiEgpWPU7N3a2vP8EofPu1mp95wdOujerUc6X4Y2uufnUedCtAFcNB5j-SnVC1Jb5EQXK9_-mHLdF5i1PNO_wXrTDsge38Am7kjn4UwrNt2xpG3ndY-xxeLj8Nyc2h2kpiU_y2zN0bL5JvWrA5rD_SvWfd7Y3S8s6QFqF-791FiCvTNdyPXntBP6Xe_mns2Jp3926UOn9ZLYx1X9bUwLtbWVeWtgn5Fx5aKcBRORdecykytnqkpuwk44F2OsQaT4B3faSQfC0a4uG3ehnYa5DH7FFlpxAB7A93L8IVoVqACO8J6oLTN7KrCF8b0og-QiZFEXkmF0rd2tW2YME2WkSXh4oxo&cid=CAASEuRoXxqHTq8o_PyN3zw8QE3Utw&rfl=1%2Chttps%253A%252F%252Faskleo.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44b9a9d2c3baadad3ce45a7368c567c905db6d1473139b93b50123e3197e20c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9339
x-xss-protection: 0
server: cafe
etag: 8973662780436066029
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:42:47 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/elements/html/ Frame BFFD 8 KB
3 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 236
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:40:40 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BFFD 0
583 B 216ms
76ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv9PlvkVrJcwFYS9T3Sj2Dq-KKgIGS_IxzZPnvaarLS7vlgmC3hQJZAG9QrFxielz2J2Gqql5NXoAdv0jS1mEariLPt-4bOpVQygzElXEQpYkwl9hrM_NI_R4DhqAfufZXjB-3AavgerU9pMjSK5Xs6NHKqXDArkQAjXqfzEyecFbl3XChOGBiSjJL-GOwidpiONWybzyPpyf-WYTjS3QY4_-ZYGUUj0GTb3f6fkzEQl-hBhFdAnNuPnEu3EVi2wrwPNm1QXr6fCHAuSX6YotAG3ub79siDI0R2GJZF8cDTO2a8s4vi6S6FWuQKA9nMCRwe5JKGdSg_M9X3_b-Er-yrzPf4NnowVAEeXzsJDfRFvTk97ASy5VQvLdTpkE2JH2oOsbMxw3iKs7fLVNEFQbcUP81zI7l_f1FtwFnD9vSqVDsWxiE_LFxKKjDWVrVDCEQNMxTBqcoryQslKZoDk8_Mz8umj-ON33u_bzXBHdaQQYgCqVIvAUdC9w_LwabHxH8PLBuLPfAmZSNgn31xD2lLTIT-UygCDho0l0BdhlDNXFWKldupYtuDLBqTQuN75RKdqtk3DpC6yLiu6ZQVBlVNNeFo1kiNZ_fLPM6ZbIXi0jJvysa8SGZKAXZmJkE-Rjzfiggzo7f0YGd5tNovRbQ5MqwFNTcCMPHWg889dIyPzME4pmJuHng0hueHAHIFaimnbG2Mr3zx3F0GkgvUHm43hvL9ltNrdrR3N2R5ULi0km-EMrxN2l0Uds1AiXTRq5vi6zwIOcp88FsMhqpa-WJvv3VZk3P3QSKzdD9DsrhoOkihgLIJe6tTzk-OBXx8Q671CeSU2HfxD_3p-83gueXw7_6Dqfrbd1jJWwSkfmwndYgB1WSaWu-KRJxzDb8RzMDvq79NVdsB04HWGQNrpdJorBVBFwP5y-TDWf3VOJWlr-iORjDqdWzj_EdkcvqyBuOsVm72vHK-OhCBplURMjG_UzfDANcK2fKRuk5hlLyaYcc3CHYcBaNfODzVhx2Pyk4Uk8ZbzKCUGUN9GXp8iHA2aaTGwCkTqStnJg2KjgI3QXJCaYUnyuTgpoC-ndvXGKGQft3JVhXrQ0Y6uaCYPlfzSXZQlNBKKJgc8ygpHL7oVONrCtZA8mOSDy5OHOrSPLdfj8fHKvA06202f3jI94nexLZJn7iBqVfQqADjMZ17-sA_Oh9Br0LzkbbgGVpge-zm4iNJ4zqzVzXllBcbEqHQaLzvORwHTz3nQRPbbfw0R1SIimV2aUXc_PpBvHrdGkeDONLigdNm&sai=AMfl-YSRPDYm4BI7XGvcivegb6aOkJ5RNBc_WW51Rs1hEfq78AP05WciDCC58dQT5elrjGaOjvamUK5zi7Q8T9lrnmHHQ0HHHzOCaEUR5Er6wkN24iYHu8zw-mmWcHb8q3oiWeyV3m82AiJmvk7qmBsqp3rVsg1n6bWq5dFPDegzsE2b6VBQ_RPOug&sig=Cg0ArKJSzDmAkGtOA5xkEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210803.12893&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 09 Aug 2021 12:44:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame BFFD 41 KB
15 KB 16ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 11:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3598
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 11:44:38 GMT

GET
H2 200 LMS_DBWBID_US-EN_Conversion_300x250_Counter.jpg
s0.2mdn.net/9295318/ Frame BFFD 46 KB
46 KB 48ms
16ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9295318/LMS_DBWBID_US-EN_Conversion_300x250_Counter.jpg

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d52143581e0975f5c1bc2d40cac0048e9e263c79870558261101d233aadfcb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 04:24:52 GMT
x-content-type-options: nosniff
last-modified: Fri, 02 Apr 2021 02:44:05 GMT
server: sffe
age: 29984
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46808
x-xss-protection: 0
expires: Tue, 10 Aug 2021 04:24:52 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3720
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENMPmM6Xx82j1iapvLh25pY&google_cver=1

43 B
1013 B

123ms
101ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENMPmM6Xx82j1iapvLh25pY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXkRIQs9JQITCcZRfmTiGEf_bpirvIszeP5v6i5jdJYdlO2HSd9MWEwboMmWSqSXEaMm2CHqggr7HqLbmE5DB_S5PKWgOtYqai4X9JGjl6-Od0_FZPBI0fPuFUpWt-2mZqcFLyjR0JTvwmtjIzq65AQZs4d9A_FfjW4vnPEPl0-COjSEe-x9tP28yzkkMVGPeoF65YHFNwWn5b5euImPPvjoWCBEQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:36 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 09 Aug 2021 12:44:36 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENMPmM6Xx82j1iapvLh25pY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3720
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YREjNJ2jDfJTkAkNeh-oiwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1

43 B
893 B

71ms
71ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXkRIQs9JQITCcZRfmTiGEf_bpirvIszeP5v6i5jdJYdlO2HSd9MWEwboMmWSqSXEaMm2CHqggr7HqLbmE5DB_S5PKWgOtYqai4X9JGjl6-Od0_FZPBI0fPuFUpWt-2mZqcFLyjR0JTvwmtjIzq65AQZs4d9A_FfjW4vnPEPl0-COjSEe-x9tP28yzkkMVGPeoF65YHFNwWn5b5euImPPvjoWCBEQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 09 Aug 2021 12:44:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3720
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENFkMRpNr-MI0XcTRAnAfDk&google_cver=1

43 B
1006 B

143ms
78ms

Image
image/gif

185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENFkMRpNr-MI0XcTRAnAfDk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXkRIQs9JQITCcZRfmTiGEf_bpirvIszeP5v6i5jdJYdlO2HSd9MWEwboMmWSqSXEaMm2CHqggr7HqLbmE5DB_S5PKWgOtYqai4X9JGjl6-Od0_FZPBI0fPuFUpWt-2mZqcFLyjR0JTvwmtjIzq65AQZs4d9A_FfjW4vnPEPl0-COjSEe-x9tP28yzkkMVGPeoF65YHFNwWn5b5euImPPvjoWCBEQ

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
X-Proxy-Origin: 37.120.209.188; 37.120.209.188; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b3b4f237-36d4-4176-ac7a-f618b1df6516
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENFkMRpNr-MI0XcTRAnAfDk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3720
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D

170 B
188 B

138ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:36 GMT
X-Proxy-Origin: 37.120.209.188; 37.120.209.188; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 92884826-f463-4bd5-b82e-37be2b66fe11
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 331 B
164 B 314ms
313ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=3302398753004253&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=1&rcs=3&prev_scp=a%3D%257C251%257C%26iid1%3D9113725436610209%26eid%3D9113725436610209%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D13%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Daskleo_com-box-2-9113725436610209%26eb_br%3Daf063c244089b52ec5a0423a258f1f8e%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D140%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C996%2C988%2C783%2C20%2C17%2C20%2C608%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D260%26reqt%3D1628513076586&eri=1&cookie=ID%3D339de4d2466eabd0%3AT%3D1628513074%3AS%3DALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ&bc=31&abxe=1&lmt=1628216635&dt=1628513076608&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=285&adks=1875650461&ucis=g&ifi=16&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x60&msz=468x60&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

cd7dd964b1da1aa80ad7ba1d9f24bd0c709ff1d3312a8960b78dea94ca5a1379

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 container.html Show response
0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F269 6 KB
3 KB 22ms
7ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 09 Aug 2021 12:44:32 GMT
expires: Tue, 09 Aug 2022 12:44:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7489 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 09 Aug 2021 11:44:39 GMT
expires: Tue, 09 Aug 2022 11:44:39 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3597
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6661 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 09 Aug 2021 11:56:19 GMT
expires: Tue, 10 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 2897
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame BFFD 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f595c28d56b2d8e95e71397899294ef99962a42f36c086e323065a77b2a6b939

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 52ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8yIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjU3OTE0YzM3MTYzMTJjYjdlOTU0MDkwZjA3MTdlYTI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMiIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMiIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8yIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjU3OTE0YzM3MTYzMTJjYjdlOTU0MDkwZjA3MTdlYTI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMiIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMiIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDUxNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=520; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 54ms
53ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: askleo.com
URL: https://askleo.com/porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
42 B 51ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wOC0wOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE0In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wOC0wOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE0In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=520; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:35 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 52ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhdWN0aW9uX2Vwb2NoIjoxNjI4NTEzMDc3LCJhZF9wb3NpdGlvbiI6MTEwNCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImJpZF9mbG9vcl9pbml0aWFsIjo4MDAsImJpZF9mbG9vcl9wcmV2Ijo0MDAsImJpZF9mbG9vcl9maWxsZWQiOjI2MCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NjAwLCJtdWx0aV9hZF91bml0IjoyLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhdWN0aW9uX2Vwb2NoIjoxNjI4NTEzMDc3LCJhZF9wb3NpdGlvbiI6MTEwNCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImJpZF9mbG9vcl9pbml0aWFsIjo4MDAsImJpZF9mbG9vcl9wcmV2Ijo0MDAsImJpZF9mbG9vcl9maWxsZWQiOjI2MCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NjAwLCJtdWx0aV9hZF91bml0IjoyLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=520; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H3-29 200 container.html Show response
0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 280D 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 09 Aug 2021 12:44:32 GMT
expires: Tue, 09 Aug 2022 12:44:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 container.html Show response
0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3FCB 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://askleo.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://askleo.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Mon, 09 Aug 2021 12:44:32 GMT
expires: Tue, 09 Aug 2022 12:44:32 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame BFFD 0
23 B 152ms
92ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 56ms
56ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8xIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjU3OTE0YzM3MTYzMTJjYjdlOTU0MDkwZjA3MTdlYTI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDQxNjk3OSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8xIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjU3OTE0YzM3MTYzMTJjYjdlOTU0MDkwZjA3MTdlYTI1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMjYsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDI2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDQsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDQxNjk3OSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=780; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 57ms
56ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: askleo.com
URL: https://askleo.com/porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
42 B 54ms
53ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wOC0wOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE0In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wOC0wOSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE0In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjEifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=780; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:44 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 54ms
53ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhdWN0aW9uX2Vwb2NoIjoxNjI4NTEzMDc3LCJhZF9wb3NpdGlvbiI6MTEwNCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImJpZF9mbG9vcl9pbml0aWFsIjo4MDAsImJpZF9mbG9vcl9wcmV2Ijo0MDAsImJpZF9mbG9vcl9maWxsZWQiOjI2MCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NzQ0LCJtdWx0aV9hZF91bml0IjoxLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhdWN0aW9uX2Vwb2NoIjoxNjI4NTEzMDc3LCJhZF9wb3NpdGlvbiI6MTEwNCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImJpZF9mbG9vcl9pbml0aWFsIjo4MDAsImJpZF9mbG9vcl9wcmV2Ijo0MDAsImJpZF9mbG9vcl9maWxsZWQiOjI2MCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NzQ0LCJtdWx0aV9hZF91bml0IjoxLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=780; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 53ms
50ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI4NjgwMmE5MjNhMWYzMjUxN2U0YzVkM2I2ZDU1MDI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMiwiYmlkX2Zsb29yX3ByZXYiOjAuMDA1NSwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1ODgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI4NjgwMmE5MjNhMWYzMjUxN2U0YzVkM2I2ZDU1MDI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMiwiYmlkX2Zsb29yX3ByZXYiOjAuMDA1NSwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1ODgifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:44 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 54ms
53ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: askleo.com
URL: https://askleo.com/porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 09 Aug 2021 12:44:36 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 53ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTA5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTQifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTA5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTQifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 53ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImF1Y3Rpb25fZXBvY2giOjE2Mjg1MTMwNzcsImFkX3Bvc2l0aW9uIjoxMTAwLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjExMDAsImJpZF9mbG9vcl9wcmV2Ijo1NTAsImJpZF9mbG9vcl9maWxsZWQiOjIwMCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NjY5LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImF1Y3Rpb25fZXBvY2giOjE2Mjg1MTMwNzcsImFkX3Bvc2l0aW9uIjoxMTAwLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjExMDAsImJpZF9mbG9vcl9wcmV2Ijo1NTAsImJpZF9mbG9vcl9maWxsZWQiOjIwMCwiYXVjdGlvbl9jb3VudCI6MywicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NjY5LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:34 UTC

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EDFD 624 B
297 B 52ms
49ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXnIiQbeye4fHnPMW4wPmdTkWem7aTseplhpMJ4NnEAgYZp6cC5bfgmSTEVfjIBMPw4oBjLN0SxWHBMyL9DBgxU1LyOhSEKJfjQyPltWo58ZL1mVsqdqHQSneThIVl7MtMAFd318i7Iptc0qe5RorT5NkQ39KhDzexIliJlTB3ZHHvKyjwNymyd867HsbBuu8c97CJMVgxHRLvuG4_J8eHMtF-f3A

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXnIiQbeye4fHnPMW4wPmdTkWem7aTseplhpMJ4NnEAgYZp6cC5bfgmSTEVfjIBMPw4oBjLN0SxWHBMyL9DBgxU1LyOhSEKJfjQyPltWo58ZL1mVsqdqHQSneThIVl7MtMAFd318i7Iptc0qe5RorT5NkQ39KhDzexIliJlTB3ZHHvKyjwNymyd867HsbBuu8c97CJMVgxHRLvuG4_J8eHMtF-f3A
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlBafuUBnXV_OSM9uNDtYVtoys-AarxpvUeHMiz33wzszICXhyWU2e0hB6yRmA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 09 Aug 2021 12:44:36 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F269 45 KB
22 KB 57ms
52ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aq8O1unoPxebUWsdSiBSZA-Gy1r2MuLp2jLO2d-LuvdLAm40WlFLqp7iWdKxKr9TVC3X2eVuJo1UVx1bnyXcoLuabyojMbku_HMfqfBzJxErb31wfvIhbxh8Tb2YxIdDnAmiHtvJsvf2gyY0T383JRKovruw&dbm_d=AKAmf-Ac_WYE59QnfbtUg18N-CoP3JQzqtCoWmoj_1RKHdQm_kY0hSBOvL4oOG7jkK_iWt_SSqnqYzGhFO_TJZqyhMfb9FgWMDtKDo8FmD6aizE-B7JQH7B86wH3ItcTlNo3YEUt5hIE0XzDzSQ1tiR2btKExfn7flUFBwKE-DeecEwkcbKF29kVNuG2S8ndCgda_DQdXWfO93WfIEHCI0oDU1sO_3b1ryuDCRrO1moHTq8_116m03k9HT5OY1z5pn7wT7zhG8FmPdua6R4BurFn5tiEFCHr-a-nkusCVfcofzK4-uUyI9Kf_O2ptln8hvCYM_fPljAdZeqqWJHglCHYWCFbdIpzWH3f4bmpcUtqJjcF1EjylcCoSJXEdBKLU8X-AdOpZ81P2qORq8ZtikEZJg56egs89zGzmDX2ZvpUJ9k3lADKM5pi_J0ZyvPSzKbEOcU_0QN0zlC7EACvebRrMKODQzPasZwLEZgeglvSASz63RpuOJx4jzyjvKsU-FbtRna7owRIwrphNG_CdgDV12heZ2PGBq872ZfpACf2YqLNB6cSlrhF2gf4Wmi5aaVa-bexXecHEk7FQ6E15pWhce6hZc1l4Hgpj7TvgzWcUQ2RaNcnqDZFeQMTLif37vddYGT_aakGGwTUa99TyGsny20WGW3ko572-C43uIr7tlRiUq35ht6kS61ta3N0tLB54gN3An4jftJJ6AQBdaMjXjOYc9HL6H_fauBw1QmELUVUkscBKy7gu1BOpKAnVXQDVuTC50bDkt5keeZygqNiv630Jqx4iRoOQzzhDX4aBhQvMvb9ydfhDbzG_18E7dl0cF1ZDI2_l8W-WcZgPE34WzRuPg6dnZz_a8kIP8_5ly0INWhozdmKDelnDC_QimvcaBo-7lIqlx5AUyUADi51q27KtmavQiNEcJv-aQU4c_k_miiyzhUNCDynVUY581_4OcAHgOe0YBixa_3jKTBA4D69WBuaJX5tpmRsNT6S3L0i5irJ8RpsGCRD98zat9s6Pq9tOYPwg2v8KhjB0x99QbfY5dJnJkhZCsu4981dwYQ6Ay4ymefgX8kUDJrI5iwBuNn6c3bAQ3PQ5S5yzd_qE9Yy-LoV1N4DW1M3jvfYfFi92nWm0uIZBroZAONRzcxb85VcS-1CI419SXsQsKuoNgBaOQpVvU2mmZkeXlE_EK_kxAJcw93fCn45ttLccSeAGFA0oBnWTBYG8Cu3BXfobXY_gwLnBP43uuCpiQa3AlyR3kiYRMneniKDtw7yxYHsT316z2LNb67UwDLBj7DsTV6XMD1fxvPZG_E0zqj7OFK4c-C9fC0KvjJb7dx096nJFWxhg4BnafqQKebHfNrlyeoay6_-ZXoazULX68oRqrPhOLmGtFfdzyEYmMDq6POxB51LSzxaOMGhuRXCxXQLIyBYjqKcFhDii-DCLeo_Nhh8WphHW-txygrktaiJJo34yp3y-DOEHb_tsOPjzsl3uTCLPJlMd2UaIwtdo734uFR5_Afbpx-rU78C5su04rdj0o7zh4bmKEh58lqvdm6i2AEjWgltJJ4-sQ1RK7mY5rvAyCdG__zdFc8xv2TzQjj0T6OJl5gMNvm_za4oZ5oS8j7cF6nYmB9sO8fijmGPbnzqAgftoVPSgUcznkxU4HcZq60j18yGyDxCwIvWE52PiOOkW0jsj46EorrcOBZsZUnKVE46I8hThpRmgiEAx7zlyuRwMYoA8LZfGto6jUvTx0WsU7nl3JhckwGBJsVrmifRNokx45vFfg0Fk6nG25-x3QQSuUF5amOZIZsTwFAPxsIhYdXt5ZcxMu-U6lHrNOIemJdGze2yn0JnF5Jt3mlAiGUk6C1dEMNeZxVJ4OJzUtYOz4GUsQDYYtnYoVgA7SKZdFj2tq_-dk5DZbYECCbuqpw3ki0zJkZwZtCRlqbib7fqyLUbdVlbUBsJCowh7L0aSb0Ayzzcwp6TZ9H-19zjYhe9Z_6cykY2gEbSSWtsXx4Cf8SPC3Mt0gnKhWcPeGIFnEp3Gyj-34r7ldH2ZZkUgOEdedPs6jFzQUp44rWsataIWDeFIjJip8fk9pBHNkKpSJwOOsl1MhUoanNr-1RyaoZqHc1K7ioIS4IZ2kYLGEv9WIyjsHyCHA2T3DsWDuk5fmcNf6eLls6NIK8xRvClRPe30e4uLMoglQgTm_rrkZtavineV6cmnK6M4f0zOXTdObuy_aTewC1YCcvcg3HaFfYCiVufP5yim3InVmFIyrtM7kXtQpN8fP977IDMklx_VelVezrhiGfyigoLJQ54DesS7iKMLsmdnXZ6xE7eMylt1nqyJMpSuRhDaUV1rQSUCv4UkAr9rfKett2IaXxbZ8Ff-pZqsdnkS9qDcnf1fTJrucWbvZvhIsJS5h2yvDaqDRQ6vWBh9DkruIFeHNJ5MdOoZ71q5107bS7DCSyb5LuO0ZXzcEp9Hu1FyBSGCgv04YlJkWgU72LXZ-mj7vQrj-5ekI7BcOA3zevC1tIUP3RmMEBf_-pf9E91aT1AueHdUorCMQGErMAz8qe7eLGQA0NLA_DL0AumSzm6Vd8G4Q1yE1H8QQBc9x2seg6DxI-hSBD3EPFNSImFLwLyGU6geRCXDFu-YWc1OG0W7ATCIforQaW0YWAReJnSdaUSTgebCuif4VC0PeoLRGeSI2QxnU9l6oEsYpF_XGGvDzFfJXyizoNa4jwPeo6b5EBeNOSqGCdc5mtCrPD-AydfoAZOaDYvHMBbAdKwQeLOKMuMMcHPdlSyuzC7DX7KIy2okXPkz57opTCMLiTfCdb9myEk3kKnQ8TMaVA3ORHtkjTiUp0NoYZEFEJ6QthU26ULFbuoZ521UBK7qlpyPcL9joVUe_B84v24JTaqo6-QOdjTukp_T187B4T0Ps48_zSRLujgYGgfLU74BoP2AOUmXk_t4c7lUkmg2A4ATh1DA1TtZDMdIIjSamG4vWUTR6xNzOtf4b6YCuyqS5re0xDlYrIha-aAnkJH_lpaFcM6FqLwq_afXVZIbOVq2cxaELkLRllLFDS8389UfNfFWTZJUky3_IKQIYzR4RCgEZzqAFY7oSl0AHmN1hCl0g6uOk3l3onUl86UOGA&cid=CAASEuRoNR8uX8-yIFtdYPVAkAtgGw&rfl=1%2Chttps%253A%252F%252Faskleo.com%252F%240

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b10bfc9c53a2434084d9cd393831c2156a885832ef7546d97f2cc8a8b0626a69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22597
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F269 42 B
63 B 52ms
49ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BtGzcf9bV8ZYSdXDj-HaCheKVH78QT7rjpFeBNjSJbC5Q3MCyCryrBfoBNjqQ9wHl02emaD0AHkalv56UZutAAe44bWHIYkOwgWOhcuPxg0AXK_uY

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame F269 2 KB
1 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/window_focus_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 454
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:37:02 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F269 125 KB
38 KB 58ms
56ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31bd4156e14d269de39d5e4bda8b81140fe74ccf3f91c49103c4ea22c8b4cd90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:36 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628249295356546"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38372
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:36 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame F269 14 KB
6 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 491
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:36:25 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6B87 640 B
316 B 63ms
19ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUlBafuUBnXV_OSM9uNDtYVtoys-AarxpvUeHMiz33wzszICXhyWU2e0hB6yRmA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 09 Aug 2021 12:44:37 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 280D 45 KB
22 KB 86ms
41ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AwaTO9EjdSP_h7tQvOnsoHpgoIHAnFAcaDGhWA9JIhhuvXcudW1DQ-aEwJ6ATxXLkhfdG3tzIvRQMGSXko5oYyekUqUJmjJQSrBhNREQAaLclxo5aZ8rGchmxyPJqFw339kNJK0mhdI8sqalU2Sw15Lln4QA&dbm_d=AKAmf-AshWc17wxn-6C645Je2G0-S7hj-t48BHrXxidzzC2dHeDlDMGtlBJFMlslFr_Mj5Xlbl6h1cOMSTbezxDsIFLyuQyBugQJh3msiitEph3q_06C2hsT2OYLtOUNfequf3kAQE3V4t06WDYpof1euCl9QmWnSa0spO8amtpW504P2CHnE1eRj6YL9cMZa7tHCzTrF4UtzIVKSnjWr8NicKbWnsMWP3_5QDZCmYcLfUavUhfreWVa1bOlOn7oIqQNrM7UWWwp4fLFZ9uJ6mRCXROzjXNGd5UchmImmIodHYlN8kdpJsKgjuKevGGFmvcPpBvWe4TsKpkQQ018ncHs0JYTSNHMkLIbjSP_MvYM_5x9XQXZTI5AF3SQAIwkNEvKZcg6RBJjDrQdgJfQNy9e6-VC93-qYSKCOVm3_Uqo7YpNHOYoOg-rOS2BMh_vP15BD_9__Q0GQv_Tt_42m3EIBGZ9vTlJTGRBFV8MfAQhHcKqwakieVHHR4zDP7_h6pT10hpEx2diY-D4WI1Qroqa8MmTW7OYgLWuhaSoWC_qRTG87RYpA14lO0w8-fHa8OPNJC_0qYc-T1GeNJuy68OnhNQCPI4Vjuzw2Y4sDlmgOBy7VO3b8xuUNjZu0ceOBBtCfJ2iVpuJUiYTWXNQetcBP74O64674EqZwq-k31OLOEAB8_52f4DuORFj3ANPWl9QonxMb4MRzB1c-w_5Q_uxAyKh_5XkXbowLA1y7fBDKPMrjCyzLiYRuLSWp4GAPOHmcl0Z8KZkFnmkS3hLYRlquCOmf1-0_YF41XoyMUeKiWad8sipgJElvpnq8lTIyPlWBjMoaBQIOGDBulZdvuvx4h3pgWz-Op6PfgNcF4-beC3e4MteBg0VyqlmOfFy-3if8dZiXJufM3KqT1bK4vo4Cs704Y4AAbNCB_tODgEI6jBqLCjOAtzHiJVhd3tNhBhenKUlRLsKakqXkN8YviQ_1Oaw7S9dB-41NG6LfswbLP7-QbPgG7u2-B9lLJnVFFDHyeLT3nrBc-YMMHsgPEAOA6SxFVb3q7HChxltsG_RN3KBup_zEKe_Wz7Kv1F5W1vsrUl-b0FXGiyKhCppFuE73_EyoErt6XIC4wXIqV1z3bV4epYwSSNtpcKPdYheQ04uKRqqKA15Y9o5GdBJvUQYHp1vCGMpwFGMCRWlow90ev92spKKaBpaLJK4BsT-BACjT55wPP81UES31fCNDfls3QV5WRE7Y-ukaUoP-I7jBuZ7RHMzQ9O9NN0qh1TMsttCdr6ppODeP9nBSa0enL3bRghtIh0cDTBkW8F3RyS2zvRGrLt3JPjCK-KIHHp0UwhF5HXJMtbxZByA34h5zYwYZdfDOn9p8wh3UZJ6emydj4ZF8kjMS8apTIgWcNPJJ50n9caYlc4ZVUENS8GiIw2OOtyTuEgGh4_d2AhNzWXTTx9XgqMGybyvB-_1VwCC5LFanxXjl8BVy8ls8bxjM_EohdLpm26RHsKi4iyyfXiNo3heeY--XPq--wvYVO8aXctYfrRzXb50276tlS5uXigbqWLoH62BK0SZWXIzzYgFjXnWFxj7e0o1IjveVaSnK9WtPps8Kw3g3AaVFkokGhV1fZ1H8K-ZNncgAiW03tYuz7ijd8Mxl17wEYPhTm4vKLxvsROBBzj9oNzFJLAeIKV-dWg9QhLTj1VsdpyhJJccnhZyK5DLyTYcLmCchsnuMmADito_dKgMGTnOYLnjNnfY1VZrLnN83GvlEEPDeMaD8JuUExUA8r6srrRZb7hFk2CiMC8tS4ygwNOj7Xukmlk5lA1SLxu65K_uU6dHNl-rcFnmSSW-MgnEvkT-EvNsKxIwctDrxMgXWQwz6ACkb41IBat2_9_1-KCIUo1uXXQF6KuNbRtprtAwx_NrPVaSqNDx-9Lebb8qTYUikmD29pYLAna09Xsphn1EbcAsdCs-bDlnMLztJDlWcvqoTRZ-ueKNNTOekXfBxLzsWF_w6o8VyGXBpfMSiKB2jp9TZPBLBmgI6xSvL0Vg1MNBLN8ktX99gADuX-CHEqtKLXPDEpCTdXk9Vf7AfW3R4v2j9dS5QOTq54md0yJUcIFc2K7aS8w7McYfETjCIyN5KahajtSmUHdyE34D8OtyxSYDQd-M5QfsknQ9aAOE01zvp_9k_Y2X__4lXINpXyeOIBlXahKtS62r6KIt6wnMUvCm-mRQMOtJEx9eZiPZ8biKh2etWMnC45bMkWutTajEz7y_n1TOVIa1UGlETK3iQmjoaYUOSyR2uZDNq1PXL89RqWWXNCoaMM4LySXXilCNHwlf-e3HbOYpM8gMXcmxQNb0ade2Di8oOunPWucGgX2BqH7SyQM3CR86lvhPzEMydlbhtw4dG-MVdkeymImmyfxEDY3Nsmd_1YEJ9VzaYq4tYGn5yXEsX5wH5Sk5V5URPrcdBiwEVAsk5PxfgGrtTFiOOOTWLfW0_i9AztmDUWz9mytV3FjA2vZCtJl33q9tkStJgc5I_Q5L67H8T6FtYmUqBy_NyXY83yp16_RLgBOt5p_vXqiifpccgp4NR1UiAM8PUDbDcCFfR9vyysyme3uQGpu8obuiBpknTC_s4hsuJaUd176BNm3sGang4HdeXfBzd_GsKgLa50H5HBoelhj1px5cl_mce7RUNTqp40cbMvxDYDi5jeFXKkg45AkMq945W73eIq-lJbtO7NhQv6CbYcBrSpHoZpjma4EZ_CG7S2d4LW0a_tBp861P66fIBDryPnPpjDLHFz9_1mQhxVSSm3R1nIdM-XFEHXg2Q0_XWrwLiimwbiUfVGyOtTvFaziJEwLKVi5bWy5PwR4esXPL5g-1unhhXNirtt_3LznC4PQXP2VvF7e_oFBzIfSofZ-haOLDN00QUeHi4v-veczrpGcvXIDcL6i5msy9UVAIxr_qZrgLQgbPa-vGWlNR66YiApUx1VUX53he-D5Vkuf3TpZVJivLkjVzVGTGJvrscoNbkylHTOhX5KMdmZm4vCF0CYZdGoCjgUlvMAx7g0mOjO8XkXnW3quj3U6kiFLt7Lm3XOTYjY0vTIdJkcCKDLwT8bg4X2xKwLcSWg&cid=CAASEuRobMd28Z32ssjNnswp6Pyzng&rfl=1%2Chttps%253A%252F%252Faskleo.com%252F%240

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565c4499fdc5a3d666fbbc8f2711cfb804913d324af47a216ace7821cae632f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22632
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 280D 42 B
63 B 76ms
27ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Asw1XvKISAaJHcW8ZAN_17YVrKzbcB9Mo9yCBvtN4FP7bYmULUK814OQv9S_fJZwcfgICbE56vVZuH6L_vbpQHZfXjfA56AtidT1n6I6acgPzFZ1U

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame 280D 2 KB
1 KB 43ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/window_focus_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 455
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:37:02 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame 280D 14 KB
6 KB 43ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:36:25 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 280D 0
0 63ms
16ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ24ptgx4N95DxjPWkho1MtYWMdQ_Q1cMDfo26UtFB2udv8dUD5GfjTDNAFCNadC9tE_hZn3fYaTemI3f3KXgOjXRzOdA
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 280D 125 KB
38 KB 48ms
17ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31bd4156e14d269de39d5e4bda8b81140fe74ccf3f91c49103c4ea22c8b4cd90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628249295356546"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38372
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:37 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 3FCB 0
0 88ms
66ms Fetch
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cg-W8NCMRYeuXEJfZ3wPThYLQCP-A1_Zh3-2UvLkN2tkeEAEg9PnGJWDxrfyFpB-gAZW1lNwDyAEJqQJ_hdOmhrqzPuACAKgDAaoEmgJP0ItWEVfU4G_Mc2ooy_E6ZhXYCKPXobhLnVk3cG2Ngs3rh-rfcvEiMRVEyVrpv9upGofEWVK9ch-k-PQI2cFpy773KK1IYeT_XR0T6tPUkpvNra7eXH6nIIboBX97h4wf0ypVF2-umSCbGDMzY2_-B9uVGfgEsbhNilOSYOIB0VqAUc0-Ktn41xWeQ-j8dliNEDg-QJ2zuayS6uyPZyTM_XZjOMP7vgHklGgn_zkthdSoc-MiNWJPXkW9T--7NrviDRocQgNDHcuk681Z2v6QcP6J_yWtyC4Kn9i5gQWciTo99NxMex-2zRGK9gE8nW0SePDFuYAhKWxFdtWeYAiVZ8gR4kiUyN3QMKlkZuHV-fFG39PRenR4zkzABL7InY7qAeAEAZIFBAgEGAGSBQQIBRgEoAYRgAfTyusjqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEOiQetIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNTk1Mjc1OTAyMTQ2NjQ4MoAKA8gLAdgTDdAVAZgWAYAXAbIXGgoYCAASFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4&sigh=4Ax_X0PiInE
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 606d76fdb3521e8b1b19f21f Show response
c.bannerflow.net/a/ Frame 3FCB 53 KB
18 KB 72ms
34ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/606d76fdb3521e8b1b19f21f?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC5TeJNCMRYeuXEJfZ3wPThYLQCP-A1_Zh3-2UvLkN2tkeEAEg9PnGJWDxrfyFpB-gAZW1lNwDyAEJqQJ_hdOmhrqzPuACAKgDAaoEnQJP0ItWEVfU4G_Mc2ooy_E6ZhXYCKPXobhLnVk3cG2Ngs3rh-rfcvEiMRVEyVrpv9upGofEWVK9ch-k-PQI2cFpy773KK1IYeT_XR0T6tPUkpvNra7eXH6nIIboBX97h4wf0ypVF2-umSCbGDMzY2_-B9uVGfgEsbhNilOSYOIB0VqAUc0-Ktn41xWeQ-j8dliNEDg-QJ2zuayS6uyPZyTM_XZjOMP7vgHklGgn_zkthdSoc-MiNWJPXkW9T--7NrviDRocQgNDHcuk681Z2v6QcP6J_yWtyC4Kn9i5gQWciTo99NxMex-2zRGK9gE8nW0SePDFuYAhKWxFdtWeYAiVZ8gR4kiUyN2SMqT2uQ5LtAPYpEhLeOTK51dato7ABL7InY7qAeAEAaAGEYAH08rrI6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG6gH89EbqAfs1RuoB5bYG6gHqpuxAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNTk1Mjc1OTAyMTQ2NjQ4MoAKA5gLAcgLAYAMAbgMAdgTDdAVAZgWAYAXAQ%26num%3D1%26sig%3DAOD64_3fCBiH40R_q_nUQph9hn_iyE91Ow%26client%3Dca-pub-6396844742497208%26adurl%3D&cb=1182224599
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 579e75d3ac3a8ee1bfb4302770335e7363d2f9bb5dbcd96ff28efb7b03104599

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cf-ray: 67c113abae0c4a8b-FRA
link: <https://c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/published/592558/760486/preload.jpg>; rel=preload; as=image
request-context: appId=cid-v1:8ccc0d93-c9cf-4965-a9de-1823f9df557e

GET
H3-29 200 m_js_controller_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame 3FCB 31 KB
12 KB 25ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/m_js_controller_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6310afc6b083799134ea872e83464c204f87e0963ec77d675f732682d6a06c67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 11:51:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3209
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12643
x-xss-protection: 0
server: cafe
etag: 13082689728437942179
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 11:51:08 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame 3FCB 2 KB
1 KB 24ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/window_focus_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:37:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 455
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:37:02 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3FCB 125 KB
38 KB 30ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31bd4156e14d269de39d5e4bda8b81140fe74ccf3f91c49103c4ea22c8b4cd90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1628249295356546"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38372
x-xss-protection: 0
expires: Mon, 09 Aug 2021 12:44:37 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/ Frame 3FCB 14 KB
6 KB 20ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6204
x-xss-protection: 0
server: cafe
etag: 11055049251678278959
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:36:25 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 3FCB 0
0 34ms
16ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQLUCy2vLa46UwjQwY-TVa7zCvt1E53IEeJ4qNgCfjKG-v0jYfTKIkX58HHi1UgsVfaIfpnkiJzLD2b7ouBtuUY6BAeZA
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210803/r20110914/ Frame 3FCB 18 KB
7 KB 27ms
10ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210803/r20110914/abg_lite_fy2019.js

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:29:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 921
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7614
x-xss-protection: 0
server: cafe
etag: 9899176843389144697
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:29:16 GMT

GET /
google2waycm.netmng.com/cm/ Frame 6661 0
0

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 6661 0
104 B 138ms
63ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEJM5QFEQHHmCqHv7TVtmdb0&google_cver=1&google_push=AYg5qPLc1MaWK8PKk_YN7rnX5VCxbuO_MP_PWrvcc3WbodD-h8JkgOhzHtcxq5BUmphHt8lK1IxmunLOu7R3bvNgqJFUv8JrxMfK
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , United States, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6661
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEFyeeLwwD_xHxZUZPlssepg&google_cver=1&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJV...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEFyeeLwwD_xHxZUZPlssepg&google_cver=1&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSb...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJVGkDAr

170 B
188 B

66ms
65ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJVGkDAr

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPI5_Wlef-EQny5NbLCwd43tfE-fE95zBOrmm--1mIiZHGsmkXSSJgwRp-Y8JVN1K7Olio62uObv-_D8lJVULBpSbJVGkDAr
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6661
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tsOrzOSiQyScRv8-ll94FA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tsOrzOSiQyScRv8-ll94FA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJsaxxRISzFWB3SwjrmdohBmui4jIM_HOfCAaSreFK-Ni3Qn5MVT9j0uhaYo_god_WA_p44ENKcKBcZfQshvaPqp5gOxPlN

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=tsOrzOSiQyScRv8-ll94FA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJsaxxRISzFWB3SwjrmdohBmui4jIM_HOfCAaSreFK-Ni3Qn5MVT9j0uhaYo_god_WA_p44ENKcKBcZfQshvaPqp5gOxPlN
date: Mon, 09 Aug 2021 12:44:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6661
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEOymQufsRhv0l-vcJdTC5UU&google_cver=1&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDSNLvpBb...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEOymQufsRhv0l-vcJdTC5UU&google_cver=1&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDS...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=c3LyrumMRmqfSVyY2xsIug&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKD...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=c3LyrumMRmqfSVyY2xsIug&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDSNLvpBbyQjI8

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=c3LyrumMRmqfSVyY2xsIug&google_push=AYg5qPJjzklk7E-mkTCp80U6Pz3gJSJM5-brZGD8s-1INuimuif553gvxMLc3GVUbiopdk5AofXwyb4JzMxetKDSNLvpBbyQjI8
date: Mon, 09 Aug 2021 12:44:37 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 6661 0
44 B 877ms
282ms Image
text/plain 52.198.4.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEG61Sl8CHUp8YGp_fDmZIlM&google_cver=1&google_push=AYg5qPKhQU_EYlgBVDTciYd4W7jfZwVgB3yKRSiqm9kLno46A4BtaaIsLWYaR2CcCtwbZF-GiOujJrYCuBLknLMIxWV_hf7gmCqj
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.198.4.47 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-198-4-47.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: awselb/2.0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6661
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=googleban&pm=1&google_gid=CAESEOmMbWGhs0rNncRtGOYi240&google_cver=1&google_push=AYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSk...
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Da15cd32e-288a-4d31-8fc2-10952e8d8120%26google_push%3DAYg5qPKnYX7Zt5HglOMVCBNW4YdPlcM...
https://tech.rtb.mts.ru/?dsp_uid=a15cd32e-288a-4d31-8fc2-10952e8d8120&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Da15cd32e-288a-4d31-8fc2-10952e8d8120%26g...
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=a15cd32e-288a-4d31-8fc2-10952e8d8120&google_push=AYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNS...

170 B
188 B

65ms
65ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=a15cd32e-288a-4d31-8fc2-10952e8d8120&google_push=AYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSkDqqN9pufkEYPA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: nginx/1.13.12
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=a15cd32e-288a-4d31-8fc2-10952e8d8120&google_push=AYg5qPKnYX7Zt5HglOMVCBNW4YdPlcMGevmQ_Ojj4JaHWLFTFKXPmf8cdX4pE5L0f_3vnaQsl7b8ZOSm6DYlnsNSkDqqN9pufkEYPA
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 6661 0
12 B 84ms
63ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JESii6NXObnCydiB-LB9i7GYu7G4gOCwv0KujBLd_sSIHBxYRKGPX7jywnD6xtYF1H4J2dBA

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 7489 35 KB
13 KB 30ms
10ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 469
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 09 Aug 2022 12:36:48 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/ Frame F269 24 KB
9 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aq8O1unoPxebUWsdSiBSZA-Gy1r2MuLp2jLO2d-LuvdLAm40WlFLqp7iWdKxKr9TVC3X2eVuJo1UVx1bnyXcoLuabyojMbku_HMfqfBzJxErb31wfvIhbxh8Tb2YxIdDnAmiHtvJsvf2gyY0T383JRKovruw&dbm_d=AKAmf-Ac_WYE59QnfbtUg18N-CoP3JQzqtCoWmoj_1RKHdQm_kY0hSBOvL4oOG7jkK_iWt_SSqnqYzGhFO_TJZqyhMfb9FgWMDtKDo8FmD6aizE-B7JQH7B86wH3ItcTlNo3YEUt5hIE0XzDzSQ1tiR2btKExfn7flUFBwKE-DeecEwkcbKF29kVNuG2S8ndCgda_DQdXWfO93WfIEHCI0oDU1sO_3b1ryuDCRrO1moHTq8_116m03k9HT5OY1z5pn7wT7zhG8FmPdua6R4BurFn5tiEFCHr-a-nkusCVfcofzK4-uUyI9Kf_O2ptln8hvCYM_fPljAdZeqqWJHglCHYWCFbdIpzWH3f4bmpcUtqJjcF1EjylcCoSJXEdBKLU8X-AdOpZ81P2qORq8ZtikEZJg56egs89zGzmDX2ZvpUJ9k3lADKM5pi_J0ZyvPSzKbEOcU_0QN0zlC7EACvebRrMKODQzPasZwLEZgeglvSASz63RpuOJx4jzyjvKsU-FbtRna7owRIwrphNG_CdgDV12heZ2PGBq872ZfpACf2YqLNB6cSlrhF2gf4Wmi5aaVa-bexXecHEk7FQ6E15pWhce6hZc1l4Hgpj7TvgzWcUQ2RaNcnqDZFeQMTLif37vddYGT_aakGGwTUa99TyGsny20WGW3ko572-C43uIr7tlRiUq35ht6kS61ta3N0tLB54gN3An4jftJJ6AQBdaMjXjOYc9HL6H_fauBw1QmELUVUkscBKy7gu1BOpKAnVXQDVuTC50bDkt5keeZygqNiv630Jqx4iRoOQzzhDX4aBhQvMvb9ydfhDbzG_18E7dl0cF1ZDI2_l8W-WcZgPE34WzRuPg6dnZz_a8kIP8_5ly0INWhozdmKDelnDC_QimvcaBo-7lIqlx5AUyUADi51q27KtmavQiNEcJv-aQU4c_k_miiyzhUNCDynVUY581_4OcAHgOe0YBixa_3jKTBA4D69WBuaJX5tpmRsNT6S3L0i5irJ8RpsGCRD98zat9s6Pq9tOYPwg2v8KhjB0x99QbfY5dJnJkhZCsu4981dwYQ6Ay4ymefgX8kUDJrI5iwBuNn6c3bAQ3PQ5S5yzd_qE9Yy-LoV1N4DW1M3jvfYfFi92nWm0uIZBroZAONRzcxb85VcS-1CI419SXsQsKuoNgBaOQpVvU2mmZkeXlE_EK_kxAJcw93fCn45ttLccSeAGFA0oBnWTBYG8Cu3BXfobXY_gwLnBP43uuCpiQa3AlyR3kiYRMneniKDtw7yxYHsT316z2LNb67UwDLBj7DsTV6XMD1fxvPZG_E0zqj7OFK4c-C9fC0KvjJb7dx096nJFWxhg4BnafqQKebHfNrlyeoay6_-ZXoazULX68oRqrPhOLmGtFfdzyEYmMDq6POxB51LSzxaOMGhuRXCxXQLIyBYjqKcFhDii-DCLeo_Nhh8WphHW-txygrktaiJJo34yp3y-DOEHb_tsOPjzsl3uTCLPJlMd2UaIwtdo734uFR5_Afbpx-rU78C5su04rdj0o7zh4bmKEh58lqvdm6i2AEjWgltJJ4-sQ1RK7mY5rvAyCdG__zdFc8xv2TzQjj0T6OJl5gMNvm_za4oZ5oS8j7cF6nYmB9sO8fijmGPbnzqAgftoVPSgUcznkxU4HcZq60j18yGyDxCwIvWE52PiOOkW0jsj46EorrcOBZsZUnKVE46I8hThpRmgiEAx7zlyuRwMYoA8LZfGto6jUvTx0WsU7nl3JhckwGBJsVrmifRNokx45vFfg0Fk6nG25-x3QQSuUF5amOZIZsTwFAPxsIhYdXt5ZcxMu-U6lHrNOIemJdGze2yn0JnF5Jt3mlAiGUk6C1dEMNeZxVJ4OJzUtYOz4GUsQDYYtnYoVgA7SKZdFj2tq_-dk5DZbYECCbuqpw3ki0zJkZwZtCRlqbib7fqyLUbdVlbUBsJCowh7L0aSb0Ayzzcwp6TZ9H-19zjYhe9Z_6cykY2gEbSSWtsXx4Cf8SPC3Mt0gnKhWcPeGIFnEp3Gyj-34r7ldH2ZZkUgOEdedPs6jFzQUp44rWsataIWDeFIjJip8fk9pBHNkKpSJwOOsl1MhUoanNr-1RyaoZqHc1K7ioIS4IZ2kYLGEv9WIyjsHyCHA2T3DsWDuk5fmcNf6eLls6NIK8xRvClRPe30e4uLMoglQgTm_rrkZtavineV6cmnK6M4f0zOXTdObuy_aTewC1YCcvcg3HaFfYCiVufP5yim3InVmFIyrtM7kXtQpN8fP977IDMklx_VelVezrhiGfyigoLJQ54DesS7iKMLsmdnXZ6xE7eMylt1nqyJMpSuRhDaUV1rQSUCv4UkAr9rfKett2IaXxbZ8Ff-pZqsdnkS9qDcnf1fTJrucWbvZvhIsJS5h2yvDaqDRQ6vWBh9DkruIFeHNJ5MdOoZ71q5107bS7DCSyb5LuO0ZXzcEp9Hu1FyBSGCgv04YlJkWgU72LXZ-mj7vQrj-5ekI7BcOA3zevC1tIUP3RmMEBf_-pf9E91aT1AueHdUorCMQGErMAz8qe7eLGQA0NLA_DL0AumSzm6Vd8G4Q1yE1H8QQBc9x2seg6DxI-hSBD3EPFNSImFLwLyGU6geRCXDFu-YWc1OG0W7ATCIforQaW0YWAReJnSdaUSTgebCuif4VC0PeoLRGeSI2QxnU9l6oEsYpF_XGGvDzFfJXyizoNa4jwPeo6b5EBeNOSqGCdc5mtCrPD-AydfoAZOaDYvHMBbAdKwQeLOKMuMMcHPdlSyuzC7DX7KIy2okXPkz57opTCMLiTfCdb9myEk3kKnQ8TMaVA3ORHtkjTiUp0NoYZEFEJ6QthU26ULFbuoZ521UBK7qlpyPcL9joVUe_B84v24JTaqo6-QOdjTukp_T187B4T0Ps48_zSRLujgYGgfLU74BoP2AOUmXk_t4c7lUkmg2A4ATh1DA1TtZDMdIIjSamG4vWUTR6xNzOtf4b6YCuyqS5re0xDlYrIha-aAnkJH_lpaFcM6FqLwq_afXVZIbOVq2cxaELkLRllLFDS8389UfNfFWTZJUky3_IKQIYzR4RCgEZzqAFY7oSl0AHmN1hCl0g6uOk3l3onUl86UOGA&cid=CAASEuRoNR8uX8-yIFtdYPVAkAtgGw&rfl=1%2Chttps%253A%252F%252Faskleo.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44b9a9d2c3baadad3ce45a7368c567c905db6d1473139b93b50123e3197e20c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 110
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9339
x-xss-protection: 0
server: cafe
etag: 8973662780436066029
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:42:47 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/elements/html/ Frame F269 8 KB
3 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 237
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:40:40 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame F269 0
24 B 75ms
74ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuBboZfd4CcXYv4UoePaYkqLVgSctwdmekbTTyEtPVbuTAfhyOp5ofjalMMm96vyVbsQ-LtXkpBI0X2Lo7_YpWHjl2imwn8F0-24BNTihVVeA9WZ44sUWcb3vGURBzjIQ0Okk4Q8bxkOCujA2Nv-R4Wv_Y1yK0Gyw6XP7v5EKqHLRuGbo8ZNoWHJ5HGg_v6bS2KmpSAXKox6mJnxNExjkMLW0durtSBTM7N1eclfgplWDY_FxDypQ0XHTktyriSjV3gqwwOz3cdryt2SSwRyJpFc7TpN0oH4PB9kgAwuFrob_m_ZpsUDWsPANVE4472QffAwm6_mhl4CvzNRpVZ7Jz774YdJXG4xNtnzzi3ZOZc-2qZYTuGgqyiWbeARtYG34v-IJZI1xn05KVuecR_2s0glL7hlXuELPYayyIn23ZM6BAdxnHvx6MCqr5EgDs3LuDCiK1rW8wTQUe2jdT6AG1pGaX-9LyC1Y_7cYf7sltWM44__NgRBO0wfNj64ylyNrvqYMzbEtFutVDDDN3kY2_wTW5uT3B6z8_Xcz3BUEXZFMRH9D8WG-_FUx67YhfuAUFBAN0blGzjA_Rj5You3MNvhVo5RrmaG9iIiPaVbF9n_9ngriNl0kBwb60fDFqXbZbCoURAZJcNH__0ukfLUVbGRaMRSoaAz9bnnyQPHtg8T7NLvAty9Du8BD4MGgc9vGsSExzSTl5Jf4eF71D2gU00HrhlXHUNu7VVhNOOs1f068WFJl9SraSKmnkgFYBpqtez8Yt1c8FLjEFisXB6izaTbR1YrkCvAJvD_9_CosM1nnNXfYEups9xYes7ZLhH0UXC62tPUFSEv9rseTuO2XZ2ZR4ceVWWOOBQrY4gB3yXG8TGVJyI4JQ6UqfAXZMEYK8Z52lsqEC2cA5U9z3_lDA1X_ZHoog7mrPLd7wSk9E2tf7B5dz9S0XPrTmzvFTeZi-5gOB3VOT0ut-exitccN7hbzDZqrJSQWjQyWNTSkkngLvgYRRZgrI8tznB2kp3EYFNH_XRvB0KbJvIePm7OFVlhFC0wZB9mtLTY5UfkuwOvSADjhyGDh5Dfj7cwTYWnlGzUMv_kTjIncTCcOqN2yr8jF_j3qdfxyKhINfcnctm6ZkaIXDY4VEjyoqPtpLCIY3Xm3jtYZVn-D7_1RbxWSrJJN1EPcCtL1tXsFKgYlrkbYQKULU3Uktr49SVBw65N1iLXVRgMmFaZ6T8DDoR0EJVLsT91zWdHVgeKfzgzX1sSDoVSDrb0rI0s-w13oUQojriptdI-arO&sai=AMfl-YTFebOyL6Q-8A1SnpXIafUPxrC49ySvzZNqaiuEeg9iIG07yRR4hAdPblwRSut1jkJmgz6bC1XTaqAEkJQIEEZ1oAOzULMnTIKour_prT4F-Fj8iUMOAw4vLXDrtHesSHHv4JqcGD-ZxIRITWbzIILWq_-BVe8WN7eQC0YBOLmF2glMhjTarA&sig=Cg0ArKJSzDkWYTm2EWUNEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210803.29494&adurl=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 09 Aug 2021 12:44:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F269 41 KB
15 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 11:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 11:44:38 GMT

GET
H3-29 200 LMS_DBWBID_US-EN_Awareness_300x250_Counter.jpg
s0.2mdn.net/9295318/ Frame F269 46 KB
46 KB 22ms
7ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9295318/LMS_DBWBID_US-EN_Awareness_300x250_Counter.jpg

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb60f9e875ef0083fcb612e02ea98bd1a4ee5063f923237f6786efe17695c8f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 04:48:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 02 Apr 2021 02:43:19 GMT
server: sffe
age: 28588
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47268
x-xss-protection: 0
expires: Tue, 10 Aug 2021 04:48:09 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EDFD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1

43 B
893 B

70ms
69ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXnIiQbeye4fHnPMW4wPmdTkWem7aTseplhpMJ4NnEAgYZp6cC5bfgmSTEVfjIBMPw4oBjLN0SxWHBMyL9DBgxU1LyOhSEKJfjQyPltWo58ZL1mVsqdqHQSneThIVl7MtMAFd318i7Iptc0qe5RorT5NkQ39KhDzexIliJlTB3ZHHvKyjwNymyd867HsbBuu8c97CJMVgxHRLvuG4_J8eHMtF-f3A
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 09 Aug 2021 12:44:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EDFD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YREjNJ2jDfJTkAkNeh-oiwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1

43 B
893 B

70ms
70ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXnIiQbeye4fHnPMW4wPmdTkWem7aTseplhpMJ4NnEAgYZp6cC5bfgmSTEVfjIBMPw4oBjLN0SxWHBMyL9DBgxU1LyOhSEKJfjQyPltWo58ZL1mVsqdqHQSneThIVl7MtMAFd318i7Iptc0qe5RorT5NkQ39KhDzexIliJlTB3ZHHvKyjwNymyd867HsbBuu8c97CJMVgxHRLvuG4_J8eHMtF-f3A
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 09 Aug 2021 12:44:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHyixkMW3aeKzSqZOUlhO_8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame EDFD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEF9EkP8eds1ko6MnRv8612M&google_cver=1

43 B
1006 B

80ms
79ms

Image
image/gif

185.33.220.241
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEF9EkP8eds1ko6MnRv8612M&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNXnIiQbeye4fHnPMW4wPmdTkWem7aTseplhpMJ4NnEAgYZp6cC5bfgmSTEVfjIBMPw4oBjLN0SxWHBMyL9DBgxU1LyOhSEKJfjQyPltWo58ZL1mVsqdqHQSneThIVl7MtMAFd318i7Iptc0qe5RorT5NkQ39KhDzexIliJlTB3ZHHvKyjwNymyd867HsbBuu8c97CJMVgxHRLvuG4_J8eHMtF-f3A

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.241 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

732.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
X-Proxy-Origin: 37.120.209.188; 37.120.209.188; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9bfe4883-d9b5-4bb4-9849-c63b8ea4487c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEF9EkP8eds1ko6MnRv8612M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame EDFD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D

170 B
188 B

64ms
63ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
X-Proxy-Origin: 37.120.209.188; 37.120.209.188; 732.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2105d305-0f26-482b-9b33-3d450561ab85
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ2NjY4MTg3MTE4MzcxNjg1Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame F269 0
23 B 64ms
64ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 LMS_DBWBID_US-EN_Awareness_300x250_Counter.jpg
s0.2mdn.net/9295318/ Frame 280D 46 KB
46 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9295318/LMS_DBWBID_US-EN_Awareness_300x250_Counter.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AwaTO9EjdSP_h7tQvOnsoHpgoIHAnFAcaDGhWA9JIhhuvXcudW1DQ-aEwJ6ATxXLkhfdG3tzIvRQMGSXko5oYyekUqUJmjJQSrBhNREQAaLclxo5aZ8rGchmxyPJqFw339kNJK0mhdI8sqalU2Sw15Lln4QA&dbm_d=AKAmf-AshWc17wxn-6C645Je2G0-S7hj-t48BHrXxidzzC2dHeDlDMGtlBJFMlslFr_Mj5Xlbl6h1cOMSTbezxDsIFLyuQyBugQJh3msiitEph3q_06C2hsT2OYLtOUNfequf3kAQE3V4t06WDYpof1euCl9QmWnSa0spO8amtpW504P2CHnE1eRj6YL9cMZa7tHCzTrF4UtzIVKSnjWr8NicKbWnsMWP3_5QDZCmYcLfUavUhfreWVa1bOlOn7oIqQNrM7UWWwp4fLFZ9uJ6mRCXROzjXNGd5UchmImmIodHYlN8kdpJsKgjuKevGGFmvcPpBvWe4TsKpkQQ018ncHs0JYTSNHMkLIbjSP_MvYM_5x9XQXZTI5AF3SQAIwkNEvKZcg6RBJjDrQdgJfQNy9e6-VC93-qYSKCOVm3_Uqo7YpNHOYoOg-rOS2BMh_vP15BD_9__Q0GQv_Tt_42m3EIBGZ9vTlJTGRBFV8MfAQhHcKqwakieVHHR4zDP7_h6pT10hpEx2diY-D4WI1Qroqa8MmTW7OYgLWuhaSoWC_qRTG87RYpA14lO0w8-fHa8OPNJC_0qYc-T1GeNJuy68OnhNQCPI4Vjuzw2Y4sDlmgOBy7VO3b8xuUNjZu0ceOBBtCfJ2iVpuJUiYTWXNQetcBP74O64674EqZwq-k31OLOEAB8_52f4DuORFj3ANPWl9QonxMb4MRzB1c-w_5Q_uxAyKh_5XkXbowLA1y7fBDKPMrjCyzLiYRuLSWp4GAPOHmcl0Z8KZkFnmkS3hLYRlquCOmf1-0_YF41XoyMUeKiWad8sipgJElvpnq8lTIyPlWBjMoaBQIOGDBulZdvuvx4h3pgWz-Op6PfgNcF4-beC3e4MteBg0VyqlmOfFy-3if8dZiXJufM3KqT1bK4vo4Cs704Y4AAbNCB_tODgEI6jBqLCjOAtzHiJVhd3tNhBhenKUlRLsKakqXkN8YviQ_1Oaw7S9dB-41NG6LfswbLP7-QbPgG7u2-B9lLJnVFFDHyeLT3nrBc-YMMHsgPEAOA6SxFVb3q7HChxltsG_RN3KBup_zEKe_Wz7Kv1F5W1vsrUl-b0FXGiyKhCppFuE73_EyoErt6XIC4wXIqV1z3bV4epYwSSNtpcKPdYheQ04uKRqqKA15Y9o5GdBJvUQYHp1vCGMpwFGMCRWlow90ev92spKKaBpaLJK4BsT-BACjT55wPP81UES31fCNDfls3QV5WRE7Y-ukaUoP-I7jBuZ7RHMzQ9O9NN0qh1TMsttCdr6ppODeP9nBSa0enL3bRghtIh0cDTBkW8F3RyS2zvRGrLt3JPjCK-KIHHp0UwhF5HXJMtbxZByA34h5zYwYZdfDOn9p8wh3UZJ6emydj4ZF8kjMS8apTIgWcNPJJ50n9caYlc4ZVUENS8GiIw2OOtyTuEgGh4_d2AhNzWXTTx9XgqMGybyvB-_1VwCC5LFanxXjl8BVy8ls8bxjM_EohdLpm26RHsKi4iyyfXiNo3heeY--XPq--wvYVO8aXctYfrRzXb50276tlS5uXigbqWLoH62BK0SZWXIzzYgFjXnWFxj7e0o1IjveVaSnK9WtPps8Kw3g3AaVFkokGhV1fZ1H8K-ZNncgAiW03tYuz7ijd8Mxl17wEYPhTm4vKLxvsROBBzj9oNzFJLAeIKV-dWg9QhLTj1VsdpyhJJccnhZyK5DLyTYcLmCchsnuMmADito_dKgMGTnOYLnjNnfY1VZrLnN83GvlEEPDeMaD8JuUExUA8r6srrRZb7hFk2CiMC8tS4ygwNOj7Xukmlk5lA1SLxu65K_uU6dHNl-rcFnmSSW-MgnEvkT-EvNsKxIwctDrxMgXWQwz6ACkb41IBat2_9_1-KCIUo1uXXQF6KuNbRtprtAwx_NrPVaSqNDx-9Lebb8qTYUikmD29pYLAna09Xsphn1EbcAsdCs-bDlnMLztJDlWcvqoTRZ-ueKNNTOekXfBxLzsWF_w6o8VyGXBpfMSiKB2jp9TZPBLBmgI6xSvL0Vg1MNBLN8ktX99gADuX-CHEqtKLXPDEpCTdXk9Vf7AfW3R4v2j9dS5QOTq54md0yJUcIFc2K7aS8w7McYfETjCIyN5KahajtSmUHdyE34D8OtyxSYDQd-M5QfsknQ9aAOE01zvp_9k_Y2X__4lXINpXyeOIBlXahKtS62r6KIt6wnMUvCm-mRQMOtJEx9eZiPZ8biKh2etWMnC45bMkWutTajEz7y_n1TOVIa1UGlETK3iQmjoaYUOSyR2uZDNq1PXL89RqWWXNCoaMM4LySXXilCNHwlf-e3HbOYpM8gMXcmxQNb0ade2Di8oOunPWucGgX2BqH7SyQM3CR86lvhPzEMydlbhtw4dG-MVdkeymImmyfxEDY3Nsmd_1YEJ9VzaYq4tYGn5yXEsX5wH5Sk5V5URPrcdBiwEVAsk5PxfgGrtTFiOOOTWLfW0_i9AztmDUWz9mytV3FjA2vZCtJl33q9tkStJgc5I_Q5L67H8T6FtYmUqBy_NyXY83yp16_RLgBOt5p_vXqiifpccgp4NR1UiAM8PUDbDcCFfR9vyysyme3uQGpu8obuiBpknTC_s4hsuJaUd176BNm3sGang4HdeXfBzd_GsKgLa50H5HBoelhj1px5cl_mce7RUNTqp40cbMvxDYDi5jeFXKkg45AkMq945W73eIq-lJbtO7NhQv6CbYcBrSpHoZpjma4EZ_CG7S2d4LW0a_tBp861P66fIBDryPnPpjDLHFz9_1mQhxVSSm3R1nIdM-XFEHXg2Q0_XWrwLiimwbiUfVGyOtTvFaziJEwLKVi5bWy5PwR4esXPL5g-1unhhXNirtt_3LznC4PQXP2VvF7e_oFBzIfSofZ-haOLDN00QUeHi4v-veczrpGcvXIDcL6i5msy9UVAIxr_qZrgLQgbPa-vGWlNR66YiApUx1VUX53he-D5Vkuf3TpZVJivLkjVzVGTGJvrscoNbkylHTOhX5KMdmZm4vCF0CYZdGoCjgUlvMAx7g0mOjO8XkXnW3quj3U6kiFLt7Lm3XOTYjY0vTIdJkcCKDLwT8bg4X2xKwLcSWg&cid=CAASEuRobMd28Z32ssjNnswp6Pyzng&rfl=1%2Chttps%253A%252F%252Faskleo.com%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb60f9e875ef0083fcb612e02ea98bd1a4ee5063f923237f6786efe17695c8f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 04:48:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 02 Apr 2021 02:43:19 GMT
server: sffe
age: 28588
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47268
x-xss-protection: 0
expires: Tue, 10 Aug 2021 04:48:09 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/ Frame 280D 24 KB
9 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44b9a9d2c3baadad3ce45a7368c567c905db6d1473139b93b50123e3197e20c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:42:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 110
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9339
x-xss-protection: 0
server: cafe
etag: 8973662780436066029
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:42:47 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/elements/html/ Frame 280D 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210803/r20110914/elements/html/omrhp.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:40:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 237
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 Aug 2021 12:40:40 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 280D 0
24 B 73ms
73ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssISnyVI4pjCata1v4jjmuWCdmNzwPl63jRqA47UbE5NUUw_LGJwQKamvQ0x3DB8idnivszkNROgKpj8rG49lnvWGQs1GZfPRaQJ2i2yqaUhB8N_dFN0LxQGG1cbcjvYqWYJHDqH-dmj7b0syZ0lQylSD3-gFd-wgQeG2Ah1RYR7NXimJ1KCXGbjSE0HcJyU9HZx89bz8ZVa4M1CEu8bqzom6mkome9tUKD-Qq_MXEwgJz7SdETnAHVeucF3IHWbC2l2yiyWOel6YRIjMpLURI-c4Z3xLSA0guPYPVZ_TzHk_n4Kqj9h5KECjxDvYR0qIcF8W6SdTjvETTFjQlMm_y5xLCQN-sesXRN5Ow-9JOF_XdyVbZ9z8FBfTEBLZ-Yl4rk656jGpAhhC-t03ja9wqz7GQQVg_AeV9GOWYuEDWlbdKlZKdD0m4Xq9azR-tZPrY0AKsBNowvLh0m_BrwsafcHCljLDCr6dkXbG9mBIVCuarWSsrtAp4PYgpdzctmfi9OsHyi5w43hPfLIMrtthNVKwuAdueh5MvrdYKTUxuyWfOslOUoAVfpKoAUhntvkrnW5PUN1nKD4bUWu1_GIED1PuzC8h9w9HyeaLaFLPPfEI5Mc9qdt8ubh9e6hx7BjQ28DF9380hZx7awZdWIvDMyiSQ1jYjvEAMFB5ZhCW-BSXQLIr9uKKF7eqKeUHTJpbTjnkfg_dIGMncUsTEE7P8hyGtZNqzSDP5Zmv2LYnrvQ-0PbpUASxUcNfKU3bg4wG5c_QThmfeIwfjWtISBoEyzTJWc8f6f5YNK-ncAmXhC3GEes9_CoVO5eA8iYV9ek2lzztWCibGNyCPpfm_sv8b_v4g_TcKPbE1SKYiqbNXbnf4m4T_qDcogwCbL63uWo6gM7YnARyP8JIVypbjEhI6IgAB8saCjo9VcAwE-PVuZQUtbCh-vN9d3lYiun9--fsrpBoveHuiRA1EuciwknqOVo8cYFYnr34iSNo_wuiTw_KHGGh5iP-WyEaDuK643cahfqBXxk2qdr0AhNUxyRZAVfypqzoP563HziDM6je_qt68AxFOkM6vaksrNAlh1NucAL0a-hqmL8r4QP6jX7BI2VmSbci9PwYxw0YarjjwLCEGeCf1cRVTE_kDLjEy7ita5geOWrnPeUBHrkL-O1Wlm7jUFYAsGV4YLSxQnFqVAJBP1BiBjEAaUbiTIytCXqmh-_BWJwlVDQ0OnD0X3ETRud8r3MFLkW4RWMSnCYkqMabqmR1HP0h1ULsWD3rPiMw&sai=AMfl-YTmPtB9CK7SWldLuTi8tYHWbDNvW_sArzWBy18Z79IaasUrQkBvgdP8WXOj10a2mvv74PYc4_chFGf_Uckgpxge2tcq6WQ-URviyHAxUOk436Evn3Z5y4zuqm3oz01rtguamw9b1JWnD5urOCeLkJuIBf0Z6h4WwFRZeldFnkDg5rqVGhtd-A&sig=Cg0ArKJSzJABJmCtUO0TEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210803.60674&adurl=

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 09 Aug 2021 12:44:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 280D 41 KB
15 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 11:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Aug 2022 11:44:38 GMT

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/published/592558/760486/ Frame 3FCB 16 KB
16 KB 22ms
6ms Image
image/jpeg 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/published/592558/760486/preload.jpg
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4559f60701a5aa950f63abc90ccac3d816472952ba46f119d7a7f9a74fd0e504

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 09 Aug 2021 12:44:37 GMT
cf-cache-status: HIT
age: 197514
content-length: 15989
x-ms-lease-status: unlocked
last-modified: Wed, 07 Apr 2021 09:11:57 GMT
server: cloudflare
etag: 0x8D8F9A53231AF66
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 751b4512-701e-001a-7c50-8b8cf9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 67c113ac2f3e4a8b-FRA
cf-bgj: h2pri

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 6B87
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKgGM07CMNAhMig0djbjJdw&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKgGM07CMNAhMig0djbjJdw&google_cver=1

43 B
172 B

54ms
54ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKgGM07CMNAhMig0djbjJdw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.213.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
via: 1.1 google
server: OXGW/16.213.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKgGM07CMNAhMig0djbjJdw&google_cver=1
date: Mon, 09 Aug 2021 12:44:37 GMT
via: 1.1 google
server: OXGW/16.213.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 6B87
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTQ0YTU1YTItOGIyZS0yYzc5LWNlM2ItMjJlYzQ1MDQwNTRl

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTQ0YTU1YTItOGIyZS0yYzc5LWNlM2ItMjJlYzQ1MDQwNTRl

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 09 Aug 2021 12:44:37 GMT
content-encoding: gzip
server: OXGW/16.213.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTQ0YTU1YTItOGIyZS0yYzc5LWNlM2ItMjJlYzQ1MDQwNTRl
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H2

200

um
sync.teads.tv/ Frame 6B87
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESENBHqIlAzB2mdSYWTc51qNc&google_cver=1

23 B
172 B

117ms
83ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESENBHqIlAzB2mdSYWTc51qNc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 09 Aug 2021 12:44:37 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESENBHqIlAzB2mdSYWTc51qNc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 6B87 23 B
172 B 240ms
82ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNa7wgEQkt-DAhiI4q1wMAE&v=APEucNWpxK8iJL_9ls96xlHw9RSMo6jiCuAGxNSxl961m8tOECqQh64bXiV8Tqci1Zg36kDKWedIL9fQVDzFxXWAMi5Nbge8wMojAuVWYrs2rFbqC3t_Kh7t6hG8DrnaSrqYYqZVkwLd0xYqKslQMjJ_W6TEpSsxnlEFhh_FAToo_t_Sa7eyoxiIBTfaMGOOYnvDhBTNcQhc5iFaNXU4K5lEXX-ZUX1gDg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 09 Aug 2021 12:44:37 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5300 1 KB
749 B 11ms
10ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 09 Aug 2021 11:56:19 GMT
expires: Tue, 10 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 2898
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3FCB 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8f9d1d205540e75fd9257075f1e7755cc5e515938c6ec9f8d02790ba8ff272f0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D014 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 09 Aug 2021 11:44:39 GMT
expires: Tue, 09 Aug 2022 11:44:39 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3598
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E710 1 KB
749 B 13ms
11ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 09 Aug 2021 11:56:19 GMT
expires: Tue, 10 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 2898
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F269 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 12e565307080aa9048142e9492be4941bd4230b24de22a321a208c041e226a1c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame 280D 0
23 B 63ms
63ms Ping
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
70 B 52ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIyNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjM5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIzOSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMzkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNDgifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIyNSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjM5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIzOSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMzkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNDgifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:38 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 51ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjU2NiJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMjg1In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI0OTMifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY0NCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDkzIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI5NjcifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjQ5MyJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMTA0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjU2NiJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMjg1In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI0OTMifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjY0NCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDkzIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI5NjcifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjQ5MyJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjgwMDE2NTIxMjA2NjQ4NzgiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTg4LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMTA0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

POST
H2 200 pixel
c.bannerflow.net/tr/v2/ Frame 3FCB 0
74 B 32ms
32ms Ping
text/plain 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/606d76fdb3521e8b1b19f21f?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC5TeJNCMRYeuXEJfZ3wPThYLQCP-A1_Zh3-2UvLkN2tkeEAEg9PnGJWDxrfyFpB-gAZW1lNwDyAEJqQJ_hdOmhrqzPuACAKgDAaoEnQJP0ItWEVfU4G_Mc2ooy_E6ZhXYCKPXobhLnVk3cG2Ngs3rh-rfcvEiMRVEyVrpv9upGofEWVK9ch-k-PQI2cFpy773KK1IYeT_XR0T6tPUkpvNra7eXH6nIIboBX97h4wf0ypVF2-umSCbGDMzY2_-B9uVGfgEsbhNilOSYOIB0VqAUc0-Ktn41xWeQ-j8dliNEDg-QJ2zuayS6uyPZyTM_XZjOMP7vgHklGgn_zkthdSoc-MiNWJPXkW9T--7NrviDRocQgNDHcuk681Z2v6QcP6J_yWtyC4Kn9i5gQWciTo99NxMex-2zRGK9gE8nW0SePDFuYAhKWxFdtWeYAiVZ8gR4kiUyN2SMqT2uQ5LtAPYpEhLeOTK51dato7ABL7InY7qAeAEAaAGEYAH08rrI6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG6gH89EbqAfs1RuoB5bYG6gHqpuxAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNTk1Mjc1OTAyMTQ2NjQ4MoAKA5gLAcgLAYAMAbgMAdgTDdAVAZgWAYAXAQ%26num%3D1%26sig%3DAOD64_3fCBiH40R_q_nUQph9hn_iyE91Ow%26client%3Dca-pub-6396844742497208%26adurl%3D&cb=1182224599
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 67c113ad69e64a8b-FRA
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4EF2 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 09 Aug 2021 11:44:39 GMT
expires: Tue, 09 Aug 2022 11:44:39 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3598
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3276 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 09 Aug 2021 11:56:19 GMT
expires: Tue, 10 Aug 2021 11:56:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 2898
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 280D 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e5f82b6a21c153c7a53016816d0bf95b246fc6e32ef8d31af0c15a78a96f6f7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5300
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEFGDZFTTLt4aITxdYbw7riM&google_cver=1&google_push=AYg5qPIhu19Qd5EUJvwoQWEaUwUS_OM_KaSB5FVa7WSG-cN1eT2gEMPGwd4VqsLTes8Gh301gAGvM4F4466...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIhu19Qd5EUJvwoQWEaUwUS_OM_KaSB5FVa7WSG-cN1eT2gEMPGwd4VqsLTes8Gh301gAGvM4F4466Law3KpsBVIYjz9tCf&google_hm=x8Q6gqpSRoSEm1yPG70Bvbw

170 B
188 B

67ms
67ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIhu19Qd5EUJvwoQWEaUwUS_OM_KaSB5FVa7WSG-cN1eT2gEMPGwd4VqsLTes8Gh301gAGvM4F4466Law3KpsBVIYjz9tCf&google_hm=x8Q6gqpSRoSEm1yPG70Bvbw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:36 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPIhu19Qd5EUJvwoQWEaUwUS_OM_KaSB5FVa7WSG-cN1eT2gEMPGwd4VqsLTes8Gh301gAGvM4F4466Law3KpsBVIYjz9tCf&google_hm=x8Q6gqpSRoSEm1yPG70Bvbw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5300
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESENcPARH-AW61vlFTnDZje-8&google_cver=1&google_push=AYg5qPLwYJjUlD7aUBDJbkxt2e9H_TJrQ7c0KPKUQ_5YUEpHjmxipuZNZy_e1Io30td1KUzdIjo...
https://sync.tidaltv.com/genericusersync.ashx?dpid=glrdr&google_gid=CAESENcPARH-AW61vlFTnDZje-8&google_cver=1&google_push=AYg5qPLwYJjUlD7aUBDJbkxt2e9H_TJrQ7c0KPKUQ_5YUEpHjmxipuZNZy_e1Io30td1KUzdIjo...
https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=eF0Y8qrxTBGVsbdH20NyNA&gdpr=1&gdpr_consent=

170 B
188 B

64ms
63ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=eF0Y8qrxTBGVsbdH20NyNA&gdpr=1&gdpr_consent=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: Apache-Coyote/1.1
location: https://cm.g.doubleclick.net/pixel?google_nid=lucid1&google_push&google_hm=eF0Y8qrxTBGVsbdH20NyNA&gdpr=1&gdpr_consent=
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H3-29 200 dot.gif
s0.2mdn.net/ Frame 5300 43 B
63 B 15ms
14ms Image
image/gif 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEJnDzmTqUFPmnm0gt5iLeWw&google_cver=1&google_push=AYg5qPLY8hVz-SQr2Or7A_Dv1l1yEMaeC3gUCQKfMIx_MVKIqSh02Ova15oOpXnFAhkgrV98SRcBDm0106sCYrX934MG_kKX8P_p

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Tue, 10 Aug 2021 12:44:37 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5300
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEN8Dmd7TyUzE2gad-_s8V08&google_cver=1&google_push=AYg5qPLcmf5EFCe682M3xF3pxMiswimXSiTSimkkAskyEI-b5cyOlbhKdrLpFYPN9Oj-95BHO5FmuQ...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLcmf5EFCe682M3xF3pxMiswimXSiTSimkkAskyEI-b5cyOlbhKdrLpFYPN9Oj-95BHO5FmuQpJsxk_0bNNzfUXOplsm1Dr&google_hm=MTE5MDQ0OD...

170 B
188 B

65ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLcmf5EFCe682M3xF3pxMiswimXSiTSimkkAskyEI-b5cyOlbhKdrLpFYPN9Oj-95BHO5FmuQpJsxk_0bNNzfUXOplsm1Dr&google_hm=MTE5MDQ0ODMxNzcxNTM5NzY3Mg%3D%3D

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AYg5qPLcmf5EFCe682M3xF3pxMiswimXSiTSimkkAskyEI-b5cyOlbhKdrLpFYPN9Oj-95BHO5FmuQpJsxk_0bNNzfUXOplsm1Dr&google_hm=MTE5MDQ0ODMxNzcxNTM5NzY3Mg%3D%3D
date: Mon, 09 Aug 2021 12:44:37 GMT
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5300
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEG3izMgWshuo1588DNAgouQ&google_cver=1&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTB...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEG3izMgWshuo1588DNAgouQ&google_cver=1&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTB...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEG3izMgWshuo1588DNAgouQ&google_cver=1&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQR...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1...

170 B
188 B

65ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1Am8SsiYT54da1jAJ1SNdA6jSo_zKuavHTzQw

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKgtvSq2jlmasqdGKCcVcKGeqm6hjkrIkSSDcZxYQUQ7eXVQRTBeYd9W_-RZ1Am8SsiYT54da1jAJ1SNdA6jSo_zKuavHTzQw
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK sync
rtb2-useast.e-volution.ai/ Frame 5300 42 B
233 B 866ms
123ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb2-useast.e-volution.ai/sync?exchange=193&google_gid=CAESEEMJWaeVC0CaSceF6Y9q5KI&google_cver=1&google_push=AYg5qPINuxrEhAWBuMVyjVAsLtL7Z8FDxi99jJEHlJNXsdK0Z3rcOxgjbxSIwdaPtpRTM-h4foWCvg_W4-N4Ti4tc7zmVZ9AWIZnVw
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:38 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5300
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJdEzlw7gNyNbCsnkFpBApE&google_cver=1&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1D...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJdEzlw7gNyNbCsnkFpBApE&google_cver=1&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1D...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uLjdVRm5ORTJ1RTFDNDdVaHp4M0cwUGQzVWlRdGo0N35B&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbe...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uLjdVRm5ORTJ1RTFDNDdVaHp4M0cwUGQzVWlRdGo0N35B&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1Dk8Ogk00bY0qs2U4CL7U--1Jrbd7Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0uLjdVRm5ORTJ1RTFDNDdVaHp4M0cwUGQzVWlRdGo0N35B&google_push=AYg5qPIAPqgU4aHD7mHOZDXCm-jfyj-MMTRWrrMUQB9bR0uyq0ieIPNbeTvuGCN4NXYg98rw1Dk8Ogk00bY0qs2U4CL7U--1Jrbd7Q
Connection: keep-alive
Content-Length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 5300 0
12 B 63ms
62ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KIPX1_QebSmgUK0LumvBXJ1xkpaHkNStl4PEbxZcOhIGsidl2G7eKjkcfN0JJKNa8ySUnjv5Nk

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame E710
Redirect Chain

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEDHxYMdgFjhBCzvGg6yEbjo&google_cver=1&google_push=AYg5qPL_JSs0keOwo5qyTFKVjqZWjp8o1HoDH8joNdkAGoK10KRtLscE4YxJc__d8JbCl...
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL_JSs0keOwo5qyTFKVjqZWjp8o1HoDH8joNdkAGoK10KRtLscE4YxJc__d8JbClpZxKdhkqq8aOj-GB7G6A3CcfMmd20M&google_hm=QXhqemtjekFnbzZGbHB4UGlBY...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL_JSs0keOwo5qyTFKVjqZWjp8o1HoDH8joNdkAGoK10KRtLscE4YxJc__d8JbClpZxKdhkqq8aOj-GB7G6A3CcfMmd20M&google_hm=QXhqemtjekFnbzZGbHB4UGlBYkl0Ymc=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPL_JSs0keOwo5qyTFKVjqZWjp8o1HoDH8joNdkAGoK10KRtLscE4YxJc__d8JbClpZxKdhkqq8aOj-GB7G6A3CcfMmd20M&google_hm=QXhqemtjekFnbzZGbHB4UGlBYkl0Ymc=
Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame E710
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGW1DvMRey_4LpFaPO6xmbw&google_cver=1&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP1E...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEGW1DvMRey_4LpFaPO6xmbw&google_cver=1&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjd...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjkxNjcyNjI3NDg2MzYwODUxMQ&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP...

170 B
188 B

68ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjkxNjcyNjI3NDg2MzYwODUxMQ&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP1EZAaxNVuH367FZx_zWG9v

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjkxNjcyNjI3NDg2MzYwODUxMQ&google_push=AYg5qPLQAsX6vR-ZaLqQ-Ex-l_WZg31Ey5PZTTVsj4O6RGa4BFvv8go93maD06Repzt5USSKIjdeiP1EZAaxNVuH367FZx_zWG9v
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame E710
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENvgo0HrxLmpxVGxm4Ciwrk&google_cver=1&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5e...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESENvgo0HrxLmpxVGxm4Ciwrk&google_cver=1&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5e...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5ejywyZAE7PST&google_hm=4cb1d35a7f5f360c72963d83

170 B
188 B

64ms
63ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5ejywyZAE7PST&google_hm=4cb1d35a7f5f360c72963d83

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AYg5qPJXsV4vWR6i15RpUpk2S4xnf2wX2AcUaIj0nQHjJm6f1wWy-IcpHlWZnD_hj6K1IPZgq0yuMKEcX8_yrXe5ejywyZAE7PST&google_hm=4cb1d35a7f5f360c72963d83
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame E710
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEDupsQ4ypaaqX6UOP6LokrM&google_cver=1&google_push=AYg5qPJGz1OZ2iW8o2Ba5diVw8n0V41pxPwKc1ORQ3R7h_jUcZOl6WmducEn_AUzR3SeIVd8y7FDs2rM_nRXKqGj3WtgGoWsVoMB
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&mn_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJGz1OZ2iW8o2Ba5diVw8n0V41...

170 B
188 B

66ms
65ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&mn_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJGz1OZ2iW8o2Ba5diVw8n0V41pxPwKc1ORQ3R7h_jUcZOl6WmducEn_AUzR3SeIVd8y7FDs2rM_nRXKqGj3WtgGoWsVoMB&gdpr=&gdpr_consent=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&mn_hm=MjcxNTE0Njc3NzUwMDQ2MjAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJGz1OZ2iW8o2Ba5diVw8n0V41pxPwKc1ORQ3R7h_jUcZOl6WmducEn_AUzR3SeIVd8y7FDs2rM_nRXKqGj3WtgGoWsVoMB&gdpr=&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html
Content-Length: 154
X-MNET-HL2: E
Expires: Mon, 09 Aug 2021 12:44:37 GMT

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame E710 0
43 B 461ms
283ms Image
text/plain 52.198.4.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESENM4lEpgZONPZQTohToViu4&google_cver=1&google_push=AYg5qPJPqFAF3FUnlWmPT5AksU4TQ5MnQ_v_NP2wDuqMXwGyhnTNBpcpxXM3SB06bkDc7AnR6jIKNxIpgCT4jSKKOUOjtdv047XP
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.198.4.47 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-198-4-47.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: awselb/2.0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame E710
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPQU8fsTq5pMBZIv8FVE_PU&google_cver=1&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeT...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPQU8fsTq5pMBZIv8FVE_PU&google_cver=1&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeT...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPQU8fsTq5pMBZIv8FVE_PU&google_cver=1&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQ...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lA...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lAQXOvX6hBIXDmJ2LKasQ86Wd_No03rBmjP6vA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 09 Aug 2021 12:44:37 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA4ZTg0NDI1OC1mOTBmLTExZWItYTZhNS0wMjkwMmE0ODJkOGM%3D&google_push=AYg5qPKMQhDgyKZBGvAHxDnzenrSxtxARvgPk7DfyGa6KNhrrt2HpQeTAZU7LIQ4lAQXOvX6hBIXDmJ2LKasQ86Wd_No03rBmjP6vA
Connection: keep-alive
Content-Length: 0

GET

pixel
cm.g.doubleclick.net/ Frame E710
Redirect Chain

https://ads.avads.net/sync/ggl?google_gid=CAESEKiqR1Gn6tHhuW2QQNEJE4A&google_cver=1&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w
https://ads.avads.net/sync/ggl?google_gid=CAESEKiqR1Gn6tHhuW2QQNEJE4A&google_cver=1&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22...
https://ads.avads.net/sync/ggl?google_gid=CAESEKiqR1Gn6tHhuW2QQNEJE4A&google_cver=1&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOclt...

0
0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame E710 0
12 B 63ms
62ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LYygBQJRvpi-n1CACuancuxjVZAzVblnKdmAPDbwb-A1_FEmYg8WveoxQnOzP5GEJ5cc0ZUQQ

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame D014 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 469
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 09 Aug 2022 12:36:48 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 3276
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEIA0Rl_VFUbEKFxYe_UpyDc&google_cver=1&google_push=AYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk&r...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIA0Rl_VFUbEKFxYe_UpyDc&google_cver=1&google_push=AYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk...

43 B
419 B

172ms
161ms

Image
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIA0Rl_VFUbEKFxYe_UpyDc&google_cver=1&google_push=AYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 67c113afae4d0746-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 271
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 67c113ae8b9f0746-FRA
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIA0Rl_VFUbEKFxYe_UpyDc&google_cver=1&google_push=AYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPIzfRjNjAjwW8FaIZdUMzHHll79ZjNJ4HYz4kU5M1GnYfAJcknrlLLSLY5Jwo4_ZdrBnTllAASPsQbLEWZJ6SeL05d3kIk%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3276
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGS3Yhvx9r0mqwejBgXeuTU&google_push=AYg5qPL2Z2N6HbRMkHJtz0lnnxsBiO_40xlubPENM1NdH4EdYoGMEg1_dx...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGS3Yhvx9r0mqwejBgXeuTU&google_push=AYg5qPL2Z2N6HbRMkHJtz0lnnxsBiO_40xlubPENM1NdH4EdYoGMEg1_dxrtjw6u0nTYrawwNJUKLZxS_eXZZaquYR1-3LuiyFYB

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1628513078.215490,VS0,VE88
x-served-by: cache-fra19162-FRA
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGS3Yhvx9r0mqwejBgXeuTU&google_push=AYg5qPL2Z2N6HbRMkHJtz0lnnxsBiO_40xlubPENM1NdH4EdYoGMEg1_dxrtjw6u0nTYrawwNJUKLZxS_eXZZaquYR1-3LuiyFYB
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3276
Redirect Chain

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEBDic7k8daY0J_q4AAEnRxk&google_cver=1&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j...
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEBDic7k8daY0J_q4AAEnRxk&google_cver=1&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j...
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=KUh8XJW5seUIlWSdTfcv6A&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j2z3JAGXQ_pVe_JK0Ge0O...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=KUh8XJW5seUIlWSdTfcv6A&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j2z3JAGXQ_pVe_JK0Ge0Od5zw0MzCPFq40Nncz8

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 09 Aug 2021 12:44:38 GMT
Server: nginx
Vary: Accept
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=KUh8XJW5seUIlWSdTfcv6A&google_push=AYg5qPJNA8hqjNIWCsdUXSdRJZ0cFzFpJXAIM2o7JRmy8i93_-e2EsNdxTv9j2z3JAGXQ_pVe_JK0Ge0Od5zw0MzCPFq40Nncz8
Connection: close
Content-Type: text/plain; charset=utf-8
Content-Length: 237

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3276
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEC-FI_hVZAIFapnXak-qn5c&google_cver=1&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEC-FI_hVZAIFapnXak-qn5c&google_cver=1&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaK...
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=5391d056-113f-40af-b8d7-3382391a01bd&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ5OCOlnAN&google_hm=OO3rHX9iS1W6MiXVKLZ_Fg==

170 B
188 B

66ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ5OCOlnAN&google_hm=OO3rHX9iS1W6MiXVKLZ_Fg==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPITXC5M5N1vqhp_VI1djhV-V8vE5oaM7zh6Wn6DZ7D6JoeGFy9f4JFy59di5KPH2D67YEYnGYE47MasaKVzcQNZ5OCOlnAN&google_hm=OO3rHX9iS1W6MiXVKLZ_Fg==
date: Mon, 09 Aug 2021 12:44:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3276
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEP-MDyoX0i3NDUuyFv1OTPw&google_cver=1&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeA...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEP-MDyoX0i3NDUuyFv1OTPw&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeA...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeAdGWxxVnUsOuHmuG&google_hm=V2QybU1GNUNydWpWRzJW...

170 B
188 B

66ms
63ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeAdGWxxVnUsOuHmuG&google_hm=V2QybU1GNUNydWpWRzJWZ2lKczQ=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 09 Aug 2021 12:44:39 GMT
P3p: CP="We do not support P3P header."
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLCPRj_0F1909ZuSjbRNZmzA6ecWm_1PHQUyp5HCg9uDoNMb0nru_U_GKPnu65J6HsbjHfLnIdXI1zeAdGWxxVnUsOuHmuG&google_hm=V2QybU1GNUNydWpWRzJWZ2lKczQ=
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3276
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESECmmoMgZ4Nfq4asBpMjz82E&google_cver=1&google_push=AYg5qPKNQf3du4s1lP69f1tHDGDi4TKndZ5twp0A7yWeeiWxcdFEpZpH2gpXYMP3smBJ0Rd2wnHWSaqmHX_YsIv...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=A3q4D32mSKFqIgxZlHl6jCV40bw&google_push=AYg5qPKNQf3du4s1lP69f1tHDGDi4TKndZ5twp0A7yWeeiWxcdFEpZpH2gpXYMP3smBJ0Rd2wnHWSaqmHX_YsI...

170 B
188 B

64ms
64ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=A3q4D32mSKFqIgxZlHl6jCV40bw&google_push=AYg5qPKNQf3du4s1lP69f1tHDGDi4TKndZ5twp0A7yWeeiWxcdFEpZpH2gpXYMP3smBJ0Rd2wnHWSaqmHX_YsIv6kAHuKCs90dUh

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=A3q4D32mSKFqIgxZlHl6jCV40bw&google_push=AYg5qPKNQf3du4s1lP69f1tHDGDi4TKndZ5twp0A7yWeeiWxcdFEpZpH2gpXYMP3smBJ0Rd2wnHWSaqmHX_YsIv6kAHuKCs90dUh
Date: Mon, 09 Aug 2021 12:44:37 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H2 204 exptsync
ads.yieldmo.com/ Frame 3276 0
35 B 1217ms
66ms Image
text/plain 34.255.77.149
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/exptsync?google_gid=CAESEE_cLodLWLxsrK1wt6GsQzE&google_cver=1&google_push=AYg5qPLNaDAEQCkx1u6uhHTCTtH4EYSiiyJsQXw9XtQEztH4oTflKirCe9L1jcLVIpDZlYXHvV2Afk5tQvNg-V1txpk5v-sixb2v
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.77.149 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-255-77-149.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 3276 0
12 B 63ms
62ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LdYYXrVn9EgFAAVClNlTlwtaKvn3cNKE5Ujh1vUv1Fcep8tWvcclr5VFtPQ6tudM7S1-M1

Requested by

Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:37 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js Show response
pagead2.googlesyndication.com/bg/ Frame 4EF2 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/z7hxA_QHVtJoFMtElcP81jTEK2mU4ZuLJ84ICjnnObI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:36:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 469
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13261
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 09 Aug 2022 12:36:48 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7489 0
20 B 29ms
28ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BD6yJNCMRYfrDH63b-gax453wDwAAAAA4AeAEAg&bg=!s7ClsPTNAAals0SOpbM7ACkAdvg8WrjhzWGzCqwmLSmFFDZ3JJJrCT4DbEjBtpX7vOC2CJCo2vOc3QIAAAHuUgAAAC1oAQcKAGaC3Sji5ZwPmuSP2jMi5HyTB2j8abItFaD5yYotLO1LeSIRAnoXkm6nUDqgsfMG9djIT-3FwA50LleS27f62MPqIQYOMXd2l8wEbqotipd8rcuoUip0qGg3ANpZrOI2eEr1A9-txsaZArUKWAwg1aLgzK33QjpALdZdO0HdylyyvISfQ4X9bzD9zMuEWrKHIcjTEpU4ky9vXhRbtidPv35rfKUg8LloK9fAvVtN8lHfjhhOlOhbnmf-tiQPLDfBd6577JvGeHbMwKncnK3-qM9dWxibysuDakKFd0HLL5zK--DWjozn9y6oJSD7nBJggZe7RicvIrjtFDngP7cEDkbkhBOArAizm3xZcuYBwaAiIOLtd7Xj-wJ00sxjNiRbJ02L6HEkTHBGEw-kc5Nb4j-Eb6OlYKVOrOXmxUPkbsy6DSAlInF_Hfv_HH5Pm0oQtsMY9088SRxlJl3QF-fjCp-Oq7VDkhSjY-8EzevYZC3P91DN6dnhUoYLpA93pC3oe6DdIAaXD6JCEGQ_1eNxoOUkugjc_tnFXxya8hEqlj3DrgoOOIM-ThwATzchrma0dymi4kKfb_Ph0z1PSpOeibkMr---bLqdZ1psEGeGjp0ZV-O4fpiIGpGC7ou56UAVPx1-ufZc1IF-GuhjAO4AXbM9hRS2TblvKBGyQpeMfdzeJiRfh57bmxdXLlb1rq92I5Pgo5HeCCNo4XpfPtflqa0RiYvZJ96chUVGDLUosrteBeJcddaslSiu8d3irUEeeIX3vju-MA0IQkw-lOyS3LF7fK2YocyRoSjcnEwevK9WTiUb7vAZBzEPVKmtBzhaZw7xBzD-__Yew-k2oDUETNXFbe8qwPyQbGAznssaX1-Q8tUYTqLQ5rObKqPUodOq9xspPMhFLRZLOS1NkBReNo5a3-mn7BQ7dCQXLxyNYP3dkaMsyfXx__UZBDRmykrqFyqoRbk0sdor843eOrFuMhKGVAJof8kYRypB4XOTNpvcKvwCaEjYiNB_m18Ijpdun5MbJO8r-s6n244pEkeY4v2G0qTpcQTX6NnTt5yQ5BU

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4EF2 0
20 B 29ms
29ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BWmPwNSMRYcfmA8Pt3wPWoIzIBQAAAAA4AeAEAg&bg=!CQqlCk7NAAals0SOpbM7ACkAdvg8Wgk6NsBRQI8_Y0SAxSYa6etKmbDM5MQ02pdFUFCTu_JYn9_ARAIAAADlUgAAAA1oAQeZAtVJ16vuyZ5r3syuSyV4PIGPhMPWujv7azjKvlU67o3LZdnQpGwOaRfllpDlLu9cvJACoxt7X-Klrar3six4lrSgMrh9zn2X2CiBKMhMWCYqDcOJStIfTVOS7xllzuWrKwupAPBSnXSkLWATLQswm18KcewiJQWRAZ0YuAc4AUEbv-Id3uat5FDxnbui3uG4O8z-9yVLt53rnJgyi8b_Y0OdtrPNp2s6wAOy7C_Wq4aQSTAjNXoyqU1dx7tOAY5UD_HCuyuUEzoyKQMU9Tz4s9qnfwzUYUH6fhbaIivjfZXHtdC5JqZnb8De0CxdRSoCN3SjR9eDwXYP4k6y6IPgRgdFAb-kvngrlbeiw7zVB59dQzXcpusAE0or_wpejdb1RpO8g98DlLdb_xux-zA-uHQAPDXCobQo7Ck9UrzAhnD3OFxhrLkXWu-DAeDqYdwsNWaiQdYGMGIFj2K0a5ridzip6F8yKtZ9M6Vo1_ErnJTEp5tNOX44C6Ml0k_Vu2wLoQHMS0ixzoSrqkOW5J3bd8pp1MDlwSgDpguzD27xaMtDznZ6uAduvajX0pWVhcNG1Jw6PYBsbLWpsKVyWJsbp09Ti4lr_COhZWwYKebdcT4bi0JiBh3sLeQ4IvYyy88gPxV3IGbg7GnFFdbohIriDJu7vi2s0f6ms7VqN5lqyu2JPes57N7Hs31X1kQAeh5_EH9-MVdfyx2G4ichIISiLK_BkfrXrkL6FZJ6BOKsLOi7OBpQ6SSWparO31j0Vjnl1IJ9F7BUeXSpAjv7IF9gzs25T0NCV0et1AZr16430E4teXHGG7vXAjQr2ropKtWSRqvdCaQZUlWAICtxlzkZISohInnVi6CmWQ9XKiz_nXxjErr9Ijp9-m6xZoXEwfZgwBqgv8re0hNHDwa4WJsCaSQehj9Nacy1dZhDGGusILkbveoLtUePW4fTf2EfnKOEex-Z2d9GMg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D014 0
20 B 31ms
30ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZMLENCMRYYPCPJXw3gPXhoTwCQAAAAA4AeAEAg&bg=!39yl3JjNAAals0SOpbM7ACkAdvg8Wp4K2C8qwHfEdervVmi3ip5QeS9tVSjxM95ytcrlcjqgI5EcjAIAAAEUUgAAAA5oAQcKADKuWvAFbjUAd-RIxuQl5evKPiud4g7rHKGTwJyqW4cTIss1eywbaw7hcW6BDvnZ2ssPsZkCtdqGdmeYeXBC9Qd9tclO7WwmhTSbnNebr2ooNJfdiU_rf9EwSVlVRFOIC1hVm1Olo4BcaOEb7zZhCzuZvdR3ZFrRrP2yuKrFRYBjwiW6Ke-7pqa3R94oCVbAdSfvQElAwGRHuexRkM8xGlS47N4fn5m883aQRq6-0Daj4MBlV9rUZhicxXvYsP4dN8dNGI6Rb8HwaICv-Fw4vqDcCKgpQ-zLcCvOh4DI7Hc6iiRqtDJpfCi1MOSBSzHcc5AUzfT6CgByffUxE1DsBfKKxl1SyXT7jg0d7FKTQfVtCk5I4jWqYnOb6dNnsruslpx1je9tqNm68sJvt92KvTXlIvQEiZoEQPOipKAAWf8lBKMAdR6TjKY2m-jP1dxKTmOEDqvsWq42xPukdBK9mY449eb4CeqIm-Tvah4PzDeTFtCxp5MrsthUBgxkhwuUFs6DZ3Cxw8-woN7IT7abGcT9w0ONnDPLYQq5wZ7khN2V8Nnug6zrZx3AzQ1Ck1539dcSHBQEoAD_l2AqfuNyxRpISXur57b0agaihAyYcIiIh2wnXUPIBN3xiAO8iD_mPgeAIPowJ_-8g7zUblcqr5Ru4KSxhs2CcePbGt7x8iS1eY3rbeuRt1A72ZwusXHxZJcVkQV5HJ4zrPYzpDR6nSggQwGh7L6Q6Vd1vKWHlLjlmWtV76t83GmReCf2SQ85d6uDXGoEQpgaAZR3Z17MiTL276O27usfMMBPeRdmRemJYS_GgBqbEiSj5Hzf4x12a54BsBeHh7FF4TffLncFd4vNxNWHIkvmFaPaVJUmSEDETlTvwhB53T9ArO3L7BPWNyOIpyXvsMhhirjNjvaJDkHKfqNf4HhumgMaode4-HbHO57qlCYg_Ct-hV6UFbpdjzfM3uFcuFUtHOpym4GosIWZwflVvP5bmKRc5A

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BFFD 42 B
64 B 44ms
43ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssdtJ0tNkDL6bjsvT_TODd_ko_Ac2BkNIC1Rp5TV6Yt6ILLL0a_DqomvRvU_do2pJ5eEhGf4mBbC7r3mqhozeRfk_spWZyDsfiomMfL2XU9pXEESn93rwHS3ujvLg&sai=AMfl-YRrlmDzBg-eUeS7xpmozL5TaByRYQpSp6TjaHBPE1UTMn3j7Rd-xQ3nMVjiWShs4d8bEtm1KaRgf6Dd0XETkGuDYQ-XyBZHJGZ4jDX_pBgApG1Tqj5Un_q5ngg&sig=Cg0ArKJSzLa1zTHdRwFUEAE&cid=CAASEuRoXxqHTq8o_PyN3zw8QE3Utw&id=lidar2&mcvt=1000&p=493,332,747,632&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210806&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=3425419279&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1628513076480&dlt=14&rpt=423&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
65 B 50ms
50ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzMwMCwyNTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzMwMCwyNTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTAiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:37 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 50ms
50ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8yIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMiIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8yIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMiIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMiJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:36 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 331 B
164 B 492ms
491ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=113181838843088&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=2&rcs=4&prev_scp=a%3D%257C251%257C%26iid1%3D9113725436610209%26eid%3D9113725436610209%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D13%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Daskleo_com-box-2-9113725436610209%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D50%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C996%2C988%2C783%2C20%2C17%2C20%2C608%2C17%2C19%2C20%2C608%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D140%26reqt%3D1628513077179&eri=1&cookie=ID%3D339de4d2466eabd0%3AT%3D1628513074%3AS%3DALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ&bc=31&abxe=1&lmt=1628216635&dt=1628513078186&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=285&adks=1875650461&ucis=h&ifi=17&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x60&msz=468x60&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

5839849e1add2a73625a3e72490ac78ea837d5a0eebe88e4f89c160e15595a13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F269 42 B
64 B 35ms
35ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsukt8-AhNVyWJ6kbHSWMICsEb9WKXXzBfmqrGvUkV2g9WAYydWxA-jA4Kwlv78DupTptLtofQMMG8v-f_DUyXse6lH0RT4XQ3CIKe5VDW-5NVzeV1HCaWuOrvzu0A&sai=AMfl-YSQI7Vvj4R1L3u0aHiplEfyi6mpRsB6pVjZk5MfUyVU0vZ6CndvvqjQtDwVzKnaSWSPvdNdF3hBHKV_uiDp8kL0mI_SxL-F6xSvElNyEL33iCmV2gYFy-FkCXY&sig=Cg0ArKJSzMHV5718WuZnEAE&cid=CAASEuRoNR8uX8-yIFtdYPVAkAtgGw&id=lidar2&mcvt=1001&p=493,979,747,1279&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20210806&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=922330152&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1628513076645&dlt=228&rpt=2&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 document.5fe25adb0b.js Show response
c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/published/592558/760486/ Frame 3FCB 13 KB
3 KB 14ms
13ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/published/592558/760486/document.5fe25adb0b.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/606d76fdb3521e8b1b19f21f?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC5TeJNCMRYeuXEJfZ3wPThYLQCP-A1_Zh3-2UvLkN2tkeEAEg9PnGJWDxrfyFpB-gAZW1lNwDyAEJqQJ_hdOmhrqzPuACAKgDAaoEnQJP0ItWEVfU4G_Mc2ooy_E6ZhXYCKPXobhLnVk3cG2Ngs3rh-rfcvEiMRVEyVrpv9upGofEWVK9ch-k-PQI2cFpy773KK1IYeT_XR0T6tPUkpvNra7eXH6nIIboBX97h4wf0ypVF2-umSCbGDMzY2_-B9uVGfgEsbhNilOSYOIB0VqAUc0-Ktn41xWeQ-j8dliNEDg-QJ2zuayS6uyPZyTM_XZjOMP7vgHklGgn_zkthdSoc-MiNWJPXkW9T--7NrviDRocQgNDHcuk681Z2v6QcP6J_yWtyC4Kn9i5gQWciTo99NxMex-2zRGK9gE8nW0SePDFuYAhKWxFdtWeYAiVZ8gR4kiUyN2SMqT2uQ5LtAPYpEhLeOTK51dato7ABL7InY7qAeAEAaAGEYAH08rrI6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG6gH89EbqAfs1RuoB5bYG6gHqpuxAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNTk1Mjc1OTAyMTQ2NjQ4MoAKA5gLAcgLAYAMAbgMAdgTDdAVAZgWAYAXAQ%26num%3D1%26sig%3DAOD64_3fCBiH40R_q_nUQph9hn_iyE91Ow%26client%3Dca-pub-6396844742497208%26adurl%3D&cb=1182224599
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12cd064445971239e3c20570b73599e24f28ae2732cc4c303ae85df00556a48a

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: X+Ja2wtEIesgIW2ULi46SA==
age: 5808253
cf-polished: origSize=14861
x-ms-lease-status: unlocked
last-modified: Wed, 07 Apr 2021 09:11:59 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 7ca98a88-001e-0000-0248-58ed26000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 67c113b34ef14a8b-FRA
cf-bgj: minify

GET
H2 200 animated-creative.2eeb31c9458928bdad06.js Show response
c.bannerflow.net/scripts/ Frame 3FCB 126 KB
42 KB 17ms
16ms Script
application/javascript 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.2eeb31c9458928bdad06.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/606d76fdb3521e8b1b19f21f?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DC5TeJNCMRYeuXEJfZ3wPThYLQCP-A1_Zh3-2UvLkN2tkeEAEg9PnGJWDxrfyFpB-gAZW1lNwDyAEJqQJ_hdOmhrqzPuACAKgDAaoEnQJP0ItWEVfU4G_Mc2ooy_E6ZhXYCKPXobhLnVk3cG2Ngs3rh-rfcvEiMRVEyVrpv9upGofEWVK9ch-k-PQI2cFpy773KK1IYeT_XR0T6tPUkpvNra7eXH6nIIboBX97h4wf0ypVF2-umSCbGDMzY2_-B9uVGfgEsbhNilOSYOIB0VqAUc0-Ktn41xWeQ-j8dliNEDg-QJ2zuayS6uyPZyTM_XZjOMP7vgHklGgn_zkthdSoc-MiNWJPXkW9T--7NrviDRocQgNDHcuk681Z2v6QcP6J_yWtyC4Kn9i5gQWciTo99NxMex-2zRGK9gE8nW0SePDFuYAhKWxFdtWeYAiVZ8gR4kiUyN2SMqT2uQ5LtAPYpEhLeOTK51dato7ABL7InY7qAeAEAaAGEYAH08rrI6gH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG6gH89EbqAfs1RuoB5bYG6gHqpuxAtgHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNTk1Mjc1OTAyMTQ2NjQ4MoAKA5gLAcgLAYAMAbgMAdgTDdAVAZgWAYAXAQ%26num%3D1%26sig%3DAOD64_3fCBiH40R_q_nUQph9hn_iyE91Ow%26client%3Dca-pub-6396844742497208%26adurl%3D&cb=1182224599
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2787eea78a4f9318c5b120447bae4ffd745940ec426bbb9823ac0bb285b9314

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: kAZKdYVwf2cBpizv/Np+Ww==
age: 5808253
cf-polished: origSize=129414
x-ms-lease-status: unlocked
last-modified: Wed, 31 Mar 2021 11:16:15 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f7a36e60-f01e-0014-2548-58a549000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 67c113b34ef34a8b-FRA
cf-bgj: minify

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 58ms
58ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8xIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJhZF9wb3NpdGlvbiI6MTEwNCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTM0NzQ4NDYzMDczMCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTMtMF8xIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTUzNDc0ODQ2MzA3MzAiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1hc2tsZW9fY29tLWJveC0zLTBfMSIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiNzQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:38 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 51ms
50ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils3MjgsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MDAxNjUyMTIwNjY0ODc4IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MDAxNjUyMTIwNjY0ODc4IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxOTMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils3MjgsOTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MDAxNjUyMTIwNjY0ODc4IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI4MDAxNjUyMTIwNjY0ODc4IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4OCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIxOTMifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:37 UTC

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 280D 42 B
64 B 33ms
33ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssnRXeuSmB_hvAa-OhQvoSpYDDg0dKP-zc8PqRGq5ryoPbs9QiRpNmFO4HDHBc5HQYHhaNHZ7QvM9IaP1uK0a_bwlulNCYWdfEo1OMGVu78dfT5aBHCTQCBj8YAiw&sai=AMfl-YSFS7OYYKnW3lmJ_Jb-3uAf3G6xjNmvPII6Ter_eXjsEZr3FEUJfls4_1RQE1NqiVRtv0AtJe5Ty1eND0iJPI6jEQTsI8dOnI8t-9wV4bnIQ5U3NRVZtl9z2bQ&sig=Cg0ArKJSzBjDmX8gmSRaEAE&cid=CAASEuRobMd28Z32ssjNnswp6Pyzng&id=lidar2&mcvt=1000&p=493,655,747,955&asp=493,655,747,955&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20210806&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=922330153&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1628513076857&dlt=80&rpt=538&isd=0&lsd=0&msd=0&r=v&speed=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 3FCB 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 3FCB 4 KB
5 KB 30ms
14ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F5992fc9c5aa6dc1994b532b6%2F188c473c-7226-4e30-a331-24ed0c8dc9bc.woff&t=%20Baefgilnortv%C3%A4%C3%A5%C3%B6
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c82424d491cad337fbb068d4eafe7f2f3eae73f88ca24422c85733ff7913214

Request headers

Origin: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
cf-cache-status: HIT
server: cloudflare
age: 9525547
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=188c473c-7226-4e30-a331-24ed0c8dc9bc-subset.woff
cf-ray: 67c113b46f4f4eb0-FRA
expires: Thu, 21 Apr 2022 06:45:31 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 3FCB 5 KB
5 KB 30ms
14ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F5992fc9c5aa6dc1994b532b6%2Fa2c4ac0f-4006-4ad4-888d-afd9a56db905.woff&t=%20.ABSVabcdefhiklmnoprstuv%C3%A4%C3%A5%C3%B6
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59102b63acf9c9ff9ec3ff18b5f4d209b757273971b919a63cbade5bf8ee0955

Request headers

Origin: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
cf-cache-status: HIT
server: cloudflare
age: 9525547
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=a2c4ac0f-4006-4ad4-888d-afd9a56db905-subset.woff
cf-ray: 67c113b46f5d4eb0-FRA
expires: Thu, 21 Apr 2022 06:45:31 GMT

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 3FCB 3 KB
3 KB 32ms
16ms Font
font/woff 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F550abe329445702310657a53%2F5992fc9c5aa6dc1994b532b6%2F22150624-8703-4bae-a214-77928211e75c.woff&t=%20Aknsu%C3%B6
Requested by: Host: 0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
URL: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4081abf0804d11e5b2d6765205964f004ae15dfef0016d062172f737a81ac2c1

Request headers

Origin: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
cf-cache-status: HIT
server: cloudflare
age: 198920
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=22150624-8703-4bae-a214-77928211e75c-subset.woff
cf-ray: 67c113b46f614eb0-FRA
expires: Sun, 07 Aug 2022 05:29:18 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3FCB 42 B
64 B 37ms
36ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1mc469az5yMdD_UkDJUA1dzidAYxRWBcsp0CMmOv_yyklaNq28YyaG2UH1Qh0nnyRO1PPkZvGmInp2xjFnl5LNO9rEELh2pZbGFoxvDZRjFHfhs0pTh_sVQDIuwbv4ufwOeXID18hGviLC2yTpacw&sai=AMfl-YS3nRiSAhzOEhN3LmisbrZGUkpeaP5nYxW9O_Fi4YLm2-IhXv25tjNWCatuFWnFWffzOo1TUSLADakb8pZUfj-by5AKSvm45llaqPg-QCpTiqp2-ZSbnohjDl4&sig=Cg0ArKJSzDdaHHnfV39LEAE&cid=CAASF-Ro20ooZMuABw4NUV-Mw22cC9SnMAmv&id=lidar2&mcvt=1012&p=1110,436,1200,1164&mtos=1012,1012,1012,1012,1012&tos=1012,0,0,0,0&v=20210806&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=404481011&rs=4&met=ie&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ%3D%3D&vs=4&eosm=0&rst=1628513076870&dlt=87&rpt=1&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 52ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxMTA0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:37 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 51ms
50ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzIiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:37 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 51ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiODAwMTY1MjEyMDY2NDg3OCIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODgsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:38 UTC

GET
H2 200 optimizepositionedimage
c.bannerflow.net/io/api/image/ Frame 7F67 10 KB
10 KB 14ms
14ms Image
image/webp 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimizepositionedimage?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fsvea-ekonomi%2F5992fc9c5aa6dc1994b532b6%2Fimages%2F06af0316-b97d-4bbd-a63e-b0d0f2a06a23.jpg&w=220&h=115&q=90&f=webp&positionX=0&positionY=56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 534bd405277470d844057484c3618601fc6d50ebf7bfad61a46f751512d60b3a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
cf-cache-status: HIT
api-supported-versions: 2.0
age: 79951
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 67c113b4a9c24a8b-FRA
content-length: 9810
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 77b11301-0f34-4ee2-bbe3-2865cc6e3055.png
c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/images/ Frame 7F67 14 KB
14 KB 15ms
14ms Image
image/png 2606:4700::6810:c40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/svea-ekonomi/5992fc9c5aa6dc1994b532b6/images/77b11301-0f34-4ee2-bbe3-2865cc6e3055.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:c40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7cf57286c8cbbdb9ef318c7995e10bf949ff11acf8447cee91b6de81fc01954f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 09 Aug 2021 12:44:38 GMT
cf-cache-status: HIT
content-md5: EiGW/H0enNGNVTz16gzVVQ==
age: 5710
content-length: 14077
x-ms-lease-status: unlocked
last-modified: Mon, 25 Nov 2019 05:59:27 GMT
server: cloudflare
etag: 0x8D7716CA1300B94
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 65e4230b-301e-0069-2e4d-8bd46a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 67c113b4a9c84a8b-FRA

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 51ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1MzQ3NDg0NjMwNzMwIiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMy0wXzEiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExMDQsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IlNFIiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=980; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:38 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=askleo.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
14 KB 296ms
296ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=162110459216175&correlator=2793397421938149&output=ldjh&impl=fifs&eid=31062161%2C20211866%2C31062064&vrg=2021080401&ptt=17&sc=1&sfv=1-0-38&ecs=20210809&iu_parts=1254144%2Caskleo_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&ris=1&rcs=5&prev_scp=a%3D%257C251%257C%26iid1%3D9113725436610209%26eid%3D9113725436610209%26t%3D134%26d%3D173078%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod32-c%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D13%26reft%3Dn%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Daskleo_com-box-2-9113725436610209%26eb_br%3D14e8a85d4c42ff1db8790cbef9e33493%26eba%3D1%26ebss%3D10082%2C10061%2C10015%2C10063%2C11304%2C11307%26bv%3D16%26bvm%3D0%26bvr%3D6%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D12%26br2%3D500%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C996%2C988%2C783%2C20%2C17%2C20%2C608%2C17%2C19%2C20%2C608%2C17%2C18%2C19%2C20%2C601%2C608%2C1428%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D50%26reqt%3D1628513078692&eri=1&cookie=ID%3D339de4d2466eabd0%3AT%3D1628513074%3AS%3DALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ&bc=31&abxe=1&lmt=1628216635&dt=1628513078700&dlt=1628513070441&idt=1430&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=285&adks=1875650461&ucis=i&ifi=18&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Faskleo.com%2Ffrom_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1000x60&msz=468x60&ga_vid=136210377.1628513072&ga_sid=1628513072&ga_hid=1133704044&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCxudWxsXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

751dfa994586c27be7650077d1a09b37102a2e62ccbe0fee690de0b188c3a73b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:38 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13996
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://askleo.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012107240354000/ Frame 5108 188 KB
55 KB 35ms
6ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107240354000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b826f485873b923a0a9046262b9d026e8f4d2094da1e98e527f279eb9b148d6c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 589075
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55201
x-xss-protection: 0
server: sffe
date: Mon, 02 Aug 2021 17:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "56e2a7f7d448fcb3"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 17:06:44 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012107240354000/v0/ Frame 5108 13 KB
5 KB 45ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107240354000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1609bdcf4696c8146359638f33c35febdaba621dea00137283c61efc17504909

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 589075
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4865
x-xss-protection: 0
server: sffe
date: Mon, 02 Aug 2021 17:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "ff227f97ed674b5b"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 17:06:44 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012107240354000/v0/ Frame 5108 87 KB
27 KB 46ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107240354000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4075d8c0c312c24df5548f967cab5fbf808fe78fdcef9d4032bad92f6cacbb70

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 589075
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27852
x-xss-protection: 0
server: sffe
date: Mon, 02 Aug 2021 17:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "3719646983ab1de2"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 17:06:44 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012107240354000/v0/ Frame 5108 4 KB
2 KB 48ms
20ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107240354000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fbb36bdcd7fcb6a1962d355dccfab3262736d4d198a389ffb85a3fa3d2440d4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 589075
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1653
x-xss-protection: 0
server: sffe
date: Mon, 02 Aug 2021 17:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "687e73129cfc4c8d"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 17:06:44 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012107240354000/v0/ Frame 5108 40 KB
13 KB 49ms
21ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012107240354000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78e0bdeabeebc2dc279c8a9321a3c05dfee71e89123ee3d480fb83fe9d308aed

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 589075
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12828
x-xss-protection: 0
server: sffe
date: Mon, 02 Aug 2021 17:06:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "4abe217821914203"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 17:06:44 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5108 4 KB
713 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 11:03:23 GMT
server: ESF
date: Mon, 09 Aug 2021 12:44:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 09 Aug 2021 12:44:39 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 5108 4 KB
690 B 25ms
25ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021080401.js?31062161

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 09 Aug 2021 12:43:43 GMT
server: ESF
date: Mon, 09 Aug 2021 12:44:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 09 Aug 2021 12:44:39 GMT

GET
DATA 200
OK truncated
/ Frame 5108 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eaa999e78a050cba8c477303c819fc31c6730bc1c23ed400924ef780033d9d68

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 10748500486760694314
s0.2mdn.net/simgad/ Frame 5108 129 KB
129 KB 9ms
8ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10748500486760694314

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a93ec136c0ab99c2f652d8922fd21cbf589a24e72e1befcfabe54e1895ac5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 02:00:29 GMT
x-content-type-options: nosniff
age: 557050
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132559
x-xss-protection: 0
last-modified: Tue, 18 May 2021 18:50:17 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Aug 2022 02:00:29 GMT

GET
H3-29 200 ad
googleads.g.doubleclick.net/dbm/ Frame 5108 42 B
63 B 29ms
28ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A99_8nl_NzSQ2EKfp9-ZXBr6FwP8HBHmR0OWQLrqXfi024hikACl88KfhV6g3CYLxihDWiaodEr5VNDYoE1MfMkjepWYC6gX-o5cEFTpPTFZ6u81cd39hZ7pmZ5D4dLGUjz6m2Qntll4uifGkALKNUJeYKJQ&dbm_d=AKAmf-AqfPqXIwMJQ8KgbDi7Ttc2Yy8iwzIOuSqGrCvDAYMRX7RYWT-lK2n_EtMhgwIGGnU72X6yS1jtQNtxoeBbHGisLzGcGmfz-AB23_fuqhkCJgpiQebWclcI76OTYmhzzX-lCTvxDd4c3-T4rwm7c_uO_z14gex-N7Yfp-WLm65WZKOmr6auBSqKe5fASf4NaSFYmJz5BPA0EdU4vil2T8HaVDYoSjeZ3IeB6P_bbpzTR33q1AJGSeDSRngxpnrnDKXi1lmpkE764EogFj7oY1DJrcYABcgiE5GHko6xOr-TAizbwS4Ge7U2OzqLtMxPi2S9d2C8zxraKMN26SQTQVNqOhDK6WvAnx9mCPrw5YDSmEIpwnHiEnRZ0FUKR1DPDu92nbB6z7uymISsaFG5p6rb6iCgzX5LusZtCDrXPETcSKX8B5d12pfzifcr84Y81FRJ1_iswEDIkY4p9m-ij4-ILx6QF8RbqBDgiYnqBjvon7BEHvD0mz60j05rrRt9PEL6WW-yEIiPrrkQvmSBqzGgWwVIrolpAvzjKSwVftxY7GcmlrUuxdtsVg0icZX9p5F8k16P7KqHtu_9X690Ta7DIORsqlfBUyEBJ3zxaamkNf2yvQYk2bb3joJW4jWjNfxAKCYYFcVRSHhQpFm-wcXribyyEYLpwbNKmvffI4y68NaA2BDTVQqGuy7-gSX9EupMHRn8kJ7RvBbpiBIPZ6LLlVwxyFfxWen51Kj0nu1fZVWEbwGt3eRJGdfdVdtp2jyRa4Tj6Wotaq4-yX31Flfa_JEjvH560b6L0sOLJJpgkpKza-5LEG93_B_5xa7lrlFlRpFML9-5UEK41tR2XAkBEjpYWTwien0djLbpBkhDMy16BedroykddP4OkqL4dXylkKJF2erSyMjLsqzdSeHMcqCIweIqiBXWpmJUJ64Y--TM5pMpZmawU6jHpbH8heC5mR8kYilXIFDhuW_OGqtfhv5tO_hWlYnPA4WBZka0g9EDvAfykhyRw7ry4gt5GAjUqLh-BoXNZjc0JATo2BUJ_mGhve78P-vuAjXzAW_kHoVQrMK0ZgmE55UagLDBrdCTKvO26eVgzzjtzAe8R3rrzd8AmvmYHrzdFTFy56CUxiceTsy2IcitmAB1zioqw-xPpVPANpj8zVfR5Le7RNyGmei9vvcJjE84xFoM0EEkWxFKgihxGl-XyYI9hBDxLycTbefyieK5DDNwTika05gsegXfRIr4i5p1y-LYl6zNhvvXvT2YZsirCjyvaW1DVRQ0i-UdvI2lyax1wMyOvaYzg-RH2efSTeuDUttp41rwS2jd3VtnURJRnE_bTgxvGYFjPUZjM3CsRkdbmUKIPAijOWWaKAtiRo1dK3PjOTUfVRfVhN5AqTUDf-l0pl1dM_8MSjXf_0qLsoKZMdPWSqEV8RurSBTy29UO4rUuqQSJDio0iwc8RE_FY4ygulpxSHHMJic-HrFA0F3ZFXZvVC12mf4SygTmZ7fz4LKIs2hHxjCL_67fzawCIndH18T5BZ6sQoJ0NiPu8-QlzX2Czp1WyzYE0QgEXsxKuHeIF8u8O6t4I1UBB-00EZkMwj0h3o3__BBLhqVFGwBvkoV6oCQbOiena311TQSOZqhTd4PYb_9aKf16bsRBv_omHB6up4KumuHXVrxeN4auPmzCE1lqPGkKRsZoD7cR1Fd17z5A8GcFcSPjJ5TSrpvGGsPciuIoxRqPZPs65jULHINO0y5dMvnKiZDzOocXC6glW5eIJUD7PFqosdEUdes1dc7tM2quvKAJY5mT_BEWuUOw0BdZlyTDJdV2SRto1EK_b_TOxWM_k8xRhuv8l-w-QlrPgVAlnHSSPV51Khnj3XKkHSVFkGFCfa6cXYc_q5Atl01zMijpoh_s3-BS8RU9hIymymXgnF85TsMamYJzB0SjAqAIqrvfe1O4pPMXz3dEYQM6VobjhSL4pg3bN0kw4fbqE0rlNKHMa_SyJviRUc9mn_Jz1uVBf0VdWoXfa_TUV8-i3y_00y1YzE3LQ6tVCMyKXEqS9W5s8c7xvnVN-bY1Un74CKEWkr4h9RjDDpfj_aMsRqbban6mGIYPylUT9VXweo1W-Uun27GNu3MCSQWLKAHmacYlLH2obtWtBfI3xl7w1awxfx5AdPLvUy0M-kUTLiOUUvVV6DSQovpWV7V58iUIPADcr1efb5C44uradbkZO5YnG4ALUtYpiY6N58MUCOGe3qEbEwUIjLslDYGFr7IXuwZPvybVPCrsiQTeHVHnltGlsmdddhXLiSneaL-igEuaulykZxtkpxUbi3rbKMRqC-gwrK0AjGR6H35TZMV9z3DUWRS8IWA3Yow2medfYD00I2KupMbafExCA0WSguwUWYgvAQtH3TS7cHrmbp2I2QnmWu6rp817w4ldOJb1QjRX_vjve2Z0LrhXVyBnMjs2PYEs0mDl0PAqUMqt91YQbp0sTSSThnbszM-MJw0lmm0Q4qy6TIzJVBsTJiQgDuQ7fxLz_Cd_lvEco5a1stOVYR-Zc8XLBJdUB7F-5vCaMuOunyxJtxsro478PcwKJz6WKDP5W5b965N4f4Wf7G48xbZ-R2_-9TwHQtmR70YS7FGZ6vGhMrQ5LCPZ9hFApyBwsqE4QTVOtIpN8pv-FZQCLiyVJz31o8Q4kYbyjr-G6_oH3cx9lsiYCvaQhpGuGePQpM8W7ZQvNCzzNkiDkTOBSbmFuG30DIRlMI1fTImDqBOgtZNT2PRaLGVgSk6wf5D7PgMyhBNiaYD_qvaDt59j3tonRkoaReG1SWJDLEfu9T1-H5Jar35I1o-UXv-FkfW4H56Umj6uwzwQh_qWtBvtqZ7Eq2rX30x2Yy-GYTA7zW5Smu4a5UGeUOyZaX2_fspngIAPwMofgdKnTsw3byymA8k1vvQf3qr33X3uekiFztNescg4te9HNoMXgSQnopP3SIVnb0-UgM9h5n9ggZdrR9vI-ofg5YAu3lPIGE7jQ40mXd5R_LJvtletoiKaSqOvw5poKfnOICGI61xDDzny-DlkZ40nivFFenJ-zRJCaeQYJntspVnLBF-ClGhTMXH_hlD7gCYd0v3oM0gYubLLjIkXcVl-OzKfZ3WuGHSCGCFDrzJCHkZcvcw0VOUbMmDMfY3E_8Zu5sDtPxACE7tEZiiNQGM&cid=CAASEuRoxBdwZ3kbAt1uphg630q4yQ

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5108 0
0 67ms
65ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CwRnUNiMRYcvuLpqV3wPo7I_wC67tpshjs7fclfcNm_D0_QgQASD0-cYlYPGt_IWkH6ABzJTivQHIAQaoAwHIAwqqBMUBT9DJN5bHEtSmnHH8ObpYKnMXfQLZExL4wwP5N73T8dZAjsz4LvazM8uVbxubpfoTwbSKeX8hd9oHykB7WoPJNc5j4tqhQ-ZFkGn9ksdwnq_qMEuwGtGb8ZsJMCeKSRS2LadfRmtsBJVqJMlz8AIkK6tVrtS__crCpQ0QLBtg5j6kag5sINjm1K-iabIUlIp8YXqnSVL7Srg-wpBQpaQZwe6VNnrKAT8JQwD2aFrw2LU8570_jJqae3mn4MndW4Vj25l70SbABKfAxvHKA-AEA4gFjsGxszGSBQYIAxABGAGSBQYIGxABGAGSBQYIHRAEGAGSBQYIHRABGAGSBQYIHhABGAGQBgGgBjeAB5zrncICqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RvYBwHyBwoQ8okmGMS0hKoB0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi01OTUyNzU5MDIxNDY2NDgygAoDyAsBsBPXppcMyBOfovHcA9ATANgTDYgUAdgUAdAVAYAXAbIXGgoYCAASFHB1Yi02Mzk2ODQ0NzQyNDk3MjA4&sigh=CPeR3xJ-F2g&cid=CAQSOwCNIrLMWaLIFhmrq-hpNIwjzpvG6ALA_LncVT-BQepK-p6im00nUXHKYe-0xMjWOwt13-PtidIxBHb3&template_id=509&vt=10
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 5108 0
0 14ms
13ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTvWUkcSQ76rJlk1n6B6tgN6zRFpwPYtiT_XOYQAWG_HHVfxL9ATJrQk9naJYpxi56VwaqJtF8ytqUxqYfI9FLVK0Y7-A
Requested by: Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5108 2 KB
2 KB 9ms
7ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 08 Aug 2021 15:34:33 GMT
x-content-type-options: nosniff
server: cafe
age: 76206
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 09 Aug 2021 15:34:33 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5108 295 B
319 B 7ms
6ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: askleo.com
URL: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:37:33 GMT
x-content-type-options: nosniff
server: cafe
age: 426
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 10 Aug 2021 12:37:33 GMT

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
65 B 52ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiIxNGU4YTg1ZDRjNDJmZjFkYjg3OTBjYmVmOWUzMzQ5MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDEyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDM0NTg1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNiJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiIxNGU4YTg1ZDRjNDJmZjFkYjg3OTBjYmVmOWUzMzQ5MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDEyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTIsImJpZF9mbG9vcl9wcmV2IjowLjAwMDUsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDM0NTg1In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=992; ezouspva=5
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:39 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:46 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
40 B 54ms
53ms XHR
text/plain 3.66.136.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: askleo.com
URL: https://askleo.com/porpoiseant/banger.js?cb=195-2&bv=52&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.66.136.156 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-66-136-156.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 09 Aug 2021 12:44:39 GMT
cache-control: max-age=3600, public
server: nginx
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 52ms
52ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTA5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTQifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA4LTA5In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTQifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMSJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=992; ezouspva=5
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:39 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:38 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
19 B 52ms
52ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImF1Y3Rpb25fZXBvY2giOjE2Mjg1MTMwNzksImFkX3Bvc2l0aW9uIjoxMTAzLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjgwMCwiYmlkX2Zsb29yX3ByZXYiOjUwLCJiaWRfZmxvb3JfZmlsbGVkIjoxMiwiYXVjdGlvbl9jb3VudCI6NiwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MzIxLCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImF1Y3Rpb25fZXBvY2giOjE2Mjg1MTMwNzksImFkX3Bvc2l0aW9uIjoxMTAzLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjgwMCwiYmlkX2Zsb29yX3ByZXYiOjUwLCJiaWRfZmxvb3JfZmlsbGVkIjoxMiwiYXVjdGlvbl9jb3VudCI6NiwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6MzIxLCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=992; ezouspva=5
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:39 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:37 UTC

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 5108 15 KB
15 KB 7ms
4ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://askleo.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 02 Aug 2021 18:26:24 GMT
x-content-type-options: nosniff
age: 584295
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 Aug 2022 18:26:24 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ Frame 5108 16 KB
16 KB 9ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://askleo.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 17:17:27 GMT
x-content-type-options: nosniff
age: 502032
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Aug 2022 17:17:27 GMT

GET
H3-29

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 5108
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

21ms
19ms

Image
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

date: Mon, 09 Aug 2021 12:44:39 GMT
x-content-type-options: nosniff
server: safe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-29 200 10748500486760694314
s0.2mdn.net/simgad/ Frame 5108 129 KB
129 KB 6ms
6ms Image
image/png 2a00:1450:4001:830::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10748500486760694314

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107240354000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a93ec136c0ab99c2f652d8922fd21cbf589a24e72e1befcfabe54e1895ac5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 03 Aug 2021 02:00:29 GMT
x-content-type-options: nosniff
age: 557050
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132559
x-xss-protection: 0
last-modified: Tue, 18 May 2021 18:50:17 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 Aug 2022 02:00:29 GMT

GET
H3-29 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5108 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107240354000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 08 Aug 2021 15:34:33 GMT
x-content-type-options: nosniff
server: cafe
age: 76206
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 09 Aug 2021 15:34:33 GMT

GET
H3-29 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5108 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012107240354000/amp4ads-v0.mjs

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 09 Aug 2021 12:37:33 GMT
x-content-type-options: nosniff
server: cafe
age: 426
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 10 Aug 2021 12:37:33 GMT

GET
H2 200 greenoaks.gif Show response
askleo.com/detroitchicago/ 0
19 B 51ms
50ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjI3MDMzMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI1In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjMzNTg1MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiNjQ2ODMyMDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiNDA0MjcifV19XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIzMjdkZWEzMS1iZGM1LTQ1M2YtNzE2ZS0zM2Y3ZGVkZTc5NTkiLCJkb21haW5faWQiOiIxNzMwNzgiLCJ0X2Vwb2NoIjoxNjI4NTEzMDY5LCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjI3MDMzMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI1In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjMzNTg1MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiNjQ2ODMyMDAifSx7Im5hbWUiOiJkb2NfaGVpZ2h0IiwidmFsIjoiNDA0MjcifV19XQ==
pragma: no-cache
cookie: __gads=ID=339de4d2466eabd0:T=1628513074:S=ALNI_MaDoC0zwt2z8DeJvnHFP1rwLhs8sQ; ezouspvh=260; ezouspvv=992; ezouspva=5
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:39 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:38 UTC

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
65 B 53ms
52ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:40 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:40 UTC

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 5108 42 B
289 B 32ms
31ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvPDX6YZBIhgRA7msk0YGV03A8rBFgYPRwJlYVqeJqdrrnWlNpNJJuJnzKUaQ_DIKa1G2ohjOB0FkRfVbaVbBKThdAkhZT1UJixHSryj4Y1iEVpWC5khk0eVnbLcA&sai=AMfl-YTrXwHn1Rv8WMnKrkZWqvkEynCbT8x0bFLIid5lirz905rcdm2WT8wP4j44xc5p4U6yWaQpJRT_PtOiQQIi6R1GgkS2Kd6Uo2sKst-LllGzGb_tFRvNEbf0JCQ&sig=Cg0ArKJSzCfmvhC41XNWEAE&cid=CAASEuRoxBdwZ3kbAt1uphg630q4yQ&id=ampim&o=566,285&d=468,60&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=89&tls=1089&g=100&h=100&tt=1089&r=v&avms=ampa&adk=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://askleo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 09 Aug 2021 12:44:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
askleo.com/porpoiseant/ 0
42 B 51ms
51ms XHR
text/plain 18.159.80.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://askleo.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils0NjgsNjBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: askleo.com
URL: https://askleo.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-4y06-12y07-1y0b-5y0d-10y13-3y17-3y20-3y33-15y52-1y56-21&cmbcb=20&sj=x04x02x06x07x0bx0dx13x17x20x33x52x56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.159.80.129 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-159-80-129.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTExMzcyNTQzNjYxMDIwOSIsImRvbWFpbl9pZCI6IjE3MzA3OCIsInVuaXQiOiJkaXYtZ3B0LWFkLWFza2xlb19jb20tYm94LTItMCIsInRfZXBvY2giOjE2Mjg1MTMwNjksImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiU0UiLCJwYWdldmlld19pZCI6IjMyN2RlYTMxLWJkYzUtNDUzZi03MTZlLTMzZjdkZWRlNzk1OSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1ODUsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6Ils0NjgsNjBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTEzNzI1NDM2NjEwMjA5IiwiZG9tYWluX2lkIjoiMTczMDc4IiwidW5pdCI6ImRpdi1ncHQtYWQtYXNrbGVvX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYyODUxMzA2OSwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJTRSIsInBhZ2V2aWV3X2lkIjoiMzI3ZGVhMzEtYmRjNS00NTNmLTcxNmUtMzNmN2RlZGU3OTU5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDU4NSwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiI3MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: askleo.com
referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 09 Aug 2021 12:44:40 GMT
server: nginx
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 08 Aug 2021 12:44:41 UTC

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: google2waycm.netmng.com
URL: https://google2waycm.netmng.com/cm/?google_gid=CAESEFDrUKx3ouFaMvQpkYGC1TU&google_cver=1&google_push=AYg5qPK7K1xwGGMbK7yJTG2Gd_yC1NsxmnhuYkuJHwagav21RBzxMt-Cu2KEn5jcPx-joQDKWoL0_7Y-p8qxh4_rM_F43TU4AzP_

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=N2YyZmExOTAtZWM5ZC00MjMzLWIxMDQtZmI5MDFjMjkwMzlk&google_push=AYg5qPJ3-DuvXla-R2Ryv081nbCrcq73H9hq1knwukEq45tmt_LQFqX4VoYYxE4FNOhOcltiA7PRTkGmD0DygOJ8u2pvnpPk8Ad22w&google_tc=

Verdicts & Comments Add Verdict or Comment

251 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
askleo.com/	1970-01-20 05:07:29	Name: ezux_lpl_173078 Value: 1628513072254\|327dea31-bdc5-453f-716e-33f7dede7959\|false
.askleo.com/	1970-01-20 05:46:21	Name: __qca Value: P0-764320549-1628513072184
askleo.com/	1970-01-22 09:41:05	Name: ezohw Value: w%3D1600%2Ch%3D1200
.askleo.com/	1970-01-20 13:53:05	Name: ezosuigeneris Value: 35590a724061e197809658bd35dfdc30
askleo.com/	1970-01-22 09:41:05	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
.askleo.com/	1970-01-20 05:43:29	Name: __gads Value: ID=ab7ced84da9cf4d2-22cd47869ac80030:T=1628513071:S=ALNI_MYOszVlAlUkxFeQ2Cn1a6i--O_kXQ
askleo.com/	1969-12-31 23:59:59	Name: ezouspva Value: 0
askleo.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://askleo.askleomedia.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2
console-api	info	URL: https://cdn.ampproject.org/rtv/012107240354000/amp4ads-v0.mjs(Line 6) Message: Powered by AMP ⚡ HTML – Version 2107240354000 https://askleo.com/from_spoofing_how_spammers_send_email_that_looks_like_it_came_from_you/

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0e0c511169c4964b67ef7b80aaef99f9.safeframe.googlesyndication.com
a.tribalfusion.com
ads.yieldmo.com
adservice.google.com
adservice.google.se
ap.lijit.com
askleo.askleomedia.com
askleo.com
b1sync.zemanta.com
c.amazon-adsystem.com
c.bannerflow.net
c1.adform.net
cc.adingo.jp
cdn.ampproject.org
cm.g.doubleclick.net
cs.media.net
d5p.de17a.com
dclk-match.dotomi.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
g.ezoic.net
gcm.ctnsnet.com
go.ezodn.com
go.ezoic.net
google2waycm.netmng.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
image6.pubmatic.com
match.360yield.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
r.scoota.co
rtb2-useast.e-volution.ai
rules.quantcount.com
s.tribalfusion.com
s0.2mdn.net
secure.quantserve.com
securepubads.g.doubleclick.net
sm.rtb.mts.ru
ssbsync.smartadserver.com
ssp.adriver.ru
sync-tm.everesttech.net
sync.srv.stackadapt.com
sync.teads.tv
sync.tidaltv.com
tech.rtb.mts.ru
tpc.googlesyndication.com
tracking.m6r.eu
ups.analytics.yahoo.com
us-u.openx.net
www.google.com
www.googletagservices.com
x.bidswitch.net
cm.g.doubleclick.net
google2waycm.netmng.com
104.111.242.245
13.32.21.201
142.250.184.226
142.250.74.194
151.101.14.49
151.139.128.11
172.217.23.98
174.137.133.49
18.159.80.129
18.185.208.29
185.33.220.241
185.64.190.78
185.86.138.131
2.18.234.21
2.18.235.93
213.155.156.165
213.87.44.187
216.52.2.39
217.66.147.169
2600:9000:2057:9a00:2:cb38:840:93a1
2600:9000:211e:ce00:6:44e3:f8c0:93a1
2606:4700:3036::ac43:a1d1
2606:4700::6810:c40
2606:4700::6812:c05
2a00:1450:4001:800::2003
2a00:1450:4001:801::2001
2a00:1450:4001:801::2002
2a00:1450:4001:802::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:811::2002
2a00:1450:4001:812::200a
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:830::2002
2a00:1450:4001:830::2006
2a02:fa8:8806:16::1400
2a05:d018:24:b001:197c:8ea4:869f:2648
3.126.56.137
3.66.136.156
34.205.3.24
34.255.77.149
34.98.64.218
35.157.0.85
35.157.177.200
35.186.193.173
37.157.2.236
52.198.4.47
54.171.74.241
64.202.112.63
72.251.244.141
81.222.128.213
91.228.74.134
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0608fb292b35aeda9a58753b14a45c86796d2b58596d7ff2af67e5f692a77de8
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
09b56f997a02246f1af68bb00f2e1c634572510712e3ff82e9dc151bd226c376
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0cd851e5b33af0fbb354df65506da39807b998e07723f3d08aba5179fa2ed97e
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12cd064445971239e3c20570b73599e24f28ae2732cc4c303ae85df00556a48a
12e565307080aa9048142e9492be4941bd4230b24de22a321a208c041e226a1c
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
155f5f740759b681ffb0e20f52f8755242fbe2e5f73984765242b3c0bbe458de
1609bdcf4696c8146359638f33c35febdaba621dea00137283c61efc17504909
1a93ec136c0ab99c2f652d8922fd21cbf589a24e72e1befcfabe54e1895ac5d8
1cc5fba1b17b26c8975d63d581f375152c583264b4ba58a2d2eacac2d11d90ee
1d679474c62830d6a3e51724af7fb034d9151eea7168bf3b02a715a4dfdb3fd5
2087d023c149cf3b8c828e94c7c057c759648209f45447774b40c67f1b288ba1
2620ea80d4b627207ed8ee055d6db3b460e241936dbede10f54cd5bf26653c6b
290bfec620bfd7765ed1aca8daf780e26da80d53f90baaa412d54c043f816673
31bd4156e14d269de39d5e4bda8b81140fe74ccf3f91c49103c4ea22c8b4cd90
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3308cdd33248924ba53448a8bd037fe04c77df79bc773b50198a071dde70d511
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
39d5cdc19374a44077c4246db6f442209b230d42642019e056574a20090403c4
3b1384ff918d4b7f95f9ee5c8fc388203dedff7344d3d96598c9562162788612
3b68bad79742705a9e7a436733a8fd2278f9923f48fc304ce9aecd97205ad642
3c30f9db6ce74a9fadf8de7de2ae7e23428d3c043f576184c391908f8154d2f7
4075d8c0c312c24df5548f967cab5fbf808fe78fdcef9d4032bad92f6cacbb70
4081abf0804d11e5b2d6765205964f004ae15dfef0016d062172f737a81ac2c1
408d297d9dc9f508a1a0e80af26e5cba10bc65228ae11bc77040c46891bfd9c5
443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008
44b9a9d2c3baadad3ce45a7368c567c905db6d1473139b93b50123e3197e20c5
4559f60701a5aa950f63abc90ccac3d816472952ba46f119d7a7f9a74fd0e504
46fe1e70ee65fb4c830d4c6ed315119e499efc0b8e18245f5b26a9860ae55f16
48052f6267b2e21fb086ad26457c715b3b8b5e8c6fcbcdea42589da06b05e9be
4883cdcfd267a93c48c03f2af24a342223239176f49abd440982e450e417a42c
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c82424d491cad337fbb068d4eafe7f2f3eae73f88ca24422c85733ff7913214
4d3c7f9d4e2b85c5a04a382911211f91906e8c342a0641bb9d8175629924b2dd
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ee6cb4482225d6c4f47f4db5011d22a38a4248a59063d7b4cde53ad1fea1723
4f6cacd54975e047a9bb152841f8fa870b1797366cd5993462f121ee77711e13
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
534bd405277470d844057484c3618601fc6d50ebf7bfad61a46f751512d60b3a
55b58281bbc9f83501945a904f3654d22a370fc8506c4e0763537f2ee7531efd
565c4499fdc5a3d666fbbc8f2711cfb804913d324af47a216ace7821cae632f8
579e75d3ac3a8ee1bfb4302770335e7363d2f9bb5dbcd96ff28efb7b03104599
5839849e1add2a73625a3e72490ac78ea837d5a0eebe88e4f89c160e15595a13
59102b63acf9c9ff9ec3ff18b5f4d209b757273971b919a63cbade5bf8ee0955
5b29f10d6e7c79c2f7f11b0abe16a4fb45e29673dababd29a0313d72aeaa90b5
5fbb36bdcd7fcb6a1962d355dccfab3262736d4d198a389ffb85a3fa3d2440d4
629db7e286c97c88af572b9ee82bf16a937f8916093adbe89f14f77ebf3ee79d
6310afc6b083799134ea872e83464c204f87e0963ec77d675f732682d6a06c67
677e71301ff7f0d87fe843b9f36498b4a17fe55e586678ae1f28a1ace250a7e0
67ff6efde17ddcd4d62c6c88b51c5abbe7611ed2660c19475907cae9d6dc8b87
6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41
73d269abb8a6ba50a6393840c5c5cff3bd149a14d638434b09cd38ff1268f08e
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
751dfa994586c27be7650077d1a09b37102a2e62ccbe0fee690de0b188c3a73b
769b19eab3e84c033798de35413dbdfb568d10ed2df959fb2a6d08ad9b1e30f2
78e0bdeabeebc2dc279c8a9321a3c05dfee71e89123ee3d480fb83fe9d308aed
7bf99bd072ef2181aaa53f2e5cebd463ff723828c971d8527a450ac48fcc54ff
7cf57286c8cbbdb9ef318c7995e10bf949ff11acf8447cee91b6de81fc01954f
7ee7784d217b273bd847dcc83ca3451f76f63cc1b619805dbdb297197bb44eb8
7ee9c0ca7888ff1dd612d41bdadd615d125f39e418e302938ee1826fcf397618
7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8276d99808a3a111dcb2dc61c895388c21341d48be9c3f87d905787a49c2b832
83cd4afc0672833e8ac46854de805cda18237894e6d5193111af3e2e866a7a3a
83d6a90d1dee1d91b0513febd572f8b5c807454c5c1c7baedf3cd5251ac7de07
85966d6ad60f407bebf565323325b29af0843549f174e3997a18fd5aa2c28d40
859e7bdcd95e7481128e01b5a7ff2fcf34a963198abaea0f0c483e40d22b2986
85f1dc7c35f47c67b139453f0221075ccd0848b444a1039fb1d2ba25a59b7e01
8634aa7a3ac0bc6d359b458c8922e9d3269f64c1355b329bfe215beb12773af8
889cdf19beb7becdeb19afc351dfd5e4e8f105757855c3302ddbc72736cd8cb1
891a6edbc3040f9b3b23062108409d20b4345e3179f3a9da3e5fdc195782befd
8a12cd1ba53519b9b8f531f062e149c5b29ddcf92c45df0c873ca6a21aa086f8
8c355a8b5683f9eb27b0c246df99fe03a3dd4a272cbc1f07c3e9e24a7102c105
8f9d1d205540e75fd9257075f1e7755cc5e515938c6ec9f8d02790ba8ff272f0
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
91f129dffdeeaeb889451c4e154e5ff8f1bef7b75aae9fbeb609240134db3f79
92f7c80607a7572d0ea06eb93f05e6e8e694b5f1ba282358d1f84c808ad42ff5
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9c7c023f91428234ca0ea4df1199758686f4dcd04da96ba63571788fb3389c0b
9d52143581e0975f5c1bc2d40cac0048e9e263c79870558261101d233aadfcb8
9e5f82b6a21c153c7a53016816d0bf95b246fc6e32ef8d31af0c15a78a96f6f7
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a256fccecac3b32ab73c91d79a18747519a1a18023be05465c933b03523a82e8
a2787eea78a4f9318c5b120447bae4ffd745940ec426bbb9823ac0bb285b9314
a3c216cefae59e5da3e9fd500ac9c3e09112a11ec45fd633d4f30ff3fb43f5e0
a48e3091c3e26309f1329bb7ee2812cf158deb93cd80fe6439e53e8d57e58d3d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
abc1bbfb097cfaf4715fe823adb40881f8ed35a943692d5c037945c2fcc56340
ac990171fc2a8993d659ce8f10bc0a7815c43835ba1dc00c2246f3556c6eeecd
ad1daeb0c017c11c68df7e8c08916788e2dcf248e26df4f032ba6c1e148b481e
ae707ec81b142f04b6d5f785a5d4f7e8301bdb62a95288dee1f3e58930d21c7a
b10bfc9c53a2434084d9cd393831c2156a885832ef7546d97f2cc8a8b0626a69
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3391b26fd634859b900670bddcdd8ef22a819e3581da050f15f48c85a15ba5c
b49498d1142de7f2e16afc2cd4250d2ba30c5df4de5d291f51d7cf69727efdbe
b5d0eed1e60aa4445314f7e0be635f86d2e6a23ad316e79f2a1581e1f4dc1bfa
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
b7b3466c38556660dac35c703097a6eaae49ff457b9fc028a1bb7f60cbdf1494
b826f485873b923a0a9046262b9d026e8f4d2094da1e98e527f279eb9b148d6c
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bb658d457ec9eac56e6c768b60984d74305f43f074b86b195fca535de22fc19c
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c00cb5412b8f34872361648db5c1ebab807985da31527f526d6148dbbf7e307c
c0901279dec1117310802c450665b34a60788da4a00e066d2de367327cd13456
c3b9547ad5efb844125a3f9751483384a257a2a3a33d34b461ef62ca61f0845d
c460b99f65b6c9db943bdee926064c37d4e1ea4f7f6309c958861e97d22f23d2
c8c8822e94a2b3c5499c8f59b28b11e83d2c31231806c11a7920e2f8e3457423
c9c508491a1780fe34dab43fcf7d248d76caf9008bba8b6d1d4cb30c1e2b1e45
ca365af1bccae26f47327961da261d6851977cd77fdade42589a3c8839cbdb75
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb60f9e875ef0083fcb612e02ea98bd1a4ee5063f923237f6786efe17695c8f0
cc3533e181e6e2e97e0bcfd2c8bbe98becc92d6b4338953ee4afdba5bc3dc10b
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd7dd964b1da1aa80ad7ba1d9f24bd0c709ff1d3312a8960b78dea94ca5a1379
cef56cfb50af106eee13a8077d15efd46d114217ffa7446463414fb8b25e028e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfb87103f40756d26814cb4495c3fcd634c42b6994e19b8b27ce080a39e739b2
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d20d28ad499e12da822dbbcba173c9a455951c98db09566e9e382634ad5ec402
d325476db806449106ec43620c920e7aae14b5193de849534ca479aebe8982ff
d3722344dc2b0b07af6a39d0594966bede1a0dbdf0e524795cc6aaab2a6e2845
dbdbacda218432f315ac3e50c11c793d3b095afce52955d97a56ef7bd680bd8e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd4993e5c6015cb663a4ff917d77897ed71deda6eedaed515b41326305b3ed72
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e45818350fb6700935c0dce924d8317b166845c5516bc391a1dbda39203f143a
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5bdc8836e401144476fe22b6fd05b2c6d1a94aea39564bc356ac9d09c39673c
e7a1375f883984026b922acfbe7cbc0bd02effdbfbfdde9354922a6055502624
eaa999e78a050cba8c477303c819fc31c6730bc1c23ed400924ef780033d9d68
ec4be0f885f8bf796aa356fc6e4fca12d0e620b3e160ee3a8b26f6ad2f877d2e
ed1449a3d34f0c975f912645da2e304003524c91ba5c80e3ab9907cf2768654e
edaa305a75e55c4bc4687fc43cc9778cb8c86cff4fae321402ea9494a0a605b4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f595c28d56b2d8e95e71397899294ef99962a42f36c086e323065a77b2a6b939
f7a69a2ab7aa55e3e41ba63a625ecfd3b6c00933a7e18d1f33275b83abd3bd8d
f7cb5beff11c072e487958613fdbb03c7386e1651906c5f45b76856dc901be7a

askleo.com Open in urlscan Pro 18.159.80.129 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

283 Requests

99 %HTTPS

39 %IPv6

46 Domains

56 Subdomains

37 IPs

11 Countries

1900 kBTransfer

5143 kBSize

8 Cookies

19 Outgoing links

Redirected requests

283 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

askleo.com Open in urlscan Pro
18.159.80.129 Public Scan

Screenshot
Live screenshot

Full Image

283
Requests

99 %
HTTPS

39 %
IPv6

46
Domains

56
Subdomains

37
IPs

11
Countries

1900 kB
Transfer

5143 kB
Size

8
Cookies

283 HTTP transactions
11 data transactions